Windows Analysis Report
MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Key value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon version

Source: dump_process.exe.14.dr

Binary string: Unable to get the path of the module!Unable to retrieve the path of the module!Unable to store the path of the module!Unable to retrieve a path of the known folder ({})!SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders%APPDATA%Common AppDataProgramFiles%LOCALAPPDATA%ProgramFilesDirSOFTWARE\Microsoft\Windows\CurrentVersionCommonProgramFilesCommonFilesDir\\?\Unable to enumerate volumes!Unable to retrieve volume paths for volume '{}'!Unable to convert NT path '{}' to a volume GUID path!\Device\Mup\\Device\LanmanRedirector\\SystemRoot\WSL ProcessCannot open registry key, it does not existsAttempt to execute operation on opened key which is scheduled for deletionDont have sufficient permissions to execute registry operationQuerying registry value, but queried different type than expectedString environment expansion failed due to unexpected buffer sizeString environment expansion failedCannot open registry keyCannot create registry keyUnable to open registry key handle using NtOpenKeyCannot delete registry keyCannot query kernel mode registry key pathCannot delete registry valueCannot delete registry key treeCannot write key valueCannot query registry value sizeCannot query registry valueCannot query registry data due to value changed too oftenCannot query registry value databad variant access

Source: classification engine

Classification label: mal64.rans.evad.winZIP@74/246@624/100

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5924
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{32B25EF2-80FD-4C66-97E1-0890D9E9F87B}

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe

File created: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: caffeine-1.5-installer_qak-fw1.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe

File read: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe

Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe"
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp "C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp" /SL5="$90070,837439,832512,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe"
Source: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe" /SPAWNWND=$3023E /NOTIFYWND=$90070
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp "C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp" /SL5="$90076,837439,832512,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe" /SPAWNWND=$3023E /NOTIFYWND=$90070
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrMpG6xzNiPw2zQDcpljgB1AnvPAw0qefblpEoa1wR4HgPPsGEupOsZXmbqoVTnBEo68S6u8u
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	Process created: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTtVrMpG6xzNiPw2zQDcpljgB1AnvPAw0qefblpEoa1wR4HgPPsGEupOsZXmbqoVTnBEo68S6u8u /cookie:mmm_irs_ppi_902_451_o /ga_clientid:6d11ded8-8432-4921-bfa3-224b760cd39e /edat_dir:C:\Windows\Temp\asw.5eb092b1255993ad
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gsf-fl.softonic.com/d49/077/a3289ae3596f269011fba85f3163074285/file?Expires=1702357011&Signature=40fec4ff0b920c54bdad2c59f008fa0ee38b0a46&url=https://caffeine.softonic.com.br&Filename=file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2016,i,3031805693453605639,1785818148905796408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 2788
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 2788
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=auction_worklet.mojom.AuctionWorkletService --lang=en-US --service-sandbox-type=service_with_jit --mojo-platform-channel-handle=7164 --field-trial-handle=2016,i,3031805693453605639,1785818148905796408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=auction_worklet.mojom.AuctionWorkletService --lang=en-US --service-sandbox-type=service_with_jit --mojo-platform-channel-handle=7184 --field-trial-handle=2016,i,3031805693453605639,1785818148905796408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe "C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp "C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp" /SL5="$90070,837439,832512,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp "C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp" /SL5="$90076,837439,832512,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe" /SPAWNWND=$3023E /NOTIFYWND=$90070	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrMpG6xzNiPw2zQDcpljgB1AnvPAw0qefblpEoa1wR4HgPPsGEupOsZXmbqoVTnBEo68S6u8u	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gsf-fl.softonic.com/d49/077/a3289ae3596f269011fba85f3163074285/file?Expires=1702357011&Signature=40fec4ff0b920c54bdad2c59f008fa0ee38b0a46&url=https://caffeine.softonic.com.br&Filename=file	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	Process created: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTtVrMpG6xzNiPw2zQDcpljgB1AnvPAw0qefblpEoa1wR4HgPPsGEupOsZXmbqoVTnBEo68S6u8u /cookie:mmm_irs_ppi_902_451_o /ga_clientid:6d11ded8-8432-4921-bfa3-224b760cd39e /edat_dir:C:\Windows\Temp\asw.5eb092b1255993ad	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2016,i,3031805693453605639,1785818148905796408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=auction_worklet.mojom.AuctionWorkletService --lang=en-US --service-sandbox-type=service_with_jit --mojo-platform-channel-handle=7164 --field-trial-handle=2016,i,3031805693453605639,1785818148905796408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=auction_worklet.mojom.AuctionWorkletService --lang=en-US --service-sandbox-type=service_with_jit --mojo-platform-channel-handle=7184 --field-trial-handle=2016,i,3031805693453605639,1785818148905796408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: Google Drive.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Window found: window name: TSelectLanguageForm

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Source: MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip

Static file information: File size 1221258 > 1048576

Source:	Binary string: C:\non_system\code\WebAdvisor-ISGIS\build\x64\Release\Installer.pdb source: installer.exe, 00000018.00000000.2979725249.00007FF7C5C9B000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_mod.pdb source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2789790902.00000000050BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_sfx.pdb source: avg_antivirus_free_online_setup.exe, 0000000E.00000002.3094097212.0000000004980000.00000002.00000001.00040000.0000000F.sdmp, avg_antivirus_free_online_setup.exe, 0000000E.00000000.2765079692.0000000000597000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\non_system\code\WebAdvisor-ISGIS\build\x64\Release\Installer.pdb, source: installer.exe, 00000018.00000000.2979725249.00007FF7C5C9B000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus_ui.pdb source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2850866277.0000000005453000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\SaBsi.pdb source: saBSI.exe, 0000000C.00000000.2734026343.000000000091E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe.11.dr
Source:	Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2888982009.0000000005130000.00000004.00000020.00020000.00000000.sdmp, dump_process.exe.14.dr
Source:	Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdb/ source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2808651594.00000000052E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdb source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2808651594.00000000052E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb source: avg_antivirus_free_setup.exe, 0000000D.00000000.2742965983.0000000000573000.00000002.00000001.01000000.0000000E.sdmp

Source: caffeine-1.5-installer_qak-fw1.tmp.6.dr	Static PE information: section name: .didata
Source: caffeine-1.5-installer_qak-fw1.tmp.10.dr	Static PE information: section name: .didata
Source: saBSI.exe.11.dr	Static PE information: section name: .didat
Source: avg_antivirus_free_setup.exe.11.dr	Static PE information: section name: .didat
Source: installer.exe.12.dr	Static PE information: section name: _RDATA
Source: avg_antivirus_free_online_setup.exe.13.dr	Static PE information: section name: .didat
Source: icarus_ui.exe.14.dr	Static PE information: section name: _RDATA
Source: dump_process.exe.14.dr	Static PE information: section name: .didat
Source: dump_process.exe.14.dr	Static PE information: section name: _RDATA
Source: bug_report.exe.14.dr	Static PE information: section name: _RDATA
Source: icarus.exe.14.dr	Static PE information: section name: .didat
Source: icarus.exe.14.dr	Static PE information: section name: _RDATA
Source: installer.exe.24.dr	Static PE information: section name: .didat
Source: installer.exe.24.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Code function: 11_2_00198480 push eax; ret	11_2_00198481
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Code function: 11_2_0019B806 push edi; retf 0000h	11_2_0019B807
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Code function: 11_2_0019845C push eax; ret	11_2_0019845D
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Code function: 11_2_0019A7FA push edi; retf 0020h	11_2_0019A803
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Code function: 11_2_0019C1FE push ebp; retf	11_2_0019C20E
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Code function: 11_2_0019D468 push eax; retf	11_2_0019D48A
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Code function: 11_2_0019C1ED push ebp; retf	11_2_0019C1F2

Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	File created: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	File created: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\dump_process.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp1545665699\installer.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\bug_report.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	File created: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus_mod.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus_ui.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	File created: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	File created: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\dump_process.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\bug_report.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus_mod.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus_ui.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus.exe	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	System information queried: FirmwareTableInformation			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2947800042.00000000050E9000.00000004.00000020.00020000.00000000.sdmp, product-def.xml.14.dr	Binary or memory string: <DEST>%PRODUCT_INST_A64%/ASWHOOK.DLL</DEST>
Source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2947800042.00000000050E9000.00000004.00000020.00020000.00000000.sdmp, product-def.xml.14.dr	Binary or memory string: <PATH>%PRODUCT_INST_32%\ASWHOOKX.DLL</PATH>
Source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2947800042.00000000050E9000.00000004.00000020.00020000.00000000.sdmp, product-def.xml.14.dr	Binary or memory string: <DEST>%PRODUCT_INST_32%/ASWHOOK.DLL</DEST>
Source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2947800042.00000000050E9000.00000004.00000020.00020000.00000000.sdmp, product-def.xml.14.dr	Binary or memory string: <DEST>%PRODUCT_INST_64%/ASWHOOK.DLL</DEST>

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\_isetup\_setup64.tmp

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp TID: 2512	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp TID: 2512	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe TID: 7052	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe TID: 4364	Thread sleep time: -90000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	File Volume queried: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	File Volume queried: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp FullSizeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: avg_antivirus_free_setup.exe, 0000000D.00000003.2761130460.0000000004720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWV
Source: caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2582388128.0000000000B90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\brand\\PRUC","Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\brand\\PRUG","Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\brand\\PRUI"],"cmdu":[{"utr":"HKEY_LOCAL_MACHINE","utk":"SOFTWARE\\AVG\\Browser","utvn":"UninstallTimestamp","utvt":"SZ","umd":40},{"utr":"HKEY_LOCAL_MACHINE","utk":"SOFTWARE\\Avast Software\\Browser","utvn":"UninstallTimestamp","utvt":"SZ","umd":40}],"cp":"https://www.avg.com/privacy","ctu":"https://www.avg.com/eula","ov":61,"pv":"1.24","v":3}},{"ad":{"n":"","f":"ZB_RAV_Cross_Solo_Soft","o":"RAV_Cross"},"ps":{"i":"RAV/images/ZB_RAV_Bisli_Logo_bcg_V2/DOTPS-588/EN.png","dn":"RAV Antivirus","u":"https://shield.reasonsecurity.com/rsStubActivator.exe","p":"-ip:\"dui={userid}&dit={sessionid}&is_silent=true&oc={of}&p={pubid}&a=100&b={ispb}&se=true\" -i","r":["ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvn":["HKCR\\ReasonPersistentStorage\\AvUninstallTime"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://reasonlabs.com/policies","ctu":"https://reasonlabs.com/policies","win64":true,"pv":"1.26","disk":250,"fe":["{commonpf64}\\ReasonLabs\\EPP\\InstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstaller.exe"],"ov":100,"x":10,"v":1}},{"ad":{"n":9,"nn":"Med_Ntiles","f":"ZB_Avast","o":"AVAST"},"ps":{"i":"AVAST/images/DOTPS-403/EN.png","dn":"Avasm
Source: caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000002.2930607929.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2766427808.00000000026D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2766800666.00000000026D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:}
Source: caffeine-1.5-installer_qak-fw1.tmp, 00000007.00000002.2981450652.00000000009ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y\|_
Source: caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000002.2930607929.0000000000B47000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2581188045.0000000000B35000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2589729169.0000000000B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000C.00000002.3084268274.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000C.00000002.3084268274.0000000002FD1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000C.00000003.2812576510.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000C.00000003.2754355296.0000000002FCD000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000D.00000003.2761130460.0000000004740000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000D.00000003.2761802069.000000000474A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000D.00000002.3083561955.0000000004748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2767292773.00000000026E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:"W
Source: caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2581188045.0000000000B35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.Q
Source: avg_antivirus_free_online_setup.exe, 0000000E.00000002.3099496810.0000000004E50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /icarus-info-path:C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\icarus-info.xml /install /silent /ws /psh:92pTtVrMpG6xzNiPw2zQDcpljgB1AnvPAw0qefblpEoa1wR4HgPPsGEupOsZXmbqoVTnBEo68S6u8u /cookie:mmm_irs_ppi_902_451_o /track-guid:6d11ded8-8432-4921-bfa3-224b760cd39e /edat_dir:C:\Windows\Temp\asw.5eb092b1255993ade33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736ez
Source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2767488341.00000000026E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll+
Source: caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2582443030.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rosoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvn":["HKCR\\ReasonPersistentStorage\\AvUni
Source: avg_antivirus_free_online_setup.exe, 0000000E.00000003.2765975295.00000000026BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:}#^
Source: caffeine-1.5-installer_qak-fw1.tmp, 00000007.00000002.2981450652.00000000009ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y7^
Source: avg_antivirus_free_setup.exe, 0000000D.00000002.3083561955.00000000046A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@)r

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrMpG6xzNiPw2zQDcpljgB1AnvPAw0qefblpEoa1wR4HgPPsGEupOsZXmbqoVTnBEo68S6u8u	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gsf-fl.softonic.com/d49/077/a3289ae3596f269011fba85f3163074285/file?Expires=1702357011&Signature=40fec4ff0b920c54bdad2c59f008fa0ee38b0a46&url=https://caffeine.softonic.com.br&Filename=file	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	Process created: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTtVrMpG6xzNiPw2zQDcpljgB1AnvPAw0qefblpEoa1wR4HgPPsGEupOsZXmbqoVTnBEo68S6u8u /cookie:mmm_irs_ppi_902_451_o /ga_clientid:6d11ded8-8432-4921-bfa3-224b760cd39e /edat_dir:C:\Windows\Temp\asw.5eb092b1255993ad	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp "c:\users\user\appdata\local\temp\is-rp58k.tmp\caffeine-1.5-installer_qak-fw1.tmp" /sl5="$90076,837439,832512,c:\users\user\appdata\local\temp\temp1_mde_file_sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe" /spawnwnd=$3023e /notifywnd=$90070
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	Process created: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe "c:\windows\temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pttvrmpg6xznipw2zqdcpljgb1anvpaw0qefblpeoa1wr4hgppsgeuposzxmbqovtnbeo68s6u8u /cookie:mmm_irs_ppi_902_451_o /ga_clientid:6d11ded8-8432-4921-bfa3-224b760cd39e /edat_dir:c:\windows\temp\asw.5eb092b1255993ad
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp "c:\users\user\appdata\local\temp\is-rp58k.tmp\caffeine-1.5-installer_qak-fw1.tmp" /sl5="$90076,837439,832512,c:\users\user\appdata\local\temp\temp1_mde_file_sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe" /spawnwnd=$3023e /notifywnd=$90070	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	Process created: C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe "c:\windows\temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pttvrmpg6xznipw2zqdcpljgb1anvpaw0qefblpeoa1wr4hgppsgeuposzxmbqovtnbeo68s6u8u /cookie:mmm_irs_ppi_902_451_o /ga_clientid:6d11ded8-8432-4921-bfa3-224b760cd39e /edat_dir:c:\windows\temp\asw.5eb092b1255993ad	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\mainlogo.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\WebAdvisor.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\AVG_AV.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\v.png VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	12 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	1 Software
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	321 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	13 Virtualization/Sandbox Evasion	Security Account Manager	13 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Disable or Modify Tools	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	5 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
C:\Program Files\McAfee\Temp1545665699\installer.exe	0%	ReversingLabs
C:\Program Files\McAfee\Temp1545665699\installer.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp	7%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp	7%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\_isetup\_setup64.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe	1%	Virustotal	Browse
C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\bug_report.exe	0%	ReversingLabs
C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\bug_report.exe	0%	Virustotal	Browse
C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\dump_process.exe	0%	ReversingLabs
C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\dump_process.exe	0%	Virustotal	Browse
C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus.exe	0%	ReversingLabs
C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus.exe	0%	Virustotal	Browse
C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus_mod.dll	0%	ReversingLabs
C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus_mod.dll	1%	Virustotal	Browse
C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus_ui.exe	0%	ReversingLabs
C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus_ui.exe	0%	Virustotal	Browse
C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
id5-sync.com	0%	Virustotal	Browse
sync.ex.co	0%	Virustotal	Browse
softonic.com.br	0%	Virustotal	Browse
pugm-vac.pubmnet.com	0%	Virustotal	Browse
sync-unosync-com.geodns.me	0%	Virustotal	Browse
sync1.intentiq.com	0%	Virustotal	Browse
sync.intentiq.com	0%	Virustotal	Browse
m.deepintent.com	0%	Virustotal	Browse
bttrack.com	0%	Virustotal	Browse
match.prod.bidr.io	0%	Virustotal	Browse
rtb.adgrx.com	0%	Virustotal	Browse
api.btloader.com	0%	Virustotal	Browse
thrtle.com	1%	Virustotal	Browse
cx.serverbid.com	0%	Virustotal	Browse
core.iprom.net	0%	Virustotal	Browse
sync-dmp.mobtrakk.com	0%	Virustotal	Browse
sync.ipredictive.com	0%	Virustotal	Browse
cdn.id5-sync.com	0%	Virustotal	Browse
lb.eu-1-id5-sync.com	0%	Virustotal	Browse
rtb.adentifi.com	0%	Virustotal	Browse
match.adsby.bidtheatre.com	0%	Virustotal	Browse
tr.blismedia.com	0%	Virustotal	Browse
matching.truffle.bid	0%	Virustotal	Browse
ad.mrtnsvr.com	0%	Virustotal	Browse
ad-delivery.net	0%	Virustotal	Browse
us01.z.antigena.com	0%	Virustotal	Browse
spug-njrpb.pubmnet.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent=	0%	URL Reputation	safe
http://www.avast.com0/	0%	URL Reputation	safe
https://www.softonic.com.br/windows/calculadoras-conversores	0%	Avira URL Cloud	safe
https://www.softonic.com.br/artigos/acabou-o-relacionamento-mais-bonito-dos-videogames-lol-e-amazon-	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
https://match.deepintent.com/usersync/143?gdpr=0&us_privacy=1---	0%	Avira URL Cloud	safe
https://reasonlabs.com/policiesE	0%	Avira URL Cloud	safe
https://www.innosetup.com/	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/medicina	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/previsao-do-tempo	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/calculadoras-conversores	0%	Virustotal		Browse
https://home.mcaf	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/video	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/manuais-tutoriais	0%	Avira URL Cloud	safe
https://prebid.a-mo.net/setuid/magnite?uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1---	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/medicina	0%	Virustotal		Browse
https://slimdrivers.softonic.com.br	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/video	0%	Virustotal		Browse
https://sysinspire-7z-password-recovery.softonic.com.br	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/cassino	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/manuais-tutoriais	0%	Virustotal		Browse
https://reasonlabs.com/policiesE	0%	Virustotal		Browse
https://www.innosetup.com/	2%	Virustotal		Browse
https://roblox.softonic.com.br/jogos	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/previsao-do-tempo	0%	Virustotal		Browse
https://www.softonic.com.br/windows	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/internet-rede	0%	Avira URL Cloud	safe
https://sync.spotim.market/csync?t=a&ep=281178&extuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&traffic_source=snippet&session=14A0FC939D6A6483&sp=750078&pb=612004&c=570607&a=281178&domain=visitor.omnitagjs.com	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/musica	0%	Avira URL Cloud	safe
https://mouse-jiggler.softonic.com.br	0%	Avira URL Cloud	safe
https://roblox.softonic.com.br/jogos	0%	Virustotal		Browse
https://www.softonic.com.br/windows/cassino	0%	Virustotal		Browse
https://www.softonic.com.br/windows/internet-rede	0%	Virustotal		Browse
https://id5-sync.com/g/v2/691.json	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows	0%	Virustotal		Browse
https://sadownload.mcafeA	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/cursores-fontes	0%	Avira URL Cloud	safe
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQC4ZCY6-1I-JWAU	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/ensino-treinamento	0%	Avira URL Cloud	safe
https://mouse-jiggler.softonic.com.br	0%	Virustotal		Browse
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=fmx	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/cursores-fontes	0%	Virustotal		Browse
https://www.softonic.com.br/windows/gerenciadores-download	0%	Avira URL Cloud	safe
https://www.softonic.com.br/windows/musica	0%	Virustotal		Browse
https://www.softonic.com.br/windows/ensino-treinamento	0%	Virustotal		Browse
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=fmx	0%	Virustotal		Browse
https://slimdrivers.softonic.com.br	0%	Virustotal		Browse
https://www.softonic.com.br/windows/gerenciadores-download	0%	Virustotal		Browse
https://id5-sync.com/g/v2/691.json	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
um.simpli.fi	35.236.220.17	true	false		high
rtb-csync-use1.smartadserver.com	23.105.14.106	true	false		high
global.px.quantserve.com	192.184.68.215	true	false		high
cm119.appier.org	172.105.220.23	true	false		high
id5-sync.com	162.19.138.116	true	false	0%, Virustotal, Browse	unknown
us-east-eb2.3lift.com	52.223.22.214	true	false		high
cs.admanmedia.com	80.77.87.166	true	false		high
prebid.media.net	34.120.63.153	true	false		high
pixel-a.sitescout.com	207.198.113.203	true	false		high
live.rezync.com	18.239.225.91	true	false		high
rtb.openx.net	35.186.253.211	true	false		high
bttrack.com	192.132.33.69	true	false	0%, Virustotal, Browse	unknown
hb-api-us-west-2.omnitagjs.com	44.231.162.210	true	false		high
stats.g.doubleclick.net	173.194.219.154	true	false		high
cdn.w55c.net	54.157.11.141	true	false		high
sync.ex.co	34.194.40.200	true	false	0%, Virustotal, Browse	unknown
crb.kargo.com	34.230.139.192	true	false		high
r.casalemedia.com	172.64.151.101	true	false		high
dsum.casalemedia.com	172.64.151.101	true	false		high
lga-direct-bgp.contextweb.com	198.148.27.131	true	false		high
www.google.com	142.250.189.132	true	false		high
syncelb-240036109.us-east-1.elb.amazonaws.com	34.224.234.201	true	false		high
api-2-0.spot.im	65.8.178.13	true	false		high
sync.intentiq.com	65.8.248.118	true	false	0%, Virustotal, Browse	unknown
lb.eu-1-id5-sync.com	162.19.138.119	true	false	0%, Virustotal, Browse	unknown
tagr-gcp-odr-use1.mookie1.com	35.190.90.30	true	false		high
id.rlcdn.com	35.244.154.8	true	false		high
idaas6.cph.liveintent.com	3.223.167.169	true	false		high
bcp.crwdcntrl.net	174.129.88.64	true	false		high
sync1.intentiq.com	65.8.248.42	true	false	0%, Virustotal, Browse	unknown
match.adsrvr.org	15.197.193.217	true	false		high
rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com	44.193.120.159	true	false		high
softonic.com.br	35.227.233.104	true	false	0%, Virustotal, Browse	unknown
match.prod.bidr.io	52.7.115.91	true	false	0%, Virustotal, Browse	unknown
pagead-googlehosted.l.google.com	192.178.50.33	true	false		high
creativecdn.com	185.184.8.90	true	false		high
widget.va1.vip.prod.criteo.com	74.119.119.150	true	false		high
pugm-vac.pubmnet.com	8.28.7.81	true	false	0%, Virustotal, Browse	unknown
m.deepintent.com	169.197.150.7	true	false	0%, Virustotal, Browse	unknown
events-ssc.33across.com	34.117.239.71	true	false		high
sync-unosync-com.geodns.me	23.227.146.18	true	false	0%, Virustotal, Browse	unknown
d2e9lx3tt9d5g4.cloudfront.net	18.64.171.94	true	false		high
d1ykf07e75w7ss.cloudfront.net	65.8.27.208	true	false		high
ssum-sec.casalemedia.com	172.64.151.101	true	false		high
googleads.g.doubleclick.net	142.250.189.130	true	false		high
rtb.adgrx.com	173.231.178.83	true	false	0%, Virustotal, Browse	unknown
clients.l.google.com	192.178.50.46	true	false		high
match-us-east-1-ecs.sharethrough.com	34.227.128.134	true	false		high
config.aps.amazon-adsystem.com	108.157.162.90	true	false		high
googlehosted.l.googleusercontent.com	142.250.189.129	true	false		high
syncsc.aniview.com	96.46.186.182	true	false		high
hb.yahoo.net	23.193.106.169	true	false		high
api.btloader.com	130.211.23.194	true	false	0%, Virustotal, Browse	unknown
www.googletagservices.com	142.250.217.194	true	false		high
nlb-home-mcafee-7e003388d1151bba.elb.us-west-2.amazonaws.com	44.238.140.201	true	false		high
de.tynt.com	67.202.105.33	true	false		high
adservice.google.com	192.178.50.34	true	false		high
hde.tynt.com	67.202.105.32	true	false		high
core.iprom.net	195.5.165.20	true	false	0%, Virustotal, Browse	unknown
idsync.rlcdn.com	35.244.154.8	true	false		high
sync.richaudience.com	162.55.236.225	true	false		high
rtb.adentifi.com	54.198.64.103	true	false	0%, Virustotal, Browse	unknown
cx.serverbid.com	159.89.246.130	true	false	0%, Virustotal, Browse	unknown
ad.mrtnsvr.com	34.102.163.6	true	false	0%, Virustotal, Browse	unknown
sync.srv.stackadapt.com	54.224.142.7	true	false		high
synchroscript.deliveryengine.adswizz.com	13.32.87.73	true	false		high
thrtle.com	44.197.22.251	true	false	1%, Virustotal, Browse	unknown
io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com	52.4.146.202	true	false		high
cdn.id5-sync.com	172.67.38.106	true	false	0%, Virustotal, Browse	unknown
pixel.tapad.com	34.111.113.62	true	false		high
sync.adotmob.com	45.137.176.88	true	false		high
a.nel.cloudflare.com	35.190.80.1	true	false		high
ssp.ads.betweendigital.com	172.240.127.128	true	false		high
pippio.com	107.178.254.65	true	false		high
sync.ipredictive.com	52.86.247.227	true	false	0%, Virustotal, Browse	unknown
accounts.google.com	192.178.50.45	true	false		high
sync-dmp.mobtrakk.com	5.161.124.197	true	false	0%, Virustotal, Browse	unknown
ad.doubleclick.net	192.178.50.70	true	false		high
s.amazon-adsystem.com	52.46.128.147	true	false		high
aax-eu.amazon-adsystem.com	54.239.38.253	true	false		high
ssbsync-use1.smartadserver.com	216.22.16.4	true	false		high
ad-delivery.net	104.26.3.70	true	false	0%, Virustotal, Browse	unknown
ipac.ctnsnet.com	35.186.193.173	true	false		high
spug-njrpb.pubmnet.com	162.248.18.34	true	false	0%, Virustotal, Browse	unknown
outspot2-ams.adx.opera.com	82.145.213.8	true	false		high
shepherd-gcp.ff.avast.com	34.160.176.28	true	false		high
match.adsby.bidtheatre.com	64.227.64.62	true	false	0%, Virustotal, Browse	unknown
d1wsawskf2klzj.cloudfront.net	13.32.87.66	true	false		high
ib.anycast.adnxs.com	68.67.179.164	true	false		high
ssbsync-usw1.smartadserver.com	23.83.76.38	true	false		high
us01.z.antigena.com	40.76.134.238	true	false	0%, Virustotal, Browse	unknown
matching.truffle.bid	23.88.86.2	true	false	0%, Virustotal, Browse	unknown
aorta.clickagy.com	52.20.73.112	true	false		high
uipus.semasio.net	50.57.31.206	true	false		high
tr.blismedia.com	34.96.105.8	true	false	0%, Virustotal, Browse	unknown
s.dsp-prod.demandbase.com	34.96.71.22	true	false		high
mosaic-nova.apis.mcafee.com	35.167.194.178	true	false		high
d20qwf0wrdtevy.cloudfront.net	18.239.225.41	true	false		high
prebid-s2s.media.net	34.107.148.139	true	false		high
na-ice.360yield.com	50.19.31.61	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cs.admanmedia.com/73c1e1bfc3bde354d60b80e601ae3914.gif?puid=[UID]&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D164%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=&coppa=	false		high
https://cm.ctnsnet.com/int/cm?exc=19&us_privacy=1---	false		high
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7	false		high
https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=	false		high
https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID	false		high
https://um.simpli.fi/lj_match?r=1702977747746&gdpr=0&gdpr_consent=	false		high
about:blank	false	Avira URL Cloud: safe	low
https://analytics.google.com/g/collect?v=2&tid=G-R5K71YRXMV&gtm=45je3bt0v877889940z86335967&_p=1702977735272&gcd=11l1l1l1l1&dma=0&tcfd=10000&cid=430166992.1702977739&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&_s=2&sid=1702977739&sct=1&seg=0&dl=https%3A%2F%2Fcaffeine.softonic.com.br%2F&dt=Caffeine%20-%20Download&en=di_request&ep.page_type=program_page&ep.site_language=pt&ep.google_click_id=&ep.test_variant=&ep.pv=undefined&ep.source_details=test&ep.suitable_campaigns=winzip-compression%2Cavast-backup%2Ccarbonate-browser%2Cnorton-secure-browser&ep.detected_country=US&_et=4&tfd=11954	false		high
https://csync.smilewanted.com/getuid?source=openrtb&zoneCode=openrtb_adyoulike&redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DSMILE_WANTED%26ttl%3D720%26uid%3De77031af9e62c4ae76bee5b9517c4ef4%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	false		high
https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D33%26xu%3D%24UID	false		high
https://sync.richaudience.com/dcf3528a0b8aa83634892d50e91c306e/?ord=3082303562	false		high
https://match.deepintent.com/usersync/143?gdpr=0&us_privacy=1---	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AeKPYwwEzYTl0vFkak-Nivy76IhRWJ6Epwfm2-9737o2Ax0IqMG9gYCi9i8z7-6qzqMYps7BEGbdumj59NI_I5desPPmraNRFEpQrkAr3hqDtY5mySkLogDGUprlngEXn3EeC7UEwlT-LpTWC-HVz-o/FHEOGGKFDFCHFPHCEEIFDBEPAOOICAHO_8_1_0_4445.crx	false		high
https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent=	false	URL Reputation: safe	unknown
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7	false		high
https://ce.lijit.com/beacon?us_privacy=1---&informer=13461259	false		high
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0&us_privacy=1---	false		high
https://ups.analytics.yahoo.com/ups/58160/sync?_origin=1&uid=LQC4ZCY6-1I-JWAU&redir=true&gdpr=0&us_privacy=1---	false		high
https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM	false		high
https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_BANNER%26ttl%3D720%26uid%3Dbdef6bd95b7450b4e62a32db8c7d8c9d%26visitor%3D__ZUID__%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	false		high
https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_user_id=ZYFg05BR8MuggUMSNtG2uQAA	false		high
https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=	false		high
https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=	false		high
https://ce.lijit.com/merge?pid=16&3pid=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent=	false		high
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=	false		high
https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=	false		unknown
https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAMuYJiaSQd8gNFY4WpAAAAAAA&ts=1702977763&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=	false		high
https://visitor.omnitagjs.com/visitor/sync?uid=9276a8c8d010b77af50144c60047b781&visitor=5184721251378344538&name=SMARTADSERVER&gdpr=0&gdpr_consent=	false		high
https://prebid.a-mo.net/setuid/magnite?uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1---	false	Avira URL Cloud: safe	unknown
https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=	false		high
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=M2Q2ZDU3NWQ1MzFmZGEzNDFmMzYzZmM3NmFlNTcwYjljZTk2MDQyOQ&gdpr=0&us_privacy=1---	false		high
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7	false		high
https://crb.kargo.com/api/v1/dsync/Martin?exid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=	false		high
https://ce.lijit.com/merge?pid=97&3pid=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&us_privacy=1---	false		high
https://sync.spotim.market/csync?t=a&ep=281178&extuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&traffic_source=snippet&session=14A0FC939D6A6483&sp=750078&pb=612004&c=570607&a=281178&domain=visitor.omnitagjs.com	false	Avira URL Cloud: safe	unknown
https://t.adx.opera.com/pub/sync?pubid=pub10014056052800&gdpr=0&gdpr_consent=	false		high
https://ssbsync-us.smartadserver.com/api/sync?callerId=2&gdpr=0	false		high
https://id5-sync.com/g/v2/691.json	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sync.richaudience.com/dcf3528a0b8aa83634892d50e91c306e/?ord=3082303562&rd=1	false		high
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&redir=true&gdpr=0&gdpr_consent=&verify=true	false		high
https://sync.targeting.unrulymedia.com/csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%26us_privacy%3D1---	false		high
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQC4ZCY6-1I-JWAU	false	Avira URL Cloud: safe	unknown
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=fmx	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api.js	false		high
https://csync.loopme.me/?pubid=11480&redirect=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3D68c72dd412a8d0f3f6d2276db2509939%26name%3DLOOPME%26visitor%3D%7Bdevice_id%7D%0A&gdpr=0&gdpr_consent=	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fr.softonic.com	chromecache_173.16.dr	false		high
https://reasonlabs.com/policiesE	caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2582443030.0000000000B7A000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000002.2930607929.0000000000B7A000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2581188045.0000000000B35000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2589729169.0000000000B7A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.softonic.com.br/windows/calculadoras-conversores	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images.sftcdn.net/images/t_app-icon-s/p/965565ac-96d3-11e6-9f43-00163ed833e7/2888512785/auto	chromecache_173.16.dr	false		high
https://images.sftcdn.net/images/t_app-icon-m/p/f46a4db4-96d4-11e6-b215-00163ec9f5fa/3261177456/caff	chromecache_173.16.dr	false		high
https://www.softonic.com.br/artigos/acabou-o-relacionamento-mais-bonito-dos-videogames-lol-e-amazon-	chromecache_173.16.dr	false	Avira URL Cloud: safe	unknown
http://clients2.google.com/service/update2/crxv	saBSI.exe, 0000000C.00000002.3084268274.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d2e9lx3tt9d5g4.cloudfront.net/zbdtmp	caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000002.2930607929.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://honzik.avcdn.net/defs/avg-av/release.xml.lzma	avg_antivirus_free_online_setup.exe, 0000000E.00000003.2773737529.0000000002744000.00000004.00000020.00020000.00000000.sdmp	false		high
https://images.sftcdn.net/images/t_app-icon-s/p/1abdcd3e-c3c1-496a-a6eb-6b415cef852a/3643405520/hp-p	chromecache_173.16.dr	false		high
http://clients2.google.com/service/update2/crxi	saBSI.exe, 0000000C.00000002.3084268274.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://idsync.rlcdn.com/712188.gif?partner_uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_con	chromecache_225.16.dr	false		high
https://www.avg.com/ww-en/eula/en-us/	caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2740844974.0000000005694000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000002.2952491009.000000000569A000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2742107623.000000000569A000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2741347685.0000000005695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F/gdpr=0/gdpr_	chromecache_225.16.dr	false		high
https://dev-support.softonic.com/customer/en/portal/articles?b_id=5424	chromecache_173.16.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_181.16.dr	false		high
https://www.innosetup.com/	caffeine-1.5-installer_qak-fw1.exe, 00000006.00000003.2519641735.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.exe, 00000006.00000003.2517503839.00000000028B0000.00000004.00001000.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 00000007.00000000.2521343787.0000000000401000.00000020.00000001.01000000.00000005.sdmp, caffeine-1.5-installer_qak-fw1.tmp.10.dr, caffeine-1.5-installer_qak-fw1.tmp.6.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.mcafee.com/consumer/en-us/policy/legal.html7218ac02d253f25f93sZXmbqoVTnBEo68S6u8udll	caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2790008019.000000000566F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.softonic.com.br/windows/medicina	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.softonic.com.br/windows/previsao-do-tempo	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images.sftcdn.net/images/t_app-icon-s/p/25d85da2-3518-4990-8c6b-7dd62176d833/455719081/hp-en	chromecache_173.16.dr	false		high
https://images.sftcdn.net/images/t_app-icon-s/p/6512042b-c170-4f25-86f8-399702cd0cc4/455719081/hp-of	chromecache_173.16.dr	false		high
https://shield.reasonsecurity.com/rsStubActivator.exem	caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000002.2930607929.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2581188045.0000000000B35000.00000004.00000020.00020000.00000000.sdmp	false		high
https://home.mcafee.com/Root/AboutF&A	caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2581188045.0000000000B35000.00000004.00000020.00020000.00000000.sdmp	false		high
https://home.mcaf	caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2582443030.0000000000B7A000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2581188045.0000000000B35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.softonic.com.br/windows/video	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://honzik.avcdn.net/setup/avg-av/release/avg_antivirus_free_online_setup.exe	avg_antivirus_free_setup.exe, 0000000D.00000002.3083561955.00000000046EF000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000D.00000003.2761802069.0000000004725000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000D.00000003.2761130460.0000000004720000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000D.00000003.2761130460.00000000046EE000.00000004.00000020.00020000.00000000.sdmp, config.def.edat.14.dr	false		high
https://www.softonic.com.br/windows/manuais-tutoriais	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://slimdrivers.softonic.com.br	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sysinspire-7z-password-recovery.softonic.com.br	chromecache_173.16.dr	false	Avira URL Cloud: safe	unknown
https://www.softonic.com.br/windows/cassino	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://roblox.softonic.com.br/jogos	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.softonic.com.br/windows	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://home.mcafee.com/Root/AboutUs.aspxH	caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2581109578.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.softonic.com.br/windows/internet-rede	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.softonic.com.br/windows/musica	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mouse-jiggler.softonic.com.br	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sadownload.mcafeA	saBSI.exe, 0000000C.00000003.2782352894.0000000005730000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=	chromecache_267.16.dr	false		high
https://www.softonic.com.br/windows/cursores-fontes	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/	chromecache_197.16.dr, chromecache_184.16.dr	false		high
https://images.sftcdn.net/images/t_app-icon-m/p/5a774982-1176-4f31-8739-d907a62a3b75/455719081/hp-de	chromecache_173.16.dr	false		high
https://token.rubiconproject.com/khaos.json?	chromecache_287.16.dr	false		high
http://www.avast.com0/	caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2740844974.0000000005679000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000002.2945531603.0000000005300000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000D.00000003.2761068138.0000000004786000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000E.00000003.2912532042.000000000521B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000E.00000002.3094097212.0000000004980000.00000002.00000001.00040000.0000000F.sdmp, avg_antivirus_free_online_setup.exe, 0000000E.00000003.2850866277.0000000005453000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000E.00000003.2888982009.0000000005130000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000E.00000003.2808651594.00000000052E2000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000E.00000003.2789790902.00000000050BE000.00000004.00000020.00020000.00000000.sdmp, dump_process.exe.14.dr	false	URL Reputation: safe	unknown
https://github.com/google/safevalues/issues	chromecache_190.16.dr	false		high
https://sc.sftcdn.net/fonts/c58b8-2a3dd.eot	chromecache_173.16.dr	false		high
https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRulesISB.xml/	saBSI.exe, 0000000C.00000003.2812576510.000000000302B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000C.00000003.2786694590.0000000003032000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cloud.google.com/contact	chromecache_181.16.dr	false		high
https://hello.softonic.com/privacy-policyion	caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2589729169.0000000000B76000.00000004.00000020.00020000.00000000.sdmp, caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000002.2930607929.0000000000B76000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sc.sftcdn.net/fonts/26316-86a0f.eot	chromecache_173.16.dr	false		high
https://www.softonic.com.br/windows/ensino-treinamento	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images.sftcdn.net/images/t_app-icon-s/p/0ef0ab2d-eea0-4e45-9e58-6e88dd0d25cb/455719081/hp-pa	chromecache_173.16.dr	false		high
https://sc.sftcdn.net/images/71dea-14daa.svg	chromecache_173.16.dr	false		high
https://www.mcafee.com/consumer/en-us/policy/legal.htmls/880/update2/EN.png13A	caffeine-1.5-installer_qak-fw1.tmp, 0000000B.00000003.2589729169.0000000000B48000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.softonic.com.br/windows/gerenciadores-download	chromecache_173.16.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.72.45.103	unknown	United States	14618	AMAZON-AESUS	false
216.22.16.4	ssbsync-use1.smartadserver.com	United States	30633	LEASEWEB-USA-WDCUS	false
130.211.23.194	api.btloader.com	United States	15169	GOOGLEUS	false
173.194.219.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
35.236.220.17	um.simpli.fi	United States	15169	GOOGLEUS	false
172.240.127.128	ssp.ads.betweendigital.com	United States	7979	SERVERS-COMUS	false
35.71.131.137	unknown	United States	237	MERIT-AS-14US	false
159.89.246.130	cx.serverbid.com	United States	14061	DIGITALOCEAN-ASNUS	false
142.250.189.130	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.189.132	www.google.com	United States	15169	GOOGLEUS	false
178.128.135.204	rt.marphezis.com	Netherlands	14061	DIGITALOCEAN-ASNUS	false
69.90.254.78	ums.acuityplatform.com	Canada	13768	COGECO-PEER1CA	false
142.250.64.166	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
52.4.146.202	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
131.153.148.26	unknown	United States	19437	SS-ASHUS	false
211.120.53.201	tg.dr.socdm.com	Japan	4694	IDCFIDCFrontierIncJP	false
38.98.69.175	pmp.mxptint.net	United States	174	COGENT-174US	false
162.19.138.120	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
34.200.65.202	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud	United States	14618	AMAZON-AESUS	false
3.94.183.232	rtb.gumgum.com	United States	14618	AMAZON-AESUS	false
208.115.232.150	shb.richaudience.com	United States	46475	LIMESTONENETWORKSUS	false
44.197.22.251	thrtle.com	United States	14618	AMAZON-AESUS	false
104.22.74.216	btloader.com	United States	13335	CLOUDFLARENETUS	false
54.239.38.253	aax-eu.amazon-adsystem.com	United States	16509	AMAZON-02US	false
23.83.76.38	ssbsync-usw1.smartadserver.com	United States	395954	LEASEWEB-USA-LAX-11US	false
162.19.138.119	lb.eu-1-id5-sync.com	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
35.163.115.57	visitor-us-west-2.omnitagjs.com	United States	16509	AMAZON-02US	false
52.7.115.91	match.prod.bidr.io	United States	14618	AMAZON-AESUS	false
162.19.138.116	id5-sync.com	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
151.101.193.108	prod.appnexus.map.fastly.net	United States	54113	FASTLYUS	false
35.207.24.140	dorpat.geo.iponweb.net	United States	19527	GOOGLE-2US	false
45.137.176.88	sync.adotmob.com	Spain	60350	VPFR	false
23.105.12.143	unknown	United States	30633	LEASEWEB-USA-WDCUS	false
65.8.178.13	api-2-0.spot.im	United States	16509	AMAZON-02US	false
34.225.234.246	sync.crwdcntrl.net	United States	14618	AMAZON-AESUS	false
40.76.134.238	us01.z.antigena.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
44.207.23.148	ds-pr-bh.ybp.gysm.yahoodns.net	United States	14618	AMAZON-AESUS	false
34.96.71.22	s.dsp-prod.demandbase.com	United States	15169	GOOGLEUS	false
34.230.139.192	crb.kargo.com	United States	14618	AMAZON-AESUS	false
13.226.54.207	www.datadoghq-browser-agent.com	United States	16509	AMAZON-02US	false
104.18.36.155	htlb.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
104.18.38.76	js-sec.indexww.com	United States	13335	CLOUDFLARENETUS	false
104.36.115.111	gob-njr3.pubmnet.com	United States	62713	AS-PUBMATICUS	false
216.219.92.22	inv-nets.admixer.net	United States	19318	IS-AS-1US	false
82.145.213.8	outspot2-ams.adx.opera.com	United Kingdom	39832	NO-OPERANO	false
192.178.50.78	unknown	United States	15169	GOOGLEUS	false
35.214.128.77	envoy-hl.envoy-csync1.core-b8mf.ov1o.com	United States	19527	GOOGLE-2US	false
69.175.41.15	unknown	United States	32475	SINGLEHOP-LLCUS	false
52.20.73.112	aorta.clickagy.com	United States	14618	AMAZON-AESUS	false
68.67.161.208	unknown	United States	29990	ASN-APPNEXUS	false
172.64.151.101	r.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
50.19.31.61	na-ice.360yield.com	United States	14618	AMAZON-AESUS	false
172.217.3.68	unknown	United States	15169	GOOGLEUS	false
67.202.105.33	de.tynt.com	United States	32748	STEADFASTUS	false
35.167.194.178	mosaic-nova.apis.mcafee.com	United States	16509	AMAZON-02US	false
67.202.105.32	hde.tynt.com	United States	32748	STEADFASTUS	false
192.178.50.70	ad.doubleclick.net	United States	15169	GOOGLEUS	false
35.227.233.104	softonic.com.br	United States	15169	GOOGLEUS	false
172.217.3.66	securepubads46.g.doubleclick.net	United States	15169	GOOGLEUS	false
34.96.105.8	tr.blismedia.com	United States	15169	GOOGLEUS	false
192.132.33.69	bttrack.com	United States	18568	BIDTELLECTUS	false
162.248.18.32	imgsync-njrpb.pubmnet.com	United States	62713	AS-PUBMATICUS	false
162.248.18.34	spug-njrpb.pubmnet.com	United States	62713	AS-PUBMATICUS	false
162.55.236.225	sync.richaudience.com	United States	35893	ACPCA	false
35.186.253.211	rtb.openx.net	United States	15169	GOOGLEUS	false
34.111.113.62	pixel.tapad.com	United States	15169	GOOGLEUS	false
35.186.193.173	ipac.ctnsnet.com	United States	15169	GOOGLEUS	false
8.2.110.134	cs.krushmedia.com	United States	46636	NATCOWEBUS	false
68.67.179.164	ib.anycast.adnxs.com	United States	29990	ASN-APPNEXUS	false
69.194.240.13	sync.1rx.io	United States	6336	TURN-US-ASNUS	false
34.107.140.113	s2s.t13.io	United States	15169	GOOGLEUS	false
52.89.73.205	unknown	United States	16509	AMAZON-02US	false
65.8.178.46	sdk.privacy-center.org	United States	16509	AMAZON-02US	false
35.244.154.8	id.rlcdn.com	United States	15169	GOOGLEUS	false
69.175.41.32	nase.vap.lijit.com	United States	32475	SINGLEHOP-LLCUS	false
38.68.201.140	rbp.mxptint.net	United States	39988	INTELLIGENT-TECHNOLOGY-SOLUTIONSUS	false
52.86.247.227	sync.ipredictive.com	United States	14618	AMAZON-AESUS	false
63.251.86.49	unknown	United States	32475	SINGLEHOP-LLCUS	false
51.222.239.230	onetag-sys.com	France	16276	OVHFR	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
13.32.87.73	synchroscript.deliveryengine.adswizz.com	United States	16509	AMAZON-02US	false
18.209.128.131	lynx-prod-beacon-alb-498367235.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
192.178.50.66	td.doubleclick.net	United States	15169	GOOGLEUS	false
107.20.203.46	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
142.250.217.230	s0.2mdn.net	United States	15169	GOOGLEUS	false
67.202.105.21	pixel.33across.com	United States	32748	STEADFASTUS	false
23.227.146.18	sync-unosync-com.geodns.me	United States	55081	24SHELLSUS	false
104.26.3.70	ad-delivery.net	United States	13335	CLOUDFLARENETUS	false
54.198.64.103	rtb.adentifi.com	United States	14618	AMAZON-AESUS	false
172.217.15.198	unknown	United States	15169	GOOGLEUS	false
74.119.119.150	widget.va1.vip.prod.criteo.com	United States	19750	AS-CRITEOUS	false
3.233.88.120	cs.yellowblue.io	United States	14618	AMAZON-AESUS	false
169.197.150.7	m.deepintent.com	United States	19381	SIMPLY-BITS-LLCUS	false
108.157.162.90	config.aps.amazon-adsystem.com	United States	16509	AMAZON-02US	false
23.227.151.202	unknown	United States	55081	24SHELLSUS	false
192.178.50.45	accounts.google.com	United States	15169	GOOGLEUS	false
192.178.50.46	clients.l.google.com	United States	15169	GOOGLEUS	false
207.198.113.203	pixel-a.sitescout.com	Canada	13768	COGECO-PEER1CA	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1364394
Start date and time:	2023-12-19 10:19:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip
Detection:	MAL
Classification:	mal64.rans.evad.winZIP@74/246@624/100
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, rundll32.exe, consent.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.211.108, 184.26.72.125, 142.250.217.238, 184.84.137.33, 23.193.106.184, 23.193.106.176, 172.217.15.195, 34.104.35.123, 151.101.1.91, 151.101.65.91, 151.101.129.91, 151.101.193.91, 192.178.50.40, 192.178.50.42, 142.250.217.202, 142.250.64.170, 142.250.189.138, 142.250.64.138, 142.251.35.234, 192.178.50.74, 142.250.217.234, 142.250.217.170, 216.239.34.178, 216.239.32.178, 216.239.36.178, 216.239.38.178, 20.42.65.92, 142.250.217.195, 142.250.217.174, 23.193.120.208, 192.178.50.33, 192.178.50.65, 104.208.16.94, 23.10.101.254, 104.94.110.19, 142.250.217.163, 213.19.162.80, 213.19.162.90, 8.43.72.97, 8.43.72.98, 142.250.64.162, 104.18.20.226, 104.18.21.226, 142.250.217.161, 142.250.64.226, 38.98.139.150, 38.98.139.151, 69.173.151.100, 159.127.42.172, 192.178.50.91, 142.250.64.219, 142.250.217.219, 142.250.217.187, 142.250.64.187, 192.178.50.59, 142.250.189.155, 172.217.2.219, 142.250.217.251, 151.101.66.49, 151.101.2.49, 151.101.194.49, 151.101.130.49, 50.116.194.21
Excluded domains from analysis (whitelisted): a267.g.akamai.net, d.turn.com.akadns.net, uipglob.trafficmanager.net, storage.googleapis.com, slscr.update.microsoft.com, partner.googleadservices.com, usersync-geo-global.usersync-prod-sas.akadns.net, clientservices.googleapis.com, l-0005.l-msedge.net, e9126.x.akamaiedge.net, ocsp.digicert.com, 1686c5c93569299f12ff90d5926d8f70.safeframe.googlesyndication.com, www.gstatic.com, rtb-csync-geo.usersync-prod-sas.akadns.net, www.google-analytics.com, onedsblobprdcus16.centralus.cloudapp.azure.com, s4-san.cloudinary.com.edgekey.net, fonts.googleapis.com, e8960.b.akamaiedge.net, content-autofill.googleapis.com, a866.dscd.akamai.net, pixel-us-east.rubiconproject.net.akadns.net, www-alv.google-analytics.com, na-east-digital-dual-active.fwgtm.akadns.net, pagead2.googlesyndication.com, www.googleapis.com, onedsblobprdeus17.eastus.cloudapp.azure.com, edgedl.me.gvt1.com, a-us-east.rfihub.com.akadns.net, sadownload.mcafee.com.edgesuite.net, blobcollector.events.data.trafficmana
Execution Graph export aborted for target caffeine-1.5-installer_qak-fw1.tmp, PID 5924 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:21:52	API Interceptor	8x Sleep call for process: caffeine-1.5-installer_qak-fw1.tmp modified
10:22:10	API Interceptor	2x Sleep call for process: avg_antivirus_free_setup.exe modified
10:22:13	API Interceptor	9x Sleep call for process: avg_antivirus_free_online_setup.exe modified
10:22:21	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.240.127.128	https://unica.md/c/index/myaccount/	Get hash	malicious	Unknown	Browse
	http://gadantifea.gq	Get hash	malicious	Unknown	Browse
	http://surghwk2953oc2.%D0%B0%D0%BD%D0%B0%D0%BF%D0%B0%D0%BC%D0%B0%D1%81%D1%82%D0%B5%D1%80.%D1%80%D1%84	Get hash	malicious	Unknown	Browse
	https://cs2buff.ru/	Get hash	malicious	Unknown	Browse
52.72.45.103	https://sports.zaly.online/57724/	Get hash	malicious	Unknown	Browse
216.22.16.4	https://conexaoufo.com/en/salyut-7-space-angels-sighted-by-russian-cosmonauts/?fbclid=IwAR0M6Prz4YudFXb6qx6hSSNhDH_aQ50t8dMsDeG9zxGInfhVplAejrcwSlg	Get hash	malicious	Unknown	Browse
	https://nursing-theory.org/articles/The-History-of-Nursing.php	Get hash	malicious	Coinimp	Browse
	https://z5amz.app.link/1B8FVTr8eDb	Get hash	malicious	Unknown	Browse
35.71.131.137	https://api.spently.com/api/spently/click?cid=7062502867059&id=3309212&store=oofos&syclid=84ab6ab1-1c21-4143-b56e-0a5538884cab&type=SO&url=https%3A%2F%2Fwww.oofos.com%2Fcollections%2Fmen	Get hash	malicious	Unknown	Browse
	http://www.visitaurora.com/	Get hash	malicious	Unknown	Browse
	https://3nyedublin.com/chi/rp@emfa.pt	Get hash	malicious	HTMLPhisher	Browse
	http://go.nypost.com	Get hash	malicious	Unknown	Browse
	https://r20.rs6.net/tn.jsp?f=001-IK3luo-d7610-syZG3-K8QGGveASJNhn1poYniSoK_T06eF7UpX8D1C8ox7ucdxr7qMSOCK9N7ZMKUoYzdZgvuGa0Q0K1QWYdWrtlOtl0ynIOTMH3VzBgKGdapppwnG9yXKOsocjLM=&c=&ch=#dmVyb25pY2EuY2FsZGVyb25AZGV2cnkuZWR1	Get hash	malicious	Unknown	Browse
	https://streamstv.org/soccer	Get hash	malicious	Unknown	Browse
	https://sports.zaly.online/57724/	Get hash	malicious	Unknown	Browse
	https://www.mediafire.com/download_repair.php?qkey=v6y1shsvt0m1lh6&dkey=vkvdhxewiw8&template=51&origin=click_button	Get hash	malicious	Unknown	Browse
	https://taget.com	Get hash	malicious	Unknown	Browse
	http://www.advania.co.uk	Get hash	malicious	Unknown	Browse
	Black Friday limited-time deals. Endless possibilities..msg	Get hash	malicious	Unknown	Browse
	https://share.transperfect.com/download/d0f6e451-b013-4068-88d2-ff23c66e0053/s	Get hash	malicious	Unknown	Browse
	https://arthurrlemus.wixsite.com/micr/office	Get hash	malicious	Unknown	Browse
	https://www.kmb.net.cn/login	Get hash	malicious	Unknown	Browse
	https://www.ydjlseub.asia/login	Get hash	malicious	Unknown	Browse
	https://www.fwnubar.asia/login	Get hash	malicious	Unknown	Browse
	https://www.grvgvrcls.run/login	Get hash	malicious	Unknown	Browse
	https://www.flbalec.top/login	Get hash	malicious	Unknown	Browse
	https://www.awrgzru.cn/login	Get hash	malicious	Unknown	Browse
	https://www.mgotcdj.website/login	Get hash	malicious	Unknown	Browse
159.89.246.130	Polynomial.xlsb	Get hash	malicious	Unknown	Browse
	https://conexaoufo.com/en/salyut-7-space-angels-sighted-by-russian-cosmonauts/?fbclid=IwAR0M6Prz4YudFXb6qx6hSSNhDH_aQ50t8dMsDeG9zxGInfhVplAejrcwSlg	Get hash	malicious	Unknown	Browse
	https://monydine.co/category/work/index.html	Get hash	malicious	Unknown	Browse
	https://dariuscooks.tv/peach-cobbler-cream-cheese-pound-cake/	Get hash	malicious	Unknown	Browse
	https://drive.google.com/file/d/11qmYm6lCQxQsYSNvVMa92eUR4AcCAhCn/preview	Get hash	malicious	Unknown	Browse
	https://www.ocregister.com/2023/09/07/what-exodus-userfornia-has-4th-stickiest-population-in-us/	Get hash	malicious	Unknown	Browse
	https://allezlens.fr/	Get hash	malicious	Unknown	Browse
	https://austin.eater.com/users/GadgetKingsQLD	Get hash	malicious	HTMLPhisher	Browse
	https://smtpurl.com/tracking/qaR9ZGtlAmp2ZmNlBQRkAwx3ZGHlZPM5qzS4qaR9ZQblHD	Get hash	malicious	HTMLPhisher	Browse
	https://open.substack.com/pub/davidlebovitz/p/brittany-addresses?r=aq9on&utm_medium=ios&utm_campaign=post	Get hash	malicious	HTMLPhisher	Browse
	https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://www.generation-nt.com/reponses/on-gnome-xfce-kde-bientot-nous-aurons-windows-entraide-3844211.html%3Fpage%3D2&ved=2ahUKEwin4OyqhYyCAxXzlWoFHdflDIsQFnoECAgQAQ&usg=AOvVaw0aU9VdyHXl9jH_yb4I9bI0	Get hash	malicious	Unknown	Browse
	https://nursing-theory.org/articles/The-History-of-Nursing.php	Get hash	malicious	Coinimp	Browse
	https://zanypandafire.tumblr.com/#==gYBdFWstEZ19kQ39yaulGbuAHch5iNyQjYz8yL6MHc0RHa	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwj85-Cx0Pz-AhV5FVkFHezeDZcQFnoECCUQAQ&url=https%3A%2F%2Fwww.dltk-teach.com%2Frhymes%2Fmacdonald%2Fmlyrics.htm&usg=AOvVaw0mYQOAG6hFsIBU_fVcAryo	Get hash	malicious	Unknown	Browse
	https://www.goodnewsnetwork.org/renaissance-masterpiece-london-bedroom-dawsons/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
global.px.quantserve.com	https://tinyurl.com/4zsnub78/SubscribeClick?e7wr=lv4&rrfg3nks=jennifer.m.franklin@instaloan.com&vus2vbx=&d%20and%20two=background%20and%20two%20admirable%20uncles%20skipping%20to%20the%20beat	Get hash	malicious	Unknown	Browse	192.184.68.134
	https://unica.md/c/index/myaccount/	Get hash	malicious	Unknown	Browse	192.184.68.166
	http://leftaaa.com	Get hash	malicious	Unknown	Browse	192.184.68.166
	http://url4950.cardamomauction.com/ls/click?upn=egCPuzUzE3IgDlrJllQ8yUBDO8VIETbuALPBUwtYINtrfRoh4niogEH8ew5kcjpQHM6X_5oPQIRm8LVmW-2FxweY307RHB6-2FfahtC57rDiHjDqcmR3wVeFHqU860zUYKXVGazyJpxMz-2BcQ5uK-2BNpDHERkaIkSLRnnlu-2Fc6D63JAIl8JEZb1GxYrBpkUR5dGmGiZ7tVIHJtwdg2sVnEwwf6w1QvIy9Zxou6xRVLuTVo-2BvDlX32eGOdm-2FS4cfnyxoMZpQM-2FzWDOoNZbiI7Zh9oLibZCTy9w-3D-3D#offer/001mu/120/frznm/ijv/41/79	Get hash	malicious	Phisher	Browse	192.184.68.166
	Polynomial.xlsb	Get hash	malicious	Unknown	Browse	192.184.68.254
	Polynomial.xlsb	Get hash	malicious	Unknown	Browse	192.184.69.201
	http://corrector.co	Get hash	malicious	Unknown	Browse	192.184.68.166
	https://s3.amazonaws.com/ycarolynanne/roymail.html	Get hash	malicious	Unknown	Browse	192.184.68.166
	https://streamstv.org/soccer	Get hash	malicious	Unknown	Browse	192.184.68.254
	https://vanbebbers.com	Get hash	malicious	Unknown	Browse	192.184.68.166
	SamFwFRPTool.exe	Get hash	malicious	Unknown	Browse	192.184.68.254
	SamFwFRPTool.exe	Get hash	malicious	Unknown	Browse	192.184.68.149
	http://url7816.acetaxi.com/ls/click?upn=k9eqZnPBEZmPVPka3LxS61O1ksdCJOgznvtiwccqzi2-2BneqvfCXEJ-2FQj-2BZo7snmCwDunBahf2LYhfs7qQp7-2F23xLStq-2BkxJ70xqVvyXzkWM-3D8Cie_z5TGfmB4A65PPE2hDgRdrx6OZsZ3AmrJLHJ0M9ePWeHP5QDTWsAVp117uXam9dNn-2BGSxHeP-2BInRF-2Bgy2v-2FXBPODjmLss6NRV2RYsUYD7um77hgLl0ET9pPGTHF-2BQ1m6-2Fw7-2B-2B9DJOpakZj874YLC8uUep0F7rZMDlM46gmHmQqqAeCV477M0h2b07T2IcXu0hzUcKftN0UG2jhPq8qo00cQl0gvOLl-2BjChyaOdLpENao-3D	Get hash	malicious	Unknown	Browse	192.184.68.149
	https://conexaoufo.com/en/salyut-7-space-angels-sighted-by-russian-cosmonauts/?fbclid=IwAR0M6Prz4YudFXb6qx6hSSNhDH_aQ50t8dMsDeG9zxGInfhVplAejrcwSlg	Get hash	malicious	Unknown	Browse	192.184.68.215
	Alyssa M Juris Please Confirm Subscription.msg	Get hash	malicious	Unknown	Browse	192.184.68.166
	https://sports.zaly.online/57724/	Get hash	malicious	Unknown	Browse	192.184.68.254
	https://att-101126-100839.weeblysite.com/	Get hash	malicious	Unknown	Browse	192.184.68.254
	http://nerokolim.cam	Get hash	malicious	Unknown	Browse	192.184.68.166
	http://firstcar.co.uk/firstcar-practical-magazine	Get hash	malicious	Unknown	Browse	192.184.68.166
	http://operadarte.net/ikquojs	Get hash	malicious	Unknown	Browse	192.184.68.134
rtb-csync-use1.smartadserver.com	https://tinyurl.com/4zsnub78/SubscribeClick?e7wr=lv4&rrfg3nks=jennifer.m.franklin@instaloan.com&vus2vbx=&d%20and%20two=background%20and%20two%20admirable%20uncles%20skipping%20to%20the%20beat	Get hash	malicious	Unknown	Browse	23.105.14.105
	https://unica.md/c/index/myaccount/	Get hash	malicious	Unknown	Browse	216.22.16.8
	http://leftaaa.com	Get hash	malicious	Unknown	Browse	23.105.12.173
	https://steam.dotaworkshops.com/	Get hash	malicious	Unknown	Browse	23.105.14.106
	Polynomial.xlsb	Get hash	malicious	Unknown	Browse	23.105.12.150
	Polynomial.xlsb	Get hash	malicious	Unknown	Browse	216.22.16.40
	https://lucid.app/	Get hash	malicious	Unknown	Browse	23.105.12.137
	https://streamstv.org/soccer	Get hash	malicious	Unknown	Browse	23.105.12.173
	SamFwFRPTool.exe	Get hash	malicious	Unknown	Browse	216.22.16.57
	SamFwFRPTool.exe	Get hash	malicious	Unknown	Browse	216.22.16.56
	http://62.109.8.203	Get hash	malicious	Unknown	Browse	23.105.12.151
	https://conexaoufo.com/en/salyut-7-space-angels-sighted-by-russian-cosmonauts/?fbclid=IwAR0M6Prz4YudFXb6qx6hSSNhDH_aQ50t8dMsDeG9zxGInfhVplAejrcwSlg	Get hash	malicious	Unknown	Browse	23.105.14.105
	https://sports.zaly.online/57724/	Get hash	malicious	Unknown	Browse	216.22.16.41
	https://bsetsy.com/	Get hash	malicious	HTMLPhisher	Browse	216.22.16.40
	https://smbc-card.world/index/indexinfore.html	Get hash	malicious	Unknown	Browse	216.22.16.56
	http://nerokolim.cam	Get hash	malicious	Unknown	Browse	23.105.12.172
	https://jpadscity.com/yTozqBN-rqp_fAumldEMt7eEwPBddyQc6_Du4euWaZs/?cid=2fb5612f478001b60480e498d3595bd0&sid=20204270	Get hash	malicious	Phisher	Browse	23.105.12.173
	https://taget.com	Get hash	malicious	Unknown	Browse	23.105.14.106
	https://arthurrlemus.wixsite.com/micr/office	Get hash	malicious	Unknown	Browse	216.22.16.8
	https://www.ukotayc.online/login	Get hash	malicious	Unknown	Browse	23.105.12.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	PO46823.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	54.242.170.148
	p3h5r9NsxY.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	44.215.97.184
	XW9DuF7Pys.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	52.205.154.100
	http://maineorthopaedicscomau.website	Get hash	malicious	Unknown	Browse	34.224.217.152
	31N825YHrQ.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	52.206.90.119
	YEEonf5uFX.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	34.205.3.170
	8k5q0nli7N.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	34.201.247.102
	8GZXHbmsm8.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	52.206.90.119
	https://my-s0ftbank.com/sbid_auth/type1/2.0/authorization	Get hash	malicious	Unknown	Browse	54.159.145.114
	Qs9Qa2ra9M.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	54.88.230.192
	https://www.snbc.heichezxhk.com/ibg/client/home.php	Get hash	malicious	Unknown	Browse	35.172.245.152
	line.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	54.83.248.93
	https://summer-spurious-tithonia.glitch.me/mart.shtml	Get hash	malicious	HTMLPhisher	Browse	44.196.220.150
	tSrcyVu7Nb.exe	Get hash	malicious	SmokeLoader	Browse	54.88.230.192
	wextract.exe	Get hash	malicious	LummaC Stealer, RisePro Stealer, SmokeLoader, Vidar	Browse	3.230.228.107
	https://grass-cultured-copper.glitch.me/jigo.shtml	Get hash	malicious	Unknown	Browse	35.173.24.16
	https://www.snbc.gaoxingda.com/ibg/client/home.php	Get hash	malicious	Unknown	Browse	3.233.35.186
	https://speckle-sunrise-justice.glitch.me/gerar.shtml	Get hash	malicious	HTMLPhisher	Browse	44.211.102.140
	https://https.secure-links.bloemlight.com/XVEdSV1YycHFWaTl0VFZCQllWaHlOekJNY1UwcmRrWnJjbEpLVUdGVVJEUXlSa3hVTWtRcmFFWTBhRVpIYlZCUFoyNDFTM1ZqY0ZZMVlsbFJTRkZFVERab00zSnZTRGw2YUdKeWMydENObVJWY3pWWEwxRmtaM05HWm5WcVl5dDZRamxGZUVKMWFtSkJSRGhPUVZFNGRsZG5hRXBqUW1ObVpVRmFOekJoUTNkU1VIVmljM05NTUVscVRrNURNMEpUTmxaTGVEVlRSRTlCYW5GRGIyYzBPU3R2V0dOdlMzRlpSMUppVm01TVEwUjNaRzVKZVhGaEswaFZha2hSVFRaSExTMURia1puVVVKWFZtcGtRMXBEUWtFeGFuZFFRbkJuUFQwPS0tZDdiYmVmNzQwNzQ2NTYyNmM0ZDNmMzEwYWYyYTZhOTVhMzU5YTQ1ZQ==?cid=1845890172	Get hash	malicious	Unknown	Browse	34.205.188.80
	1grVKS95J5.exe	Get hash	malicious	Glupteba, RedLine, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	18.204.147.138
LEASEWEB-USA-WDCUS	https://engagement.keapapis.com/v2/click/e2889f2c7e0696e172876ccf880679e7/eJyNkFtvgzAMhf9LnqH0RqFI09TSCiHaTtr1EaXEG9EgsYIp6ir--8I2bS-btEfbx5_P8YURKK4oFSxigubTJXOYgUKiBEWxVsSLj6E_9sNw6bBKqtfE6BZZdPlt93s-dGeLRRA4jM4IVnJ_u4qz9JDku_SQWSlyY2_8hxMG_nT-A9ruV-mO9f2fZKglbU8W3rCITAtDJCFtLHowldWXRNhEntd13YjX_E2rUaFrLzEcS6jBvTFU6pehkoW750piW3GSJ2jcjW6PFbh3UoBwn0pJcNTcCE-gtx6vN3Ewmcwerw0851e8obwhnQu0ljgiKPH10AzOn8b6d6Xxf3c=	Get hash	malicious	Unknown	Browse	216.22.16.72
	https://tinyurl.com/4zsnub78/SubscribeClick?e7wr=lv4&rrfg3nks=jennifer.m.franklin@instaloan.com&vus2vbx=&d%20and%20two=background%20and%20two%20admirable%20uncles%20skipping%20to%20the%20beat	Get hash	malicious	Unknown	Browse	216.22.16.57
	01b9T4tDdG.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	23.105.171.37
	https://pub-722720be67154192a1102b2cf085d306.r2.dev/SAword5.html	Get hash	malicious	HTMLPhisher	Browse	23.82.12.31
	SyD1FiOG1p.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	23.105.171.37
	https://unica.md/c/index/myaccount/	Get hash	malicious	Unknown	Browse	23.105.12.172
	http://leftaaa.com	Get hash	malicious	Unknown	Browse	23.105.12.173
	https://steam.dotaworkshops.com/	Get hash	malicious	Unknown	Browse	23.105.14.106
	http://go.nypost.com	Get hash	malicious	Unknown	Browse	216.22.16.52
	https://qtadsmail.com/P0O2wO2YjYKFm_XX0NsDKy99sGnoblqlBufoFSDFlhU/?cid=3092cb3a43521fe097f201ffded7dc1d&sid=20204270	Get hash	malicious	Unknown	Browse	108.59.2.51
	Polynomial.xlsb	Get hash	malicious	Unknown	Browse	216.22.16.57
	Polynomial.xlsb	Get hash	malicious	Unknown	Browse	216.22.16.5
	https://lucid.app/	Get hash	malicious	Unknown	Browse	23.105.12.137
	6STrd2WC88FOIND.exe	Get hash	malicious	FormBook, zgRAT	Browse	162.210.199.87
	https://portal.artslaw.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	23.82.12.32
	https://b.proofandcos.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	23.82.12.29
	SamFwFRPTool.exe	Get hash	malicious	Unknown	Browse	216.22.16.53
	SamFwFRPTool.exe	Get hash	malicious	Unknown	Browse	216.22.16.56
	http://62.109.8.203	Get hash	malicious	Unknown	Browse	23.105.12.151
	n5PW3tuGlp.exe	Get hash	malicious	FormBook	Browse	23.82.12.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	2023121142000021ki01kvjs.html	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://trackinghub.info/	Get hash	malicious	Unknown	Browse	23.1.237.25
	YIWta5djON.exe	Get hash	malicious	Unknown	Browse	23.1.237.25
	http://payonresultsc.xyz	Get hash	malicious	Unknown	Browse	23.1.237.25
	YIWta5djON.exe	Get hash	malicious	Unknown	Browse	23.1.237.25
	8UIc9QxZSj.exe	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://dynamicgiass.com/Masacks@hammond.com.au	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.1.237.25
	https://my-s0ftbank.com/sbid_auth/type1/2.0/authorization	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://au.oiwka.freeddns.com/mygov-login	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://xusrewyob.xyz/login.php	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://yuanweibar.com/	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://www.franciscoz.com/funccode.php	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://pypal0ch22.online/secure/3/4.php?join-us.x=7ab6f759f9cdcdf6bb3	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://www.51-20-0-29.cprapid.com/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.25
	https://sharepoint-bunteng-auth.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.25
	https://pub-ece886618dfa41788215ebe75499391f.r2.dev/porn.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.25
	https://bafybeied3ykd6rwigyhlm3tqfluknhi5ypj5tg2lmfoabdrgpb6m5wfyl4.ipfs.w3s.link/officeshare.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.25
	https://pub-2598caa00dcf4c658bf8753f6761f962.r2.dev/compki.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.25
	https://index.cr-mufj-bk.com/bkindex/index.php?a8942eb4e6cecd05f8b2d6c58a117d64=a8942eb4e6cecd05f8b2d6c58a117d64	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://https.secure-links.bloemlight.com/XVEdSV1YycHFWaTl0VFZCQllWaHlOekJNY1UwcmRrWnJjbEpLVUdGVVJEUXlSa3hVTWtRcmFFWTBhRVpIYlZCUFoyNDFTM1ZqY0ZZMVlsbFJTRkZFVERab00zSnZTRGw2YUdKeWMydENObVJWY3pWWEwxRmtaM05HWm5WcVl5dDZRamxGZUVKMWFtSkJSRGhPUVZFNGRsZG5hRXBqUW1ObVpVRmFOekJoUTNkU1VIVmljM05NTUVscVRrNURNMEpUTmxaTGVEVlRSRTlCYW5GRGIyYzBPU3R2V0dOdlMzRlpSMUppVm01TVEwUjNaRzVKZVhGaEswaFZha2hSVFRaSExTMURia1puVVVKWFZtcGtRMXBEUWtFeGFuZFFRbkJuUFQwPS0tZDdiYmVmNzQwNzQ2NTYyNmM0ZDNmMzEwYWYyYTZhOTVhMzU5YTQ1ZQ==?cid=1845890172	Get hash	malicious	Unknown	Browse	23.1.237.25
28a2c9bd18a11de089ef85a160da29e4	https://aqua-cranberry-n43a.squarespace.com/	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	2023121142000021ki01kvjs.html	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	IMG-20231215-WA0005[94].vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	https://trackinghub.info/	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	PO46823.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	invoice_29082365-paid_50_percent_12192023.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	YIWta5djON.exe	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	http://payonresultsc.xyz	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	YIWta5djON.exe	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	http://salpspa.shop/	Get hash	malicious	HTMLPhisher	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	deEzk5CTqP.exe	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	8UIc9QxZSj.exe	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	deEzk5CTqP.exe	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	oa1Ogjv3kL.exe	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	8UIc9QxZSj.exe	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	oa1Ogjv3kL.exe	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	http://maineorthopaedicscomau.website	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	t5tkGPp6bY.exe	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	t5tkGPp6bY.exe	Get hash	malicious	Unknown	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
	https://dynamicgiass.com/Masacks@hammond.com.au	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	54.149.12.26 40.126.29.12 44.238.140.201 20.12.23.50
74954a0c86284d0d6e1c4efefe92b521	https://motoclubefaro.com/bbe/?47174881	Get hash	malicious	PikaBot	Browse	34.117.223.223 34.160.176.28
	Patch_JB_2023.x.x.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	Patch_JB_2023.x.x.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	_.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	_.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	22382_327.js	Get hash	malicious	LummaC Stealer	Browse	34.117.223.223 34.160.176.28
	fences-1.0.1.0.0-installer_t-TafY1.exe	Get hash	malicious	CobaltStrike	Browse	34.117.223.223 34.160.176.28
	avast_vpn_online_setup.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	34.117.223.223 34.160.176.28
	Microstub.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	Microstub.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	6UqqC9EHFA.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	baofeng15.0.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	PDFViewer_44727842.msi	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	4496tHOPrYDQuhscyVqEZcbCBRRq.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	4496cCQpJVwUDGHVYSnxwLRoEIMF.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	Chrome_update(1).js	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	Chrome_update(1).js	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	4496iKzQhkhlziKzdxfRihzUykrn.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	telegram_cxcLf.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28
	CKlO7ANp5J.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 34.160.176.28

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\_isetup\_setup64.tmp	MDE_File_Sample_aa447845a64e29145a9489f43972beebcb33cfba.zip	Get hash	malicious	Unknown	Browse
	iguufjAqnn.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse
	fNEOQV1Qo2.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse
	https://onelaunch.com/download	Get hash	malicious	Unknown	Browse
	ZmWSzgevgt.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse
	ZmWSzgevgt.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse
	wechat_XC560-1.exe	Get hash	malicious	Unknown	Browse
	wechat_XC560-1.exe	Get hash	malicious	Unknown	Browse
	Promenta_Addin_3.0.10.119.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	HTMLPhisher, Glupteba, Petite Virus, Socks5Systemz, onlyLogger	Browse
	RDPInstaller.exe	Get hash	malicious	Unknown	Browse
	RDPInstaller.exe	Get hash	malicious	Unknown	Browse
	RDPInstaller.exe	Get hash	malicious	Unknown	Browse
	RDPInstaller.exe	Get hash	malicious	Unknown	Browse
	app-version.exe	Get hash	malicious	Unknown	Browse
	app-version.exe	Get hash	malicious	Unknown	Browse
	https://github.com/ZakKemble/AVRDUDESS/releases/download/v2.14/AVRDUDESS-2.14-setup.exe	Get hash	malicious	Unknown	Browse
	Backdoor.Win32.Bladabindi.exe	Get hash	malicious	Njrat	Browse
	Backdoor.Win32.Bladabindi.exe	Get hash	malicious	Njrat	Browse
	CrystalExplorer-21.5-windows-x86_64.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\McAfee\Temp1545665699\analyticsmanager.cab

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 2112485 bytes, 2 files, at 0x44 +A "\analyticsmanager.dll" +A "\analyticsmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 199 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2134485
Entropy (8bit):	7.999681045015461
Encrypted:	true
SSDEEP:	49152:6ouQiX4CzX53tU7M6eYkVgT1/WYcDU+/cGkl0//T:6lQiXVzX5cM63keBcDUSRgSr
MD5:	E4B0EE9FBEF9025D313D3582BDB9655F
SHA1:	C1542DB3B16573912D5A6E5F79BCB1DDA5D427BA
SHA-256:	3AE67AB201B503C07DA4900399F29C5EBF97680D6D4893D37FDA9D6A92247935
SHA-512:	AF388F03B08C1BC982A4DCE35F002ACDC0AA196153AA5E9D3F71F1959D3D1082B2E5AD352B9A7AB532F5C5565177BD6205316E2A50B0ADD9EC002EEB49DFEB6D
Malicious:	true
Reputation:	low
Preview:	MSCF.....; .....D............................; ..U..................x(c.......~WzM .\analyticsmanager.dll.....x(c...~W.M .\analyticsmanager.manifest...`./..[...B .....@..4....._..V...KcK.0J..j...P....5D.6...]w..[..DX.v:.s..a.a..,-9C..h.f..j....<....\|..o/..y..{.92N.}.&..H.,..9.E........m...V.v..j%.5..ml.Mn$.l..H....O.Bb...V...7k..[...Ap......@..`0.$.4.......n...?.. .C.s4.7up.P../.m9...V.z.=C.,1.....F.9..E.7...3<)ncE.b:.E._.k..U.x.....&.X........~...sGox...n}i7...m.}....]d36......M...Y..6...M6..l.e..z...w.\|...3...w.i.aB.=......>7..~.Vn.9.x...[...B....7.t...Z.y....u.FW....../.Z...2....J.{...~..-..W.7.3...].G......S.n./;....{.k..i..^.<..b.U.o..m...........]...Z....q_....v....H*...\q.....l...<c...~.......?==_sk.}y.=.....3=.\|...b.M..E...\|.z.l.{u.G.D.............X.x..,...+..Z.7._.yv..Wf....~....u..fz..l..7.X.&?..y..p.0...to..6.........,..v...[.t^.l.jK.;...iXy............%.Zu\..FU.c....q...mn..]..{\|..m....>.wO..~..l.J...-.....j..{...[...._.[k{.V.W..

C:\Program Files\McAfee\Temp1545665699\analyticstelemetry.cab

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 36221 bytes, 53 files, at 0x44 +A "\analyticstelemetry.manifest" +A "\context\analyticscontextconfig.luc", flags 0x4, number 1, extra bytes 20 in head, 4 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	58221
Entropy (8bit):	7.898749980507336
Encrypted:	false
SSDEEP:	1536:BgPhFx0cSPYc010LzVBRRvBG04i73x9p31tBqxZ1:qP3ycSPYN10BRRJG04G7i1
MD5:	83703FAA7FDB3F9C6323356F4B0D55E9
SHA1:	E287FB71B5A20BF4B91056E24B6C499F2EDA92CC
SHA-256:	2DE472D2AC27A5BA012FF9E3B94903E83CD2234F3A169C62DE577B405DABC110
SHA-512:	F89BDD63EAB3737A288B57B5E55E049AF131D79098C9C946DDC7BEEAC7C0AD3C15BE31D0D2337F59F3378FC1F81F913566C6EB321841AC16DD38A14419419438
Malicious:	false
Reputation:	low
Preview:	MSCF....}.......D...........5...............}....U..................Z.........~W.M .\analyticstelemetry.manifest.e...Z.....~W.I .\context\analyticscontextconfig.luc...........~W.I .\context\analyticswpssetting.luc...........~W.I .\context\analyticswsswps.luc.?.........~W.I .\context\browserinformation.luc.0.........~W.I .\context\browserversion.luc.....K2....~W.I .\context\contexthandler.luc......3....~W.I .\context\externalutilityfunction.luc.....r7....~W.I .\context\featuretrackingfeature.luc......W....~W.I .\context\hashedmachineid.luc......Z....~W.I .\context\msspstatus.luc.O...7b....~W.I .\context\samrecoverable.luc......e....~W.I .\context\sequencenumber.luc.R....g....~W.I .\context\subscriptionexpirydate.luc.@....i....~W.I .\context\subscriptionstatus.luc..... n....~W.I .\context\subscriptiontype.luc.Y...:p....~W.I .\context\suitestatus.luc......s....~W.I .\context\wpssubscriptionexpirydate.luc.....ku....~W.I .\context\wpssubscriptionstatus.luc.....]w....~W.I .\context\wpssubscr

C:\Program Files\McAfee\Temp1545665699\balloon_safe_annotation.png

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3166
Entropy (8bit):	7.890916051269147
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODx7FspC:bSDZ/I09Da01l+gmkyTt6Hk8nT3KC
MD5:	2048DF489A12C4C9E2341BEF42883205
SHA1:	281863D9F8B8D4D0DAD62E66E35F5C96CA0155FD
SHA-256:	DDA74B071B5869A22B327633D9641F1340EC5B913359BB389C34C44A6DB579A5
SHA-512:	815FC1E3A2E623FEA3B13AA2BCB3895FF9DDB2A7A05E1633C83D3F647EC4A4050AF0670ED01CABA47F02A920BF6AD84191B0B03EAD1E45105DD20D302D00CCE2
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files\McAfee\Temp1545665699\browserhost.cab

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1194406 bytes, 8 files, at 0x44 +A "\browserhost.exe" +A "\browserhost.manifest", flags 0x4, number 1, extra bytes 20 in head, 114 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1216406
Entropy (8bit):	7.99945274445483
Encrypted:	true
SSDEEP:	24576:pnJ0LK/sEX0qm/8Ts1VK4WPx45k/Rwx8s:pnJYK0EX0tus1vWPe5k/ReF
MD5:	5C8EF8DF135DBF4FECE55188BD74C4B6
SHA1:	93EF074DF109B6AF0ABC6818B21BB0D95E4EFE64
SHA-256:	657235AF9CA5107155C8C98C640F73D57B463DB6DEBD851DBE8C20D39BC50E73
SHA-512:	066F4E7F31370E39245D2CF44DAF11EDEA0C14B3B187F1B34A3E5252C46FDAC54D5A2502CB1C00773BCAF451E0EE98A77582864ED04A1F45080DC121872DF2C1
Malicious:	true
Preview:	MSCF.....9......D............................9...U..............r...h.8.......~W.M .\browserhost.exe..-..h.8...~W.M .\browserhost.manifest.f.....8...~W.I .\edge.com.mcafee.webadvisor.json.e...l.8...~W.I .\edge.com.mcafee.webadvisor_v2.json.......8...~W.I .\webadvisor.mcafee.chrome.extension.json.L...u.8...~W.I .\webadvisor.mcafee.firefox.extension.json.......8...~W.I .\webadvisor_v2.mcafee.chrome.extension.json.K...d.8...~W.I .\webadvisor_v2.mcafee.firefox.extension.json.5.0.....[...Y .x.M.0B.0..........~...~..y?..j..z...2....~..L.a.2.dx...y=.d\|.?.^..5..'..e.,~Y.U?..........7\=....~..........$......Ld#3Wh....Y0\r^..N..2cVUj....a.eD..)....R.A)"....6.]U...$X`..&Dx..Fg.E..p.X....8.."......!....;.....H.>_...@..E.qfVE:"......./..l`.wq.G.@<.}..!^<...o5..\|x.....N....H.g<./..Y._.6>.6m.7...w">h....Kx.....'.m.....8.?...G.~..8........_....T...........8..[6.hg...-.....h....~...f....G..s.fu.w..-.\|..;...;N...w.G ...=..?.;...e..?.=E....?....'^.......;....a..`s..........)

C:\Program Files\McAfee\Temp1545665699\browserplugin.cab

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 5067635 bytes, 2 files, at 0x44 +A "\browserplugin.manifest" +A "\e10ssaffplg.xpi", flags 0x4, number 1, extra bytes 20 in head, 183 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	5089635
Entropy (8bit):	7.999224593092551
Encrypted:	true
SSDEEP:	98304:tNPLmpAy9DKjLyZHYbBSrQGUe8DJZEmbQtX/ngnImvh13LLfv9i1kC0q:DzmOyNKHVo4e8DvhbQtX/gnD/3LjvoKq
MD5:	B8690B732E73921E48CE09B2710036DF
SHA1:	00F00AEB4807AF9F3FEBDDF417B4AC8416063C5F
SHA-256:	5B32C983156EF7E62F0640F7605BE9D8816C4030940FA12602B60D8CF75F283F
SHA-512:	1209E6035950F2C5F1465506CC0D087A616D387DD4500F964F07EA111DA233AA71637884956326D99AA2CE1A3DCA8E155EBD1415AC9D5B31F4B2A0AF2D6D0903
Malicious:	true
Preview:	MSCF....sSM.....D...........................sSM..U............................~W.M .\browserplugin.manifest.xU[.......~W-M .\e10ssaffplg.xpi.....Z..[.....P..........D..]..qwwwwwpw.P.....Apw.ww#p43VE.....`.;7......@.....LxA.#..X.Z.aM...`\|8..1..."......B....%3.N&..eVJ..R.m.NW..f.X...&J..!..........h..j.....n.s-...V..I...j...5......X.P..&...V.e6...1V...X....F.F..Q......(de.v.e...C5...E.....4.......f@E..3.-.,1./.._.......-,4....-.A...U.7.~5G.lc.^...%.H.oL...............&&._..!._.k.........y....Z..`..YX..L...;...I....;5....WB.../.U_.3..Q7....._k...>...D...........3."#.....\.......t.7......_...._..y...U.p..a.uu...x..{.h.....R......./...f.u..o...~........%=.sQ.3.;C.!.s....k.^..v..51.\|...^..`.L..O./...?...1.%.....?.....W.._;fi`.5d.............z..65.,?...1RZ..q.I.23...rE..T..Sj_].\y.u.um.i..i}qq.........l.K...B....q..g..\|.+....-....+.....~...X...p............6&/......D..k....P......q........v..........o+.Z.{..z..m.cX....9...yKO...\|..~..R../......S.

C:\Program Files\McAfee\Temp1545665699\downloadscan.cab

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 2231311 bytes, 3 files, at 0x44 +A "\downloadscan.manifest" +A "\win32\downloadscan.dll", flags 0x4, number 1, extra bytes 20 in head, 200 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2253311
Entropy (8bit):	7.999780137064173
Encrypted:	true
SSDEEP:	24576:8j/LrnyoR7Nj6shUr5DpE6KDRYpmBUEpNZaTxEDh3J4F2rU33M8RmVSSZau98fiF:OO0kK6KD2pcpwuP4F2rUOk0aQ8cpmxAn
MD5:	4B8B1F57328927B33A79C496BAFB764D
SHA1:	97491BEEA1F411CD28650D08CFCA001A0E755BE2
SHA-256:	572F1B0ACF46BD6877942D5F29395B8B0A6A3CA2F36C6AE769B10094C5FCE2C0
SHA-512:	1C3321B04E7EF27F2874D7FEBD0882EEB1CC17A4E6182E23C1BCAFD038E3DB1942EB1BE2CD6425BC8D56A466551BCF15783BD5EC63ADE8EFE7A9B5C1DA37E871
Malicious:	true
Preview:	MSCF......".....D............................."..U..................C.........~W.M .\downloadscan.manifest.(@..C.....~WGM .\win32\downloadscan.dll..]5.kG....~W.M .\x64\downloadscan.dll..G..0...[... vlr..0A.V$.@...nx.pU...E.Kqj^mLf[u.k....-s.......G.K..b.x....m.^3..G..E....y..........=...g..{.........8P.9\......p..q.:.ig....u...V.......u..Ze...N.k]P+k.(,..........C.@..0....IH.i.$...'.'.......h......o.{.?...Y.W.^....xf%.p. ....uf..U..it....jc;...m~1..6tW..,..v..k#...5.6.C..o....{..6p...V;...h...._8..7...o...E..q...=....{..Q..k+......g..?p.w..y@z9...m.f.8........n..]X.O...W......m..}0/}L...o3.....]..!.6..{.tW....xo....y.t.....x.<../...Pf&.........y.m..t]...W..\|.....b.._......&M......o.w.g.3...<uEW..^P..g..zZ......q.\f._9.\|.mF.9[..o.....6_..Ub.....;.....}z:.s#t....)......9.mb.q.....He.}g..v..#..<.-V..g{^....~..>].m.k.6.o-sn{...q;).z...N..G}.-...I......4....,.........W-.ZK0.].UW...L..[...k..5,..v.S.....}...j>lfZfG..s..,;...z>...g.3{..5.n.....

C:\Program Files\McAfee\Temp1545665699\eventmanager.cab

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1496901 bytes, 2 files, at 0x44 +A "\eventmanager.dll" +A "\eventmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 134 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1518901
Entropy (8bit):	7.999550127063391
Encrypted:	true
SSDEEP:	24576:WxgcALdZe5Zcth4ft9M7VYkgCSFIUPIY3TYXS0hLC5bjMNjYKH4CCeXRzviW60Fr:WacqHeH04ft9Kh2ggTWvLC5vXKH4CVNb
MD5:	EA59D11F4B564575724A7E8D7F393BD5
SHA1:	44E2380E3D693E2D9FC23A5449E43D32F1B4533E
SHA-256:	D34926E5D9BCEF95A4A0957FFC638E26C9BC626049573AC4F77ECF2BAF99AF27
SHA-512:	64153381383FF7306A72E238512885131D519EE04333BDBD3228260F0649B4DD76BE6F0EA2C570B9431B700E71B5C02958CC7783BEA252282835B9CFCBF5FAA1
Malicious:	true
Preview:	MSCF....E.......D...........................E....U....................B.......~W.M .\eventmanager.dll.......B...~W.M .\eventmanager.manifest....z+..[........."c`$..n....nxd4T....6..l.\V...pQd.JQe..O~._.......==?.g..o.....i.<l.H.w.....Q......;.........p.}...{]..IR..W..I.z5'HQAol./...k.oi...m..SZHkmAa.,..-...em....j.Z...&$M......"..C.E3T.{.v}....$s.O.y.B../@..E\|..........d..N..}..E...QR._.HA5w.8.P...=.v%.+K..0.,.js..,>.y..Q.......\|....].Q.S^....j.a.......Y{Q\|jxT.....U..u.[...l@<.....=\e....{\../.J...#.i.c....o..?...._s.@/_.Z.m._m...vJ}..`....Y..t.vuD..W....8..)'[.el9..N.S.X^Qa.F...f..B....Z6.W.~.B..n......P.RR.....,G..g.......-S...y.C`..?t.v.l.........G..2..L..-..6.1.................>aF.W.....9..\>.-....F&f..I..o&.Z%..eJY._{d......].......emY.'R.4.KW.T...Y.f..+G..&.&....n.n....+.+"....:.....?...........p{.f.y..P&1....1:...4;.vL.7.\....O.r'..........-c.....S..@A...Q...b.........?....P.f...Sn.Nw.....~P..-..X...&V.p.5..G.s.....a.!......

C:\Program Files\McAfee\Temp1545665699\icon_complete.png

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
File Type:	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3219
Entropy (8bit):	7.7127647052020425
Encrypted:	false
SSDEEP:	96:ek20QaOtG6FvySCYWm8yAxvU+LblYFv2tct:eQQaOwhS8m8yH+flLtct
MD5:	4A09448B224F83F4E6D36AEC9FF4DA1E
SHA1:	CC42250CAF610210EFF2904B1A08630A0888AB2F
SHA-256:	911215D1ADA8D78A33F6ED9A3740A0652BE74EFA34ED22AE569D143F9B3B5040
SHA-512:	390587FA96D17112CA7EC1ADFE2BA103FE39E980A35A2D4C7A3B6BCF4DE9E95B200DDCEE3C4B6C34899DE51F20F9635D41259558C77CF24279D26264DA953E2B
Malicious:	false
Preview:	.PNG........IHDR...d...d.....p.T....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:013EDEF9F71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:013EDEFAF71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEF7F71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDEF8F71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>d.8.....IDATx..kL.W.....Z(....h5>J....T,...4U...h.I..&~...`..hc......"h.. X.....m...Q....%...........'..ta.

C:\Program Files\McAfee\Temp1545665699\icon_failed.png

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
File Type:	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3390
Entropy (8bit):	7.74331289225542
Encrypted:	false
SSDEEP:	96:ek2J8fBtCIc5eJXe1TDiotN45Myx7n6v9+j0ZH:e98fB8vcJqVUtx+9+j0p
MD5:	AEE9C26A50511C3E4196C28662BCE665
SHA1:	ADF6DA6EE3EAAD88E8EF1C9C07505AEFFDE89B57
SHA-256:	0E2904A557F79BCE71A47BFB03E49FA9C5B54C7855017B54143EA2214501BFE6
SHA-512:	F90AA520FD9308C502B857C4425BF6CF6E12C401EA4B538534E58655448232CF797AA9A9BA60B0932DBAFC28EE925D22BED6740DF82BB02C5C99EF851389F783
Malicious:	false
Preview:	.PNG........IHDR...d...d.....p.T....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:013EDEFDF71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:013EDEFEF71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEFBF71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDEFCF71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..*.....IDATx..klTU...v..--/5.<.J...."F.aD.HQ4..(...j.P.a...?T ..F...........5..... ..jU..Q#.V(.]g...w.g.n.$.m

C:\Program Files\McAfee\Temp1545665699\icon_laptop.png

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
File Type:	PNG image data, 100 x 73, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.072392857408681
Encrypted:	false
SSDEEP:	24:YQ1hepWwjx82lY2T3JbVvdgqud1oUUyJ3Vnf//XPtGiLBVa470GoqF0ynT6/at8a:YuccNn2Vw7znJ3BvPtnLW5qF0yTUa6fC
MD5:	4D3A0258CF71A406CB7669FBE3FBEB2E
SHA1:	0811273369EADF2604DB3C53426F85FE74B785E4
SHA-256:	C156050A5D788BAD7D8F36482072B44A23F502F23C5F9198F6EB1EB066765DEE
SHA-512:	837A275BC63DD19F5F8553E056C5EAF257D530A54E0EC386BB28B0A515CA58929E3464612C30D9E7034ACF7473119E03B00EBAB26B220391330FEF12BC087973
Malicious:	false
Preview:	.PNG........IHDR...d...I............tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:3EBDD818F71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:3EBDD819F71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEFFF71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDF00F71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..}....UIDATx..K.Q..sj-HT...X..t.Z.P.A$...v...._.-]DAkG....#.B....dr.(..@.*......-y.......<H.......{..^.\NA\|h..

C:\Program Files\McAfee\Temp1545665699\installer.exe

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2547224
Entropy (8bit):	6.436358521132625
Encrypted:	false
SSDEEP:	49152:b1ozsi6h5ZDowUudY6oX26bZXKvBH4PKECsLrrrrrWeuZby:j3U6D6bZXeYHuZ
MD5:	A73E06FF4B9999811AFFE523D5710C51
SHA1:	EBC26B206BA9CB64B6FF66CC98EF08C791E5BCD6
SHA-256:	61C3D978E6165622EE608843CDA7EE9E0582DC04EDC8EFD2D5A847FDF73CB0D9
SHA-512:	B069B505D05EF17A0B2287A36613EF1D462783B0A633A2C8750FD1A95A34738226ACD9C9105D01F4F7F864769C8F5B71A5D82F54FB9D84B3BC0B4CE4C9B43D47
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......>c!.z.O.z.O.z.O.!jL.w.O.!jJ..O.(wK.i.O.(wL.p.O..m..x.O.(wJ...O.!jK.e.O.sz..r.O.wJ.{.O.!jI.x.O.niN.x.O.!jN.a.O..lJ.p.O.z.O.{.O..lK.:.O.z.N..O.wF...O.w..{.O.z...{.O.wM.{.O.Richz.O.........PE..d...^.he.........."..........&......@,.........@.............................`&.....l0'...`.................................................x0..h....@...........F....%......0&.(-...O..p....................O..(...@d..8...............0....+.......................text...n........................... ..`.rdata...Z.......\..................@..@.data....`...`...2...B..............@....pdata...F.......H...t..............@..@.didat....... ......................@..._RDATA.......0......................@..@.rsrc........@......................@..@.reloc..(-...0&.......%.............@..B................................................................................................

C:\ProgramData\AVG\Icarus\Logs\sfx.log

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (1337), with CRLF line terminators
Category:	dropped
Size (bytes):	14183
Entropy (8bit):	5.483454704594615
Encrypted:	false
SSDEEP:	384:/WxV4rifWubCu3PumHcr8rM4rqrbrRpr9rbiLrW0:e74rMBGoWKcQg4G/1pJniLi0
MD5:	38C88EE75CC255DD34A508507952E679
SHA1:	00C3F5A8E58C88702D26A9CFA8F8EBF9A63F7ABB
SHA-256:	EF59A2F78B11E8EA843E8306684DB0C7BD8C2E0D991D6E77AD36200F2ED4FDBF
SHA-512:	142517FC04A66F957253BA557DF3036FD5A42E24C480BA10073AB321A76057123B232AD4F271B5503A2DB871F00C32D5AE6CB71456C3D5A46D16C44F33B4F9F4
Malicious:	false
Preview:	.[2023-12-19 09:22:10.999] [info ] [isfx ] [ 5284: 4688] [000000: 0] * Starting SFX (23.8.6421.0), System(Windows 10 (10.0.19045) x64) *..[2023-12-19 09:22:10.999] [info ] [isfx ] [ 5284: 4688] [000000: 0] launched by:'6772-C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe'..[2023-12-19 09:22:11.015] [info ] [isfx ] [ 5284: 4688] [000000: 0] SFX started with command line '/silent /ws /psh:92pTtVrMpG6xzNiPw2zQDcpljgB1AnvPAw0qefblpEoa1wR4HgPPsGEupOsZXmbqoVTnBEo68S6u8u /cookie:mmm_irs_ppi_902_451_o /ga_clientid:6d11ded8-8432-4921-bfa3-224b760cd39e /edat_dir:C:\Windows\Temp\asw.5eb092b1255993ad'..[2023-12-19 09:22:11.015] [debug ] [isfx ] [ 5284: 4688] [000000: 0] DSA for file 'C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe' verified with result 'true'..[2023-12-19 09:22:11.015] [debug ] [isfx ] [ 5284: 5424] [000000: 0] Sending report data: ({"record":[{"event":{

C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00020052003E001D.txt

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.096513238904621
Encrypted:	false
SSDEEP:	6:rtxUhFLG6k2JM0RG0DKhS8htxvbGwZVjwOrADGq:ZUk2JTDFCfrjhroZ
MD5:	866A3D5E2DAD8A49BBFDF462F8F5F99E
SHA1:	07BC2F0A103B661AE28EDC385BEE1DB336074F48
SHA-256:	39BF7970C0EF648800306501CDA77384C0BE1B6C7045ECCA86B48E5C733EAA0E
SHA-512:	5B7C010C71FAD7C737B59F1BA57102E104B975B9C7B633C6D66CC8C0E195C3D099D71A757559BA77DBDD2FCEAB7E108F0096C29F64BDE5E0B2BA4F11F6E1FCAE
Malicious:	false
Preview:	[ERR][20231219 11:55:30.531][ProcessUtils.cpp@210]: Failed to get executable filename for process with id 3876. Error 31..[ERR][20231219 11:55:42.995][HttpsDownloadFile.cpp@200]: Unable to open HTTP transaction..

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_caffeine-1.5-ins_99a9375ba22a69393a4b3869e21b492d8172a3_6d038bba_d0e5cf32-eae8-4a2b-8735-ad3643b2ea6a\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4290236402060783
Encrypted:	false
SSDEEP:	192:dfOONoj02zHdjcvO3TfR1IXSzuiFRZ24IO8tK:VxNoQ2zHdjPfRyizuiFRY4IO8tK
MD5:	96924C3E33A69F2B90D995D3E8729213
SHA1:	03DEADC81778853C9DD1D32C96019FEBF42D4418
SHA-256:	3C7AF39DE7F6C45DA7C5BD44CEBC19F98DE0031DE418F15E360272F8FE3F3613
SHA-512:	A6B9DEC47F219D814E14D570EB3EDE1F6A8A2446BF35BE755212DFDF72575333B0F0289C0145926B23FAA303625B11F9FEF869D920095852B9E4A8825C318A03
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.7.4.5.1.3.3.6.7.9.8.9.0.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.4.7.4.5.1.3.3.9.0.3.5.8.9.8.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.0.e.5.c.f.3.2.-.e.a.e.8.-.4.a.2.b.-.8.7.3.5.-.a.d.3.6.4.3.b.2.e.a.6.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.e.9.b.0.8.d.9.-.4.e.5.6.-.4.4.8.6.-.a.3.1.e.-.f.d.e.1.2.7.3.9.c.8.e.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.c.a.f.f.e.i.n.e.-.1...5.-.i.n.s.t.a.l.l.e.r._.q.a.k.-.f.w.1...t.m.p.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.2.4.-.0.0.0.1.-.0.0.1.4.-.d.8.f.b.-.b.8.c.a.5.c.3.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.0.9.5.b.1.e.7.9.1.e.8.e.c.3.4.0.0.e.b.3.f.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_caffeine-1.5-ins_ff2c1b7fba05b3378d97d3fd78f7fe5d6e891d_6d038bba_ff20c289-d710-4248-8bd3-01ef5df34eb1\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4287731476558396
Encrypted:	false
SSDEEP:	192:yMlFNS/0JecsM4jcvO3TfR1IXSzuiFRZ24IO8tK:FNSsJecsM4jPfRyizuiFRY4IO8tK
MD5:	06D47CA8E0204870304B59359D002493
SHA1:	B65C0DBEE3C48D8E5CF84EBC20C6119C275F32C3
SHA-256:	55C5C1CE9A10BFFD8B753C11A64271811650F6AC5D593249E3DACEFC853CC704
SHA-512:	71EBC217E3E172A46F2DD9A69425DD0C09D4E67621E49289461656EE1BC7822D9B36374A70CE5BCD72E02A7FA10FCB6F9AD81E3E0785A980D66FA974D63FB269
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.7.4.5.1.3.4.3.1.5.0.6.4.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.4.7.4.5.1.3.4.5.0.6.0.6.5.0.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.f.2.0.c.2.8.9.-.d.7.1.0.-.4.2.4.8.-.8.b.d.3.-.0.1.e.f.5.d.f.3.4.e.b.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.6.a.9.b.2.6.-.3.5.0.4.-.4.a.8.e.-.a.0.f.6.-.7.4.f.1.b.c.4.6.c.0.d.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.c.a.f.f.e.i.n.e.-.1...5.-.i.n.s.t.a.l.l.e.r._.q.a.k.-.f.w.1...t.m.p.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.2.4.-.0.0.0.1.-.0.0.1.4.-.d.8.f.b.-.b.8.c.a.5.c.3.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.0.9.5.b.1.e.7.9.1.e.8.e.c.3.4.0.0.e.b.3.f.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC19.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Dec 19 09:22:18 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	137286
Entropy (8bit):	2.1793636073587552
Encrypted:	false
SSDEEP:	768:aDnbEX2b1a4drdPawOjtLz8WpGYKyQrWZ9:aDdxdrVawktLz8Wp1KtSZ9
MD5:	4CF2CD03E3CAC7CF382E0C2A3A5273A5
SHA1:	F7F9B9BBC24228B06C8C4E4109EA424D15DE08A7
SHA-256:	D763089B13191C7282C166495D195FF165AA12C03404FDE099A01FA79AE8CD8C
SHA-512:	5FD2637DB17BEBA88610CC69B1A994C2941653A4D56CAC78DBE17A796F08651D69CE2DF4CBFD0E9B4DDF51B27C47F7BFB0491983515B7AE8D1E822B6405209AF
Malicious:	false
Preview:	MDMP..a..... ........`.e............D............/..X.......,....9...........p..........`.......8...........T............m..............4:.......... <..............................................................................eJ.......<......GenuineIntel............T.......$....`.e.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD14A.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8504
Entropy (8bit):	3.703674956245424
Encrypted:	false
SSDEEP:	192:R6l7wVeJpk7681RF6YGi6tT5Bgmfp+prNx89bKnVsfcbum:R6lXJpQ681RF6Yb6PBgmfp/Knufcr
MD5:	20DDE6F7F353BA7F46A72549C5DFF2CA
SHA1:	B49FB03BC84AF3FB42D3AD72189728FF6D55ED18
SHA-256:	ECFEF10BB97A1AC4F996C9367C28B0C0005025B404459961552DDBAD87733B69
SHA-512:	30CA0D4B73D7ADDC68F739CB37ED5705DFBBBE44390818B0B1F4AD111FCFF63369A9EB581EEC1CCB430ED877166994A05C02F6308F3F5D02CAEE95051A25AD8B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD226.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4841
Entropy (8bit):	4.477096387105873
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI91aWpW8VYswIYm8M4JXutXDWGX/FE+q8qHXokXFNoV8uL84z:uIjf8I7jb7VQJmX5XGHX5XjoyuQqd
MD5:	EB068EDBDDA1A7E9793F0B7070873B21
SHA1:	AA8E37425CA25931387BB9468C69C7911430AA3D
SHA-256:	2BFC355288233DABBD3A0F2AC3F04E5434542288B466BE56CA98EC6659660939
SHA-512:	A3619F888F56026619A66A7D9F8A131A10E7D596B9D4BF5CC763CB4511C5F87345153E54D1AAC081D7035647650D7BD86EB1BA67B629D6EFB99E060B33B27696
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="110904" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4D1.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Dec 19 09:22:23 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	132866
Entropy (8bit):	2.180052875959776
Encrypted:	false
SSDEEP:	768:KDnbEQ2b1a43r0PawMjtMjrjFzneCBkpAZKfCAt:KD6x3rKawCtwfFzeL6Kf
MD5:	D93F772BCD3205703053FCE763357839
SHA1:	8EAE9A5700A1A29242351C4E9690689F6C380E4F
SHA-256:	58AEB7B62B36C2E6AB131D012703F00FFFDD57AA3B101418508000827C5C4214
SHA-512:	6A3E56DD4952194DE5C2A86016C645C02E41210D4B09CCCF9AE5AAD77121C8703370B84E0A953F8B0F6F6944D19374B24C65F2B254ECB9B495A96C259CF9FA9C
Malicious:	false
Preview:	MDMP..a..... ........`.e............D............/..X.......,....9......t....p..........`.......8...........T............l..............4:.......... <..............................................................................eJ.......<......GenuineIntel............T.......$....`.e.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8C9.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8494
Entropy (8bit):	3.7028238862447114
Encrypted:	false
SSDEEP:	192:R6l7wVeJpkM6FmmBRF6YGUD6tT5BgmfdhrMZpDv89bFnVsfOv3m:R6lXJpX6FmmBRF6YvD6PBgmfdhrM8FnU
MD5:	6DC36775A200A04DFE6285FEDE14AAD4
SHA1:	BF3808C52A20D96C3F4C2302F40A23F2285ACE09
SHA-256:	A4F16FE374B7A00112C0A5E4561028F9234C6BB8E9D0CFC5E550C9944B9A324C
SHA-512:	1949488A540373AAD86EFD53D34B03693D977A49D491855D23F403822105605C409E8BEE7021FD2076AC0A0DE0CCF0CBB5C53EF901F2A8F587AD3A3B08661DBF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE909.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4841
Entropy (8bit):	4.475915745954432
Encrypted:	false
SSDEEP:	48:cvIwWl8zsdJg77aI91aWpW8VYsEYm8M4JXutXDWGXZF7+q8qHXokX/NoV8uL849d:uIjf3I7jb7VdJmX5XHHX5XFoyuQqd
MD5:	9EA699563BD1A80D09DCA2340BB6F92A
SHA1:	5EE6B9DA0D7EE412CCE7C4A6CCACE1947B43D244
SHA-256:	3DD2ABE4CEAC7D5EC23290BD1873D68C4A450159BE83BCA26DCF75E364C9C863
SHA-512:	E66F6079ED923BF537F037634520838B2CC252B3E51694A3525B8ED3CB3DE1141DDD929761A6F187AA8C8BE284809BB3F101C44E654DD370F415A521EFED6F19
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="110905" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.676048742462893
Encrypted:	false
SSDEEP:	24:ujsZPSIPSUcnA3/46giyfV4Hxk7P3Gus6acCQ4CXmW5mOgs:ujul2nQ4XfVkk7P3g6dB42mVs
MD5:	E94FB54871208C00DF70F708AC47085B
SHA1:	4EFC31460C619ECAE59C1BCE2C008036D94C84B8
SHA-256:	7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
SHA-512:	2E15B76E16264ABB9F5EF417752A1CBB75F29C11F96AC7D73793172BD0864DB65F2D2B7BE0F16BBBE686068F0C368815525F1E39DB5A0D6CA3AB18BE6923B898
Malicious:	false
Preview:	0..r0..Z.......vS..uFH....JH:N.0....H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...200318000000Z..450318000000Z0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450.."0....H.............0.........-.0.z.=.r.:K..a....g.7..~.....C..E..cW]....%..h.K..K.J...j..a'..D...?".O.....(..].Y.......,.3$.P:A..{.M.X8.........,..C...t...{.3..Yk....Z.{..U......L...u.o.a.tD....t..h.l&>.......0....\|U..p\$x %.gg...N4.kp..8...........;.gC....t./.....7=gl.E\.a.A.....w.FGs.....+....X.W..Z..%....r=....;D.&.........E.......Bng~B.qb...`.d....!N+.mh...tsg1z...yn\|..~FoM..+."D...7..aW...$..1s..5WG~.:E.-.Q.....7.e...k.w....?.0.o1..@........PvtY..m.2...~...u..J.,....+B..j6..L.............:.c...$d.......B0@0...U...........0...U.......0....0...U.........F...x9...C.VP..;0...*.H.............^+.t.4D_vH(@....n..%.{...=..v...0 ..`.....x.+.2..$.RR......9n....CA}..[.]...&..tr&....=;jR.<../.{.3.E.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.1022129572009
Encrypted:	false
SSDEEP:	6:kK6N/KcK2GhipWhliK8al0GQcmqe3KQjMIo1l2L/:+/K72GIWzyZ3qe3KQjxoK
MD5:	CB916198F16CF774B238DE26B5A8D786
SHA1:	D13F9B0733D060446E4071EFFF170E219FD81EF1
SHA-256:	C804FAADFF39534A53AEDE4E5A10F5C61D62341196CC46237A69A542899BE704
SHA-512:	672749BFFAE68E42E0293D6BEFF57F87D2051D1A8CCA54C7F589A3CC6A47738D456649E5540E97871484EBAB38A75C9D9D4ADFC8958CCFE5A1D579CC35341764
Malicious:	false
Preview:	p...... ....v......\2..(....................................................... .................(.............v...h.t.t.p.:././.s.e.c.u.r.e...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.a.c.e.r.t./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5...c.r.t...".6.2.f.a.3.3.e.5.-.5.7.6."...

C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp

Process:	C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3209760
Entropy (8bit):	6.3327543477081925
Encrypted:	false
SSDEEP:	49152:CWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:utLutqgwh4NYxtJpkxhGj333T
MD5:	7F584FB8A2E785D4662266D877DBE18C
SHA1:	5407F12AA2F1326E6A411751DC6C588D321A174C
SHA-256:	6F2A8E7E0E8F876C0A6CA1846C0EB4B5B2E331D64AB3FAAE31E9E6762C257750
SHA-512:	7833C9E3EDA58AA28D328529AEA344361F3948AB321F768294AF7999A42A048A4BD3841F4377C8503FB40BBFD99640C36A6A15630A9ABE7BE14132B42E849A74
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 7%, Browse
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1.....Z.1...@......@....................-.......-..9....................0. (...........................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Process:	C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3209760
Entropy (8bit):	6.3327543477081925
Encrypted:	false
SSDEEP:	49152:CWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:utLutqgwh4NYxtJpkxhGj333T
MD5:	7F584FB8A2E785D4662266D877DBE18C
SHA1:	5407F12AA2F1326E6A411751DC6C588D321A174C
SHA-256:	6F2A8E7E0E8F876C0A6CA1846C0EB4B5B2E331D64AB3FAAE31E9E6762C257750
SHA-512:	7833C9E3EDA58AA28D328529AEA344361F3948AB321F768294AF7999A42A048A4BD3841F4377C8503FB40BBFD99640C36A6A15630A9ABE7BE14132B42E849A74
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 7%, Browse
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1.....Z.1...@......@....................-.......-..9....................0. (...........................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\AVG_AV.png (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	46850
Entropy (8bit):	7.966713276566761
Encrypted:	false
SSDEEP:	768:9CAfqjqFbKf4TE7quHTMPFhhgUxjEXa24KQtxe85fqlTmrY4kzT43cKLiV3YaGtm:Uk46S+E9z+UYSZhQtp5f2yFas31LiV3z
MD5:	DDC88AFCDF16B6E00F6181FE6B8EE8C1
SHA1:	05763D0FCA0061F21E718DDC77EB64317B457645
SHA-256:	D5F8BA42D45BAFF2435B7B1AE6D33E1ACCB7E23724BFC2D1473319B7BB02F30C
SHA-512:	05F4142067E6213282CC0548ECF6779D6B48764E277F7486D108EA1914F67E75B0CE54CBC85657503C0FBD3C5CBDA0626144C7E96233D3977ECA1A37CCA60A35
Malicious:	false
Preview:	.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a.....IDATx.......y&.?=aw6."g.@..#..b.%..,K"(.A.m,.;.....,[...aq.O'...p:.w.}..-Y..PT..1.HQ.X..3.A....&.Wou.tuO......C6...B....[...F...z.....3..hhh...44444444....hhT.$44J#........FeHAC.4....(...hhT..y....`.=...(...hhT.....Q....hhT.MF44AN........F..dDC..D..1.......UC..h2..Q..&R.;.Q..t$4a.....hhT..\|....0;...Q.B....5.D..`"."Z..y..u.........;d...}..r2^MS..H.g...?Y...m,..C..,..se.K......cYi...r........+.......d.>.Q%l..}....!...)..vc..#...>...i(~;;(.d...+..G>.i......ym}....y..^..~+o.e..O...y.A.D....O.r.}#..c...8...D.(=.Mb...be....}..?.q....W{l...y.).b.B.*0.W.M.....3..1..w$....2.D....'.y.....?.. H.?y...N~.c..q.....M?.".k...;X."0./.....v.....e..8..?6. .......%.r..!.../]....`..RZ"...]..............r.R....A.:..[..U~.......#.....~.........Ll...F..cF44..%...$P.l.... ..u..?....9!h..}y.c.....]/X.<.2.K..".F.m..g"02/..".O.D2.@.........P..~...p...t${.sO...._u..Xu<...tH/....

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\WebAdvisor.png (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	48005
Entropy (8bit):	7.924596711570388
Encrypted:	false
SSDEEP:	768:kLse/Ia4qCtiJ5BX17ZzMt1itbKT6GbnMHFFQCIN3HklYMsfa1pDLfkh:kLshpqCtiJ7179Mt/T6SMD/80lYMsULQ
MD5:	5FD73821F3F097D177009D88DFD33605
SHA1:	1BACBBFE59727FA26FFA261FB8002F4B70A7E653
SHA-256:	A6ECCE54116936CA27D4BE9797E32BF2F3CFC7E41519A23032992970FBD9D3BA
SHA-512:	1769A6DFAA30AAC5997F8D37F1DF3ED4AAB5BBEE2ABBCB30BDE4230AFED02E1EA9E81720B60F093A4C7FB15E22EE15A3A71FF7B84F052F6759640734AF976E02
Malicious:	false
Preview:	.PNG........IHDR.......h.......(.....sRGB.........gAMA......a.....pHYs.................IDATx^....mWu.....%. ..+t....v..F.s.N%@U...r....v.J%.\|i..r......)W..../I.I.Hc.....]p.n.@.....-..........g.9.Z{..Os...o..\s.9.c6{.u...c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..4.Wc.1.C.._~.x<~.d2....+....f/x..{766n;u...w.}..[...ox..;.......y..MN~u.=.=r/.u.......g.\|...4...mW?.g.;.....;.L.pOs....~v...-}:.T>v....nR..H....r....}2.`1.1~...O.gvb.9...............n=r....n...W\qn..^1.N.w..;...=w.u.[%...lxo.....L.....\|.K..Y.Rx./.f............8....y..\...{.7..._..,{!>..oy...~...Y.........q./.......N...t...y..1..L...._5]....x\|y..@.Zy.\y..W>.../....g<._t.....N..^w.'n..m...x<.!...{....Kf.;...../...W....f.K...^~.x4.xvZ......T...W.....k.?q..t.....Gc....~5.......z.f..wJ....1.U..P...}c2{]....1.O..;.<~WY\~..k.=2..(..\|........wp....O=9...5y..&....}...~...:..Y..\|..\z.W.~.S.._..7..[[.qd2..9

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\_isetup\_setup64.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: MDE_File_Sample_aa447845a64e29145a9489f43972beebcb33cfba.zip, Detection: malicious, Browse Filename: iguufjAqnn.exe, Detection: malicious, Browse Filename: fNEOQV1Qo2.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: ZmWSzgevgt.exe, Detection: malicious, Browse Filename: ZmWSzgevgt.exe, Detection: malicious, Browse Filename: wechat_XC560-1.exe, Detection: malicious, Browse Filename: wechat_XC560-1.exe, Detection: malicious, Browse Filename: Promenta_Addin_3.0.10.119.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: RDPInstaller.exe, Detection: malicious, Browse Filename: RDPInstaller.exe, Detection: malicious, Browse Filename: RDPInstaller.exe, Detection: malicious, Browse Filename: RDPInstaller.exe, Detection: malicious, Browse Filename: app-version.exe, Detection: malicious, Browse Filename: app-version.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Backdoor.Win32.Bladabindi.exe, Detection: malicious, Browse Filename: Backdoor.Win32.Bladabindi.exe, Detection: malicious, Browse Filename: CrystalExplorer-21.5-windows-x86_64.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\caffeine-1.5-installer.exe (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (34566)
Category:	dropped
Size (bytes):	322825
Entropy (8bit):	5.424274182819117
Encrypted:	false
SSDEEP:	1536:UQgpC3aS2jCd4RpuF6afWkhbDwh2+PvYtnWVeBK9ats+CWy2DQzgxXJQsvdHkKzQ:UQgmWk2rPDc6jWCgx4ySKVDc
MD5:	F8F266B8B8DF5F945D388E56D6C957EF
SHA1:	DF310A62F4E58393504604896D7302C121AAE692
SHA-256:	E50D9A38AD582FB3D1DEBCC2B0F6DBDBE3E570C0E1EB361B7B13D69069A6CCD5
SHA-512:	18CE0A68C96EBB5CC32848A1FF2CF2173BD774ACC7188D5B3324357F9BBCAF465C74A8FA241D332AA258159DD40B1E915463156FA23F7A26429BA9972271D0BF
Malicious:	false
Preview:	<!DOCTYPE html><html lang="pt-BR"><head><meta charset="utf-8"><meta http-equiv="x-ua-compatible" content="ie=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Caffeine - Download</title><link rel="preconnect" href="https://sc.sftcdn.net"><link rel="preconnect" href="https://images.sftcdn.net"><link rel="preconnect" href="//sdk.privacy-center.org"><link rel="preconnect" href="//securepubads.g.doubleclick.net"><link rel="preconnect" href="//www.googletagmanager.com"><link rel="preconnect" href="//c.amazon-adsystem.com"><meta name="description" content="Caffeine, download gr.tis. Caffeine 1.5: Dose certa de cafe.na para o computador n.o dormir. "><meta name="robots" content="all"><link rel="canonical" href="https://caffeine.softonic.com.br"><link rel="alternate" hreflang="es" href="https://caffeine.softonic.com"><link rel="alternate" hreflang="nl" href="https://caffeine.softonic.nl"><link rel="alternate" hreflang="pt" href="https://caffeine.softonic.com.b

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0 (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	511969
Entropy (8bit):	7.996152621854539
Encrypted:	true
SSDEEP:	12288:bVvrkApG/uBdvBLPzHb4HZDed4fze+xe3/x3y:btkeXv1z74HJtfzeNPx3y
MD5:	CD9C77BC5840AF008799985F397FE1C3
SHA1:	9B526687A23B737CC9468570FA17378109E94071
SHA-256:	26D7704B540DF18E2BCCD224DF677061FFB9F03CAB5B3C191055A84BF43A9085
SHA-512:	DE82BD3CBFB66A2EA0CC79E19407B569355AC43BF37EECF15C9EC0693DF31EE480EE0BE8E7E11CC3136C2DF9E7EF775BF9918FE478967EEE14304343042A7872
Malicious:	true
Preview:	PK.........Y.V..@I...h.......saBSI.exe..\......6i.%PJ..4.i.h....U.b...kZ...-.C.+U.pF.`..\....TT.i.J[.ie.......9.Ne..S....w...\(..>..........{....J/7..x..W_q\;G....lq.7s...\.W...J_...o......-W.h...n.\m..:.7.o..\\|...7W^wZb..<...-..../..I..7.W.9...@.Ov......W?.>...../....!,WW.'...~......>.F.........}.....}...vC......^.W..e....!.[..<....c5..M..T..nR....\w..U...O..g.....<....'.N.o.....CH..'...o..$...>....H..f..4p.....K.....C.,..c.....}5.3.E..V}]M5.,=.....+e...<mK...Ws.kS'.....}2......w?:.'q.....p..i.7 It.*....zC..[.\...mHle.H.[...............U...M\..u.q..uz....r.j8.'...M...-..m...EU.[......-..b]f3:n.@.p3R8.z.F..Y...../...X...C.p...Z=:..C ......b.X...T"<...@..\|1.......j..p<...0...,..p\|..C....O.a=.......X...Z.I.........aa..^...Zp"a.U.u......\|......A._.[.d.(,#..`.....;.a'V...Z...i .0.x...`.Z,...;.Xx:..A..\|...b.]X........n.a8..X....ba...D8... .......p'..j.R".... ......p?..ja...... ..~;.....0T._...I <.[Z?.D.....<...(..a.....>8.^l...

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0.zip (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	511969
Entropy (8bit):	7.996152621854539
Encrypted:	true
SSDEEP:	12288:bVvrkApG/uBdvBLPzHb4HZDed4fze+xe3/x3y:btkeXv1z74HJtfzeNPx3y
MD5:	CD9C77BC5840AF008799985F397FE1C3
SHA1:	9B526687A23B737CC9468570FA17378109E94071
SHA-256:	26D7704B540DF18E2BCCD224DF677061FFB9F03CAB5B3C191055A84BF43A9085
SHA-512:	DE82BD3CBFB66A2EA0CC79E19407B569355AC43BF37EECF15C9EC0693DF31EE480EE0BE8E7E11CC3136C2DF9E7EF775BF9918FE478967EEE14304343042A7872
Malicious:	true
Preview:	PK.........Y.V..@I...h.......saBSI.exe..\......6i.%PJ..4.i.h....U.b...kZ...-.C.+U.pF.`..\....TT.i.J[.ie.......9.Ne..S....w...\(..>..........{....J/7..x..W_q\;G....lq.7s...\.W...J_...o......-W.h...n.\m..:.7.o..\\|...7W^wZb..<...-..../..I..7.W.9...@.Ov......W?.>...../....!,WW.'...~......>.F.........}.....}...vC......^.W..e....!.[..<....c5..M..T..nR....\w..U...O..g.....<....'.N.o.....CH..'...o..$...>....H..f..4p.....K.....C.,..c.....}5.3.E..V}]M5.,=.....+e...<mK...Ws.kS'.....}2......w?:.'q.....p..i.7 It.*....zC..[.\...mHle.H.[...............U...M\..u.q..uz....r.j8.'...M...-..m...EU.[......-..b]f3:n.@.p3R8.z.F..Y...../...X...C.p...Z=:..C ......b.X...T"<...@..\|1.......j..p<...0...,..p\|..C....O.a=.......X...Z.I.........aa..^...Zp"a.U.u......\|......A._.[.d.(,#..`.....;.a'V...Z...i .0.x...`.Z,...;.Xx:..A..\|...b.]X........n.a8..X....ba...D8... .......p'..j.R".... ......p?..ja...... ..~;.....0T._...I <.[Z?.D.....<...(..a.....>8.^l...

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28927992
Entropy (8bit):	7.99259034567798
Encrypted:	true
SSDEEP:	786432:kp2n6SYz81bEmOX/JYHl3mdb16XJasHtpw6YWuOX:kcn6SVlOX/aFWdb8Q4MzW3X
MD5:	CCAC594E57F446FA24A364A6F37C0EE5
SHA1:	62CDEE60A05D4F0B95F7BA6B1C93FFAA1AA5E361
SHA-256:	3ABBE2EEF6A797D70337498F075223F556351874930AB68F2CAC1D1728BBBAFD
SHA-512:	9FAAD4154404055978297468F290F1C9236FFD9DB1BF87AD6A9105F8B2FDC8989F9008C991E7FA2651152C85D14E69CC55F7995D255D3CC603F62D73CF838DEB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w...w...w.......w.......w.......w.......w.......w.......w..4....w.......w...w...w..l....w..l.o..w..l....w..Rich.w..........................PE..d....gbd.........."................D..........@...................................Jj....`.....................................................(............p..L2...r..................p.......................(.......8.......................`....................text............................... ..`.rdata..vz.......\|..................@..@.data...t1...0......................@....pdata..L2...p...4...6..............@..@_RDATA...............j..............@..@.rsrc................l..............@..@.reloc...............f..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1162856
Entropy (8bit):	6.592896831755123
Encrypted:	false
SSDEEP:	24576:xoBm5Cq04JaEboVGtDNmCHUJX+va3BR1j0TbcsuefReNbHgYdGcp6S58p0Q894xp:Bo2oVGtDJvva3BR1jxCfReNbHgYdGcQv
MD5:	BB7CF61C4E671FF05649BDA83B85FA3D
SHA1:	DB3FDEAF7132448D2A31A5899832A20973677F19
SHA-256:	9D04462E854EF49BCD6059767248A635912CE0F593521A7CC8AF938E6A027534
SHA-512:	63798024E1E22975D1BE1E8BFF828040D046D63DF29F07D6161C868526D5F08451E44B5FA60BFB0C22CF7880ABC03AAEDAFA2C5C844C3AEFF640E6FAC9586AAB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$...............................:.................p................................;......e......D............e......;......;.r....;......Rich...................PE..L...]..d.....................d....................@..................................(....@.............................................p...............h.......8.......p...............................@...............(....... ....................text...L........................... ..`.rdata..............................@..@.data...$........~..................@....didat...............R..............@....rsrc...p............T..............@..@.reloc..8............X..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1 (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	125405
Entropy (8bit):	7.996684823256823
Encrypted:	true
SSDEEP:	3072:U7Uc8cJ1YuWatSIyY6NCW23L2XEYL02BmusGPCeoDhL8oLvoLH:WJ1zWuSNYJWCGEK9BmPCkhfL4
MD5:	56B0D3E1B154AE65682C167D25EC94A6
SHA1:	44439842B756C6FF14DF658BEFCCB7A294A8EA88
SHA-256:	434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
SHA-512:	6F7211546C6360D4BE8C3BB38F1E5B1B4A136AA1E15EC5AE57C9670215680B27FF336C4947BD6D736115FA4DEDEA10AACF558B6988196F583B324B50D4ECA172
Malicious:	true
Preview:	PK.........XQW.a..............avg_antivirus_free_setup.exe.].\|TG........Mj.RH-V..6.@.....Z.....%@-....;@K(..,..STPT.T.GT...H.%..BBQ.6Z.&...4.wf.......OZ..........}.}l..,I...#.I........4I....GK.7...Z..........~...Og>..g>.Y_...,..&...HA.?....F..9...>.\|.\sJ.....N.L~.OY.......)5.......;...,~7.&...LJ6?... ....w~.\|.7.>..Kx..d.{J./....j..>....."i...6..%..t.i.M.H...&...~.oV.qO...!Qy.)......&.8......I..../&I.83Y......%K%. .'Y..+I%?H.J."...g.&/)A...^...I.]..}.'6..l.%.../.?..W..1.cH.1..}<...'...G`..t"..#.<\|.\...$x.9....\.....q..'6.U..Wi..u..`.X.+i..K./...O..p.............s.G........3y.Hz.V...=-.I..\)..}.S.WW$}.\I....n.H.IR.E.{...C0...s..X'.z...W.J.iL..........i...l..$..........A$=.2=...4[J6.(..l$....f....y.g...o..:m.B...$....&...".}.r{......n&./.xdBA~d.D.....5p....g..... _Z..-b...jg.o.wMA$.2...=..5.&x.....,?..MF...2QVO,V.N..........R.^..o..o..4.hd.H..LE.SBE,.8\|Eo&d..D.Vq..NK.[.[.g.K.v..D".....og.m1....x..C....b..`?2...L...t..O.t.U..l..02.v.A.G2

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1.zip (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	125405
Entropy (8bit):	7.996684823256823
Encrypted:	true
SSDEEP:	3072:U7Uc8cJ1YuWatSIyY6NCW23L2XEYL02BmusGPCeoDhL8oLvoLH:WJ1zWuSNYJWCGEK9BmPCkhfL4
MD5:	56B0D3E1B154AE65682C167D25EC94A6
SHA1:	44439842B756C6FF14DF658BEFCCB7A294A8EA88
SHA-256:	434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
SHA-512:	6F7211546C6360D4BE8C3BB38F1E5B1B4A136AA1E15EC5AE57C9670215680B27FF336C4947BD6D736115FA4DEDEA10AACF558B6988196F583B324B50D4ECA172
Malicious:	true
Preview:	PK.........XQW.a..............avg_antivirus_free_setup.exe.].\|TG........Mj.RH-V..6.@.....Z.....%@-....;@K(..,..STPT.T.GT...H.%..BBQ.6Z.&...4.wf.......OZ..........}.}l..,I...#.I........4I....GK.7...Z..........~...Og>..g>.Y_...,..&...HA.?....F..9...>.\|.\sJ.....N.L~.OY.......)5.......;...,~7.&...LJ6?... ....w~.\|.7.>..Kx..d.{J./....j..>....."i...6..%..t.i.M.H...&...~.oV.qO...!Qy.)......&.8......I..../&I.83Y......%K%. .'Y..+I%?H.J."...g.&/)A...^...I.]..}.'6..l.%.../.?..W..1.cH.1..}<...'...G`..t"..#.<\|.\...$x.9....\.....q..'6.U..Wi..u..`.X.+i..K./...O..p.............s.G........3y.Hz.V...=-.I..\)..}.S.WW$}.\I....n.H.IR.E.{...C0...s..X'.z...W.J.iL..........i...l..$..........A$=.2=...4[J6.(..l$....f....y.g...o..:m.B...$....&...".}.r{......n&./.xdBA~d.D.....5p....g..... _Z..-b...jg.o.wMA$.2...=..5.&x.....,?..MF...2QVO,V.N..........R.^..o..o..4.hd.H..LE.SBE,.8\|Eo&d..D.Vq..NK.[.[.g.K.v..D".....og.m1....x..C....b..`?2...L...t..O.t.U..l..02.v.A.G2

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	234936
Entropy (8bit):	6.580764795165994
Encrypted:	false
SSDEEP:	3072:y2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCoKOhh3K0Ko:y0KgGwHqwOOELha+sm2D2+UhngNdK4d
MD5:	26816AF65F2A3F1C61FB44C682510C97
SHA1:	6CA3FE45B3CCD41B25D02179B6529FAEDEF7884A
SHA-256:	2025C8C2ACC5537366E84809CB112589DDC9E16630A81C301D24C887E2D25F45
SHA-512:	2426E54F598E3A4A6D2242AB668CE593D8947F5DDB36ADED7356BE99134CBC2F37323E1D36DB95703A629EF712FAB65F1285D9F9433B1E1AF0123FD1773D0384
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v jU2A..2A..2A......9A......LA......*A..`).. A..`)..'A...(..0A..`)...A..;9..3A..;9..?A..2A...A..;9..3A...(..?A...(..3A..2A..0A...(..3A..Rich2A..................PE..L....m6d.........."..........\...... ........0....@.................................V.....@........................................................Hl..p)..........p...p..........................`M..@............0......T........................text............................... ..`.rdata..`....0......................@..@.data...............................@....didat..L...........................@....rsrc...............................@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\is-1SK1O.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	48005
Entropy (8bit):	7.924596711570388
Encrypted:	false
SSDEEP:	768:kLse/Ia4qCtiJ5BX17ZzMt1itbKT6GbnMHFFQCIN3HklYMsfa1pDLfkh:kLshpqCtiJ7179Mt/T6SMD/80lYMsULQ
MD5:	5FD73821F3F097D177009D88DFD33605
SHA1:	1BACBBFE59727FA26FFA261FB8002F4B70A7E653
SHA-256:	A6ECCE54116936CA27D4BE9797E32BF2F3CFC7E41519A23032992970FBD9D3BA
SHA-512:	1769A6DFAA30AAC5997F8D37F1DF3ED4AAB5BBEE2ABBCB30BDE4230AFED02E1EA9E81720B60F093A4C7FB15E22EE15A3A71FF7B84F052F6759640734AF976E02
Malicious:	false
Preview:	.PNG........IHDR.......h.......(.....sRGB.........gAMA......a.....pHYs.................IDATx^....mWu.....%. ..+t....v..F.s.N%@U...r....v.J%.\|i..r......)W..../I.I.Hc.....]p.n.@.....-..........g.9.Z{..Os...o..\s.9.c6{.u...c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..4.Wc.1.C.._~.x<~.d2....+....f/x..{766n;u...w.}..[...ox..;.......y..MN~u.=.=r/.u.......g.\|...4...mW?.g.;.....;.L.pOs....~v...-}:.T>v....nR..H....r....}2.`1.1~...O.gvb.9...............n=r....n...W\qn..^1.N.w..;...=w.u.[%...lxo.....L.....\|.K..Y.Rx./.f............8....y..\...{.7..._..,{!>..oy...~...Y.........q./.......N...t...y..1..L...._5]....x\|y..@.Zy.\y..W>.../....g<._t.....N..^w.'n..m...x<.!...{....Kf.;...../...W....f.K...^~.x4.xvZ......T...W.....k.?q..t.....Gc....~5.......z.f..wJ....1.U..P...}c2{]....1.O..;.<~WY\~..k.=2..(..\|........wp....O=9...5y..&....}...~...:..Y..\|..\z.W.~.S.._..7..[[.qd2..9

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\is-6O4VH.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	511969
Entropy (8bit):	7.996152621854539
Encrypted:	true
SSDEEP:	12288:bVvrkApG/uBdvBLPzHb4HZDed4fze+xe3/x3y:btkeXv1z74HJtfzeNPx3y
MD5:	CD9C77BC5840AF008799985F397FE1C3
SHA1:	9B526687A23B737CC9468570FA17378109E94071
SHA-256:	26D7704B540DF18E2BCCD224DF677061FFB9F03CAB5B3C191055A84BF43A9085
SHA-512:	DE82BD3CBFB66A2EA0CC79E19407B569355AC43BF37EECF15C9EC0693DF31EE480EE0BE8E7E11CC3136C2DF9E7EF775BF9918FE478967EEE14304343042A7872
Malicious:	false
Preview:	PK.........Y.V..@I...h.......saBSI.exe..\......6i.%PJ..4.i.h....U.b...kZ...-.C.+U.pF.`..\....TT.i.J[.ie.......9.Ne..S....w...\(..>..........{....J/7..x..W_q\;G....lq.7s...\.W...J_...o......-W.h...n.\m..:.7.o..\\|...7W^wZb..<...-..../..I..7.W.9...@.Ov......W?.>...../....!,WW.'...~......>.F.........}.....}...vC......^.W..e....!.[..<....c5..M..T..nR....\w..U...O..g.....<....'.N.o.....CH..'...o..$...>....H..f..4p.....K.....C.,..c.....}5.3.E..V}]M5.,=.....+e...<mK...Ws.kS'.....}2......w?:.'q.....p..i.7 It.*....zC..[.\...mHle.H.[...............U...M\..u.q..uz....r.j8.'...M...-..m...EU.[......-..b]f3:n.@.p3R8.z.F..Y...../...X...C.p...Z=:..C ......b.X...T"<...@..\|1.......j..p<...0...,..p\|..C....O.a=.......X...Z.I.........aa..^...Zp"a.U.u......\|......A._.[.d.(,#..`.....;.a'V...Z...i .0.x...`.Z,...;.Xx:..A..\|...b.]X........n.a8..X....ba...D8... .......p'..j.R".... ......p?..ja...... ..~;.....0T._...I <.[Z?.D.....<...(..a.....>8.^l...

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\is-BDG9U.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	1386
Entropy (8bit):	7.609056598553053
Encrypted:	false
SSDEEP:	24:2QMQJy/oxEnf5a5t3/17D1CgzzMVSj4XDYVcNniBxElkC4a4YHfjK3c0x21w:2QMQ5xEnIl/1CCxj+pn/25a4YWWO
MD5:	84B4F322BF60F6ECB82FBA9E131FD62A
SHA1:	3CC7F73805260BFEAB6B7EF01F5A44A37A7E4B5F
SHA-256:	B20693C84F4EEF925702B191261ED86FE3878AA448A710B94F82684A89FD041E
SHA-512:	FD525575159CB82F9F22D8FAC698EBA00F38E1EEF7B048E9A958FD37739F8F847A0F7994D5B0F53904E00475FD189C7B313DCE7B748C45227240C487F552A70A
Malicious:	false
Preview:	......JFIF...........................................,. .. .,'/&$&/'F7117FQD@DQbXXb\|v\|................................,. .. .,'/&$&/'F7117FQD@DQbXXb\|v\|.........d.d.."............................................................!...Q1Aa."2BRq..3.CSr.b..............................................A.1.!aQ............?...g'...../..@..A...(.2.....9.....V..~..3\.Kk/..'...........e].`...ju...r.C.....B. gd...y..Y.... .#I...j..X..o.'...5..h..@...7.j$6Zk...)....s..e.....=X{I....2}.S. .VMl{k..5.9.1..{.<.[..g...i3.YU..O.1........".....c1e..e6u._?8.~9>v..1..Bh........Kd. .\|^.u....1>../..2.]}..]....y....~....fV!.d...9.\|.v...{x.P<\.. .Q-.....$.q....J2H$...._n.OG.....(.4]ke..Z3.e...\F..7S...a.....k.X..ve.a.5..........f.....+....7.........dz..C[.`w....j......Pd..../Y.;.%q..B....r..w;.J[..........V...~.XrHG.t....b.)....\.[Yb.4.p........X..vn.2.z 6?.].....EcO.mc....dP..%8...($...2[WP...I.Wi...O.U_...tq...?................c.....&iv2.6...q.....5....=.......7...T.gUy....

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\is-N988B.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	46850
Entropy (8bit):	7.966713276566761
Encrypted:	false
SSDEEP:	768:9CAfqjqFbKf4TE7quHTMPFhhgUxjEXa24KQtxe85fqlTmrY4kzT43cKLiV3YaGtm:Uk46S+E9z+UYSZhQtp5f2yFas31LiV3z
MD5:	DDC88AFCDF16B6E00F6181FE6B8EE8C1
SHA1:	05763D0FCA0061F21E718DDC77EB64317B457645
SHA-256:	D5F8BA42D45BAFF2435B7B1AE6D33E1ACCB7E23724BFC2D1473319B7BB02F30C
SHA-512:	05F4142067E6213282CC0548ECF6779D6B48764E277F7486D108EA1914F67E75B0CE54CBC85657503C0FBD3C5CBDA0626144C7E96233D3977ECA1A37CCA60A35
Malicious:	false
Preview:	.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a.....IDATx.......y&.?=aw6."g.@..#..b.%..,K"(.A.m,.;.....,[...aq.O'...p:.w.}..-Y..PT..1.HQ.X..3.A....&.Wou.tuO......C6...B....[...F...z.....3..hhh...44444444....hhT.$44J#........FeHAC.4....(...hhT..y....`.=...(...hhT.....Q....hhT.MF44AN........F..dDC..D..1.......UC..h2..Q..&R.;.Q..t$4a.....hhT..\|....0;...Q.B....5.D..`"."Z..y..u.........;d...}..r2^MS..H.g...?Y...m,..C..,..se.K......cYi...r........+.......d.>.Q%l..}....!...)..vc..#...>...i(~;;(.d...+..G>.i......ym}....y..^..~+o.e..O...y.A.D....O.r.}#..c...8...D.(=.Mb...be....}..?.q....W{l...y.).b.B.*0.W.M.....3..1..w$....2.D....'.y.....?.. H.?y...N~.c..q.....M?.".k...;X."0./.....v.....e..8..?6. .......%.r..!.../]....`..RZ"...]..............r.R....A.:..[..U~.......#.....~.........Ll...F..cF44..%...$P.l.... ..u..?....9!h..}y.c.....]/X.<.2.K..".F.m..g"02/..".O.D2.@.........P..~...p...t${.sO...._u..Xu<...tH/....

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\is-O80R5.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (34566)
Category:	dropped
Size (bytes):	322825
Entropy (8bit):	5.424274182819117
Encrypted:	false
SSDEEP:	1536:UQgpC3aS2jCd4RpuF6afWkhbDwh2+PvYtnWVeBK9ats+CWy2DQzgxXJQsvdHkKzQ:UQgmWk2rPDc6jWCgx4ySKVDc
MD5:	F8F266B8B8DF5F945D388E56D6C957EF
SHA1:	DF310A62F4E58393504604896D7302C121AAE692
SHA-256:	E50D9A38AD582FB3D1DEBCC2B0F6DBDBE3E570C0E1EB361B7B13D69069A6CCD5
SHA-512:	18CE0A68C96EBB5CC32848A1FF2CF2173BD774ACC7188D5B3324357F9BBCAF465C74A8FA241D332AA258159DD40B1E915463156FA23F7A26429BA9972271D0BF
Malicious:	false
Preview:	<!DOCTYPE html><html lang="pt-BR"><head><meta charset="utf-8"><meta http-equiv="x-ua-compatible" content="ie=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Caffeine - Download</title><link rel="preconnect" href="https://sc.sftcdn.net"><link rel="preconnect" href="https://images.sftcdn.net"><link rel="preconnect" href="//sdk.privacy-center.org"><link rel="preconnect" href="//securepubads.g.doubleclick.net"><link rel="preconnect" href="//www.googletagmanager.com"><link rel="preconnect" href="//c.amazon-adsystem.com"><meta name="description" content="Caffeine, download gr.tis. Caffeine 1.5: Dose certa de cafe.na para o computador n.o dormir. "><meta name="robots" content="all"><link rel="canonical" href="https://caffeine.softonic.com.br"><link rel="alternate" hreflang="es" href="https://caffeine.softonic.com"><link rel="alternate" hreflang="nl" href="https://caffeine.softonic.nl"><link rel="alternate" hreflang="pt" href="https://caffeine.softonic.com.b

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\is-QOOSL.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	125405
Entropy (8bit):	7.996684823256823
Encrypted:	true
SSDEEP:	3072:U7Uc8cJ1YuWatSIyY6NCW23L2XEYL02BmusGPCeoDhL8oLvoLH:WJ1zWuSNYJWCGEK9BmPCkhfL4
MD5:	56B0D3E1B154AE65682C167D25EC94A6
SHA1:	44439842B756C6FF14DF658BEFCCB7A294A8EA88
SHA-256:	434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
SHA-512:	6F7211546C6360D4BE8C3BB38F1E5B1B4A136AA1E15EC5AE57C9670215680B27FF336C4947BD6D736115FA4DEDEA10AACF558B6988196F583B324B50D4ECA172
Malicious:	false
Preview:	PK.........XQW.a..............avg_antivirus_free_setup.exe.].\|TG........Mj.RH-V..6.@.....Z.....%@-....;@K(..,..STPT.T.GT...H.%..BBQ.6Z.&...4.wf.......OZ..........}.}l..,I...#.I........4I....GK.7...Z..........~...Og>..g>.Y_...,..&...HA.?....F..9...>.\|.\sJ.....N.L~.OY.......)5.......;...,~7.&...LJ6?... ....w~.\|.7.>..Kx..d.{J./....j..>....."i...6..%..t.i.M.H...&...~.oV.qO...!Qy.)......&.8......I..../&I.83Y......%K%. .'Y..+I%?H.J."...g.&/)A...^...I.]..}.'6..l.%.../.?..W..1.cH.1..}<...'...G`..t"..#.<\|.\...$x.9....\.....q..'6.U..Wi..u..`.X.+i..K./...O..p.............s.G........3y.Hz.V...=-.I..\)..}.S.WW$}.\I....n.H.IR.E.{...C0...s..X'.z...W.J.iL..........i...l..$..........A$=.2=...4[J6.(..l$....f....y.g...o..:m.B...$....&...".}.r{......n&./.xdBA~d.D.....5p....g..... _Z..-b...jg.o.wMA$.2...=..5.&x.....,?..MF...2QVO,V.N..........R.^..o..o..4.hd.H..LE.SBE,.8\|Eo&d..D.Vq..NK.[.[.g.K.v..D".....og.m1....x..C....b..`?2...L...t..O.t.U..l..02.v.A.G2

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\mainlogo.png (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	1386
Entropy (8bit):	7.609056598553053
Encrypted:	false
SSDEEP:	24:2QMQJy/oxEnf5a5t3/17D1CgzzMVSj4XDYVcNniBxElkC4a4YHfjK3c0x21w:2QMQ5xEnIl/1CCxj+pn/25a4YWWO
MD5:	84B4F322BF60F6ECB82FBA9E131FD62A
SHA1:	3CC7F73805260BFEAB6B7EF01F5A44A37A7E4B5F
SHA-256:	B20693C84F4EEF925702B191261ED86FE3878AA448A710B94F82684A89FD041E
SHA-512:	FD525575159CB82F9F22D8FAC698EBA00F38E1EEF7B048E9A958FD37739F8F847A0F7994D5B0F53904E00475FD189C7B313DCE7B748C45227240C487F552A70A
Malicious:	false
Preview:	......JFIF...........................................,. .. .,'/&$&/'F7117FQD@DQbXXb\|v\|................................,. .. .,'/&$&/'F7117FQD@DQbXXb\|v\|.........d.d.."............................................................!...Q1Aa."2BRq..3.CSr.b..............................................A.1.!aQ............?...g'...../..@..A...(.2.....9.....V..~..3\.Kk/..'...........e].`...ju...r.C.....B. gd...y..Y.... .#I...j..X..o.'...5..h..@...7.j$6Zk...)....s..e.....=X{I....2}.S. .VMl{k..5.9.1..{.<.[..g...i3.YU..O.1........".....c1e..e6u._?8.~9>v..1..Bh........Kd. .\|^.u....1>../..2.]}..]....y....~....fV!.d...9.\|.v...{x.P<\.. .Q-.....$.q....J2H$...._n.OG.....(.4]ke..Z3.e...\F..7S...a.....k.X..ve.a.5..........f.....+....7.........dz..C[.`w....j......Pd..../Y.;.%q..B....r..w;.J[..........V...~.XrHG.t....b.)....\.[Yb.4.p........X..vn.2.z 6?.].....EcO.mc....dP..%8...($...2[WP...I.Wi...O.U_...tq...?................c.....&iv2.6...q.....5....=.......7...T.gUy....

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\v.png

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.714477225270132
Encrypted:	false
SSDEEP:	24:yghI+xfblaXCSfkpTXeJDXLEG0I9iN6H+bv7M1cjMqFPfSY0p:zhnxf0cXep8I9/kM1oMqf0p
MD5:	B0C2230B65C0350B0DF578CA82744E2A
SHA1:	ACB9E09DDF8A156F862E4F2FB782D49BC6C98EF1
SHA-256:	3974BFA83BFF0222F0D3B168EE6872CF77E3392C37138E8B252C17F85C2092CE
SHA-512:	54C3E1D174332FA60F295F1D474AD24D26C785A5BDDD7A6E50D780044BE39BAC9DA62C91C378BC55B780408632E5A845E2C8D3A8386E27DAF3705435D93DB1B2
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....sRGB.........gAMA......a.....pHYs..........o.d...1IDATx^...@....P..ED...C...?.../...k..........b..9?..A....+.............m..........lf.....e..yf'.w.,..U]..;.6.I..kDC,....>...x(....az.../E;#.AY.I..JqD.....P6uPWiDc....j....:..!qH\|.V#.i.m.U..}a5..h.m.E..Oa5.Hh.m.&...aU^&h..[b.......m..NDA7.UQ...;...O.\|...v.{~>..x.Z..#.g...2Nu.......2.9..SW..BK..A.os..E...o.6c..__O........=..(......0....%...:Ct..L.+..."k......G..A...: ..:.4.z.^...IG...D\|.......@#.E..'..%:....<.w...:.,...l.Y.....(..E......[F..;D.E.rr..Y."Hx....]..k.."..$...$........\|6...H..-~..u..wg....rq+r,..D......u]...;r .LG.z.p..K.%..o..u]..n~..+".l...:?...d.8..s.y0...E..rIX...%.go..5..[...nv..s.u.....#...p..$..DX.$.<z.y.d~X....}.<.]N..'.%.2.q..E.y..<..}.L......0I{DRv..O.U...@....Y ..6L]%...<_...b..nD..uD..x...f8.@.K....Y..&X..0.9.PvP.!..E...I. .)1.Xb..0.OX..A'%..h...Vq......a...x..GZ..2.X.J....".a.<......4.E...s..G...g..Jo.@,T*.E.Uz.T.

C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\x.png

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	7.771385462296204
Encrypted:	false
SSDEEP:	24:w2uAH0VWVgaH9/z/A8QOx4w5pUsxdKZ2xcgXnHdm1uRthMlfAWceMr1:w2l5iavQOCiUNEcgXHdmKt1WPMp
MD5:	F93BDF6A20411AE01F0A79FA38BA4F76
SHA1:	3322B04A4F83C056D922E5EFE1D1F7DF6CE013EF
SHA-256:	92877A95E0544AE4B683070EFA38A3F44E134369278D7CABC5D6E0036C2E37F5
SHA-512:	7976C88CE4EEF4E83BF26490A0025814DCAB081018422E538AB5AAEAED664C231CA0D9542F91F71AB5949B7CC5C25F235D8522198831824E026832FFAE282F76
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.k.A../.".B..V".......]..?."H...!""*"........."b'.(VZi#......a.y..vg.n.....yon~.y.;.K.-b.8,...b..-..v......,...."....N....G1..:..:....%N.O.r$..M....a.E.SXF...hs...U...e.(.ml....x-,....`.HtB...!....-..f7..x....Sb.x.....bs.Q..a5.e.9...J.......0.s..\|h%VT..I........-....3].rb.O..........."4..Rl.+.V.ZS........&b..8....v.>..gB..8_LX...uo.VEQ.....( .`..Pv>...LXe<`...N.T/.....s>...&.<#.......f.m....KE..\|"...}Q.....".h....Bt.#a./rNT.(D].g.\|.(bdo.D.0.....y.q..h..>gm...nh.C.......\.....cQ...\|../\..g....D^.n!E.)..\|..~,<C.N.#..=.VM..dAQ..dqAx....@Xm...w.......^...{...RpE..../..).....Tx.yQ8..`...\|7.H......g..g....}.o{.+02.b.0...^.Q,.V]1.@.E.U.....1J.l.L.....q>..@Pe...l.L......V.....~?+.6B......=.3......e..B...>.qN.8Ol...+<S..C..P..P..0..25U.y..rY.N...,...1(FB........c.)..7a=!.BSb.g.4...*_.....N........I.....lgl.u...U...(..M...t..,.U...m.zo..l....(dq.:.l_...N.q..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 19 08:22:15 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9838619494745933
Encrypted:	false
SSDEEP:	48:8DdtT1hpH28ZidAKZdA1FehwiZUklqehKy+3:8rvc6Fy
MD5:	683B010A1F74A33CA81ADEFA54723ABF
SHA1:	2962F0F22AFCD1B80B0DCDB870FBB2AC7CCC7CAA
SHA-256:	F3770C06A9174FC20873C1DD9ACA0981AB7E1C35A0DE057E2DAB9041F2827353
SHA-512:	CEB7C251F49737C0D0F6A594114E2D02DDA937799B5F2FE58C84B33DE22319DCD6045C3AE10E89428CF5B110D22BE1E605154F7F721463D503B45DF6D0625BB4
Malicious:	false
Preview:	L..................F.@.. ...$+.,....%\|..\2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.W.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[_.b.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 19 08:22:15 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9977623575878147
Encrypted:	false
SSDEEP:	48:8CdtT1hpH28ZidAKZdA1seh/iZUkAQkqeh1y+2:8Yvc09Qoy
MD5:	40EC9494F9AE02BA124CFFFE75D89762
SHA1:	6A4FA4F81D39013BCD804AAB30A753C2537E5348
SHA-256:	F89FAF8F05F3633E066F1F1E04A1AED8E0A92B8D9DDD596C91189812677C0DB2
SHA-512:	5F4C8D0DA23D12F0F789E3A5CBD798032E390EB5D93FFC55E53C9D582F6455CFEEEC29AD9378E4729AF631BDCE32ADA1AD98FE88EB53E0E115637680A86283BC
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....n..\2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.W.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[_.b.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.009874291249847
Encrypted:	false
SSDEEP:	48:8+dtT1hAH28ZidAKZdA14meh7sFiZUkmgqeh7sby+BX:8Uvr4n5y
MD5:	CFC37958D1F3B82A0891C24C76231FB8
SHA1:	AE5F2380C88809216F48D6F8E94A092D5AD616C7
SHA-256:	CCDC9F6EA6D98CAB489F04F851941B79FA3592372BF077376DAB968F0A0ECB18
SHA-512:	992402F7511115A1C66B381096A26BBAC11F7694DB775232C273622BE46A70D32435DDB8A6036A9E197747E3827EED12C56D324F99C0E8A20710AE35FB1F3882
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.W.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[_.b.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 19 08:22:15 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9940370100534417
Encrypted:	false
SSDEEP:	48:8pdtT1hpH28ZidAKZdA1TehDiZUkwqehxy+R:85vcvzy
MD5:	5517E96B7039BCF34E6F95AEA7C8CCA5
SHA1:	2035437148C653DF3EB2B80D9BEC1C0CF4358313
SHA-256:	32E46D4724B1139B68BEDD73DC3940CD7EDE4D14017A0C3363EA52312EEA2DFA
SHA-512:	442D3135789A1B8AFD70A95CA17A96D50C834D2AC6C4761057C5EE298A08381A6CCBEED0110CA306EF7F6F976467549E7215451356AB93713AA0ACE6745518F3
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....=..\2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.W.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[_.b.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 19 08:22:15 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9883163001053052
Encrypted:	false
SSDEEP:	48:8vdtT1hpH28ZidAKZdA1dehBiZUk1W1qehPy+C:83vcv9vy
MD5:	D0AE26AB5EF0FDC92D4313E14BC87BBE
SHA1:	EA4B5566D714D51E4FE4D61E488DF875B399E361
SHA-256:	A975A5BA34D2CD207634A1D92573506551B7105C9F4C9CED4A032C6001190A9C
SHA-512:	0A1B0DE4127F86C426A646C4EC3CCB541993B8091B6C2AB99DAFBF51CED9664FEA0ABC7B5C3CF066B6742AACA6A5183E652DC6B001ECD4FFA1F5A3A184861A1A
Malicious:	false
Preview:	L..................F.@.. ...$+.,........\2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.W.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[_.b.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 19 08:22:15 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9978782915135183
Encrypted:	false
SSDEEP:	48:8hdtT1hpH28ZidAKZdA1duTeehOuTbbiZUk5OjqehOuTb5y+yT+:8xvcTTfTbxWOvTb5y7T
MD5:	2A3535CAB696FF8BF785F51DF7628668
SHA1:	D90FB814FBE3836C95F805C9726774B5F9E2576C
SHA-256:	9789281C34AAF1E37432C7EDFF09CD7449140A1371E7B24AA79DD4C8B40A82F9
SHA-512:	E5B070ED4DAD9885463D6B999A915282A1CF2770464D29ABF57C1D33CC9FF39F791664EBA2D027BBB4D173B0CD5EC758AB0B447950E019AB392EDB9CD221BBD9
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....'..\2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.W.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[_.b.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\caffeine-1.5-installer.exe

Process:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (34566)
Category:	dropped
Size (bytes):	322825
Entropy (8bit):	5.424274182819117
Encrypted:	false
SSDEEP:	1536:UQgpC3aS2jCd4RpuF6afWkhbDwh2+PvYtnWVeBK9ats+CWy2DQzgxXJQsvdHkKzQ:UQgmWk2rPDc6jWCgx4ySKVDc
MD5:	F8F266B8B8DF5F945D388E56D6C957EF
SHA1:	DF310A62F4E58393504604896D7302C121AAE692
SHA-256:	E50D9A38AD582FB3D1DEBCC2B0F6DBDBE3E570C0E1EB361B7B13D69069A6CCD5
SHA-512:	18CE0A68C96EBB5CC32848A1FF2CF2173BD774ACC7188D5B3324357F9BBCAF465C74A8FA241D332AA258159DD40B1E915463156FA23F7A26429BA9972271D0BF
Malicious:	false
Preview:	<!DOCTYPE html><html lang="pt-BR"><head><meta charset="utf-8"><meta http-equiv="x-ua-compatible" content="ie=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Caffeine - Download</title><link rel="preconnect" href="https://sc.sftcdn.net"><link rel="preconnect" href="https://images.sftcdn.net"><link rel="preconnect" href="//sdk.privacy-center.org"><link rel="preconnect" href="//securepubads.g.doubleclick.net"><link rel="preconnect" href="//www.googletagmanager.com"><link rel="preconnect" href="//c.amazon-adsystem.com"><meta name="description" content="Caffeine, download gr.tis. Caffeine 1.5: Dose certa de cafe.na para o computador n.o dormir. "><meta name="robots" content="all"><link rel="canonical" href="https://caffeine.softonic.com.br"><link rel="alternate" hreflang="es" href="https://caffeine.softonic.com"><link rel="alternate" hreflang="nl" href="https://caffeine.softonic.nl"><link rel="alternate" hreflang="pt" href="https://caffeine.softonic.com.b

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\avg-av\config.def.edat

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	ASCII text, with very long lines (2194), with CRLF line terminators
Category:	dropped
Size (bytes):	18360
Entropy (8bit):	5.6485532995763315
Encrypted:	false
SSDEEP:	384:Dw9+iXHcV2giJi0YkdTJ3p+qOBG1srr7dl9D3ebA5obqAeS:O+ihJiaJFOBWw/D3eM5oGAr
MD5:	389208736E18C263FD3AD72311DEBF18
SHA1:	AC8AD8CAF403C81CEC0B6C891F458588F6066DCC
SHA-256:	BDBCC9120388FCE0A244AB58EAB7B04A127C45D973CC63C556621A882FD189D4
SHA-512:	56FBB984AF31029C924E97C582489140B79A75AD984E93478925E12A23469D3989C13EDF569C91D50A83FEEAFC51CD43340DCF42FFA831BBE2AE216425315583
Malicious:	false
Preview:	[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[Settings.UserInterface]..ShellExtensionFileName=0..[WebmailSignature]..GmailEnabled=0..MaxRequestSize=16384..OutlookEnabled=0..YahooEnabled=0..[WebShield.NXRedirect]..Redirect=0..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=2..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=1..[Settings.{D93EF81A-B92F-27FE-AF54-9278EA8BF910}.const]..ScanAreas=*RTK-SUPERQUICK;QuickStartup;QuickMemory..[AntiTrack]..Enabled=0..[FileSystemShield.FileSystem]..EngineLdrModuleFlags=0..[Fmwlite]..License_check_interval=16..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_fw=2..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicensed_period=3600..LicensedClean=1..UseGF1License=1..[StreamFilter.HttpPlugin]..ATisON=0..DohMode=3..Pinning=0..[OPM]..def_base=e

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\avg-av\edition.edat

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Jn:J
MD5:	9BF31C7FF062936A96D3C8BD1F8F2FF3
SHA1:	F1ABD670358E036C31296E66B3B66C382AC00812
SHA-256:	E629FA6598D732768F7C726B4B621285F9C3B85303900AA912017DB7617D8BDB
SHA-512:	9A6398CFFC55ADE35B39F1E41CF46C7C491744961853FF9571D09ABB55A78976F72C34CD7A8787674EFA1C226EAA2494DBD0A133169C9E4E2369A7D2D02DE31A
Malicious:	false
Preview:	15

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\0c56e8d7-dc1b-46d4-b559-9248e0d8483e

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 15296
Category:	dropped
Size (bytes):	9552
Entropy (8bit):	7.98045251015447
Encrypted:	false
SSDEEP:	192:FXoRJjbWx/Oyzmp4vHp108nVRWc7lzbg3i5PxNQ7lyMc2oShP:FXoC/OyUaJ15n2c7t8k/Q7lyjlY
MD5:	5751F90923D39573F3847A28A6EE4EEE
SHA1:	130EF41B16B7735C1F45EFA81331EA8E81B9A18E
SHA-256:	67C3B970F86558F3C769BCB301A89102616E19549DAFDA74E0EF201F023792BF
SHA-512:	231E356693A1A3C4C2A8F67B7580015387575A83F72E7A180E414C17887DA97537120A63CE81903D8F00287A8D0E737C7D196F788006DD91AB82658E7CE011F2
Malicious:	false
Preview:	]..@..;.......&..p.........../D.\|........{...cl..KN......TS;...p....."...gW.....~...~....oF~;...l..f.MP.%.B.d...w%.6g.T./........9....8../..}.??.j.O.<U\|.;.=wm.uz(._`h.f...];..N..k.{...PE.@'.u...h..d^2.l._..Ni=...cU...].m...q5.........n.......#.(l....s.,W....k.g .=;.v.W5.."Q.I$>.)..}..."7.}...$.........\.HW....RN=....\|_P.c.".x...5.z....p.j.`.$0.q...F...}..#Y....W..8....?"-Wc^R...F.5.-.a.7.`...2...V.!..>.a.rr.)5kq..U..e".Ji.Yk.T"..%...7.....;A+..7U.U/..>..$'..`.v......+....8:7...Y......W..#..K<....\|$....V?8..b.Z`..~..J.f.m^8T;...E.....lw;..c.H... .3R..j[..0{..EA..Z...J...7.t/Zmd%.P2./c......-w=...c...1N....JR....i.E....l.#.y.b...........{[..v..!..,...w.`.0Cm.......W....<.....%.:.... ..."....y...~....}!.D..I...b...."Q=?..xq..<..C(..I%.............{^$.]..\R.w`.S...C...2.d..=e_..<>n...lnKj.d....2.u..f0.....@..o..Q..a....R5.....GR.UN2.j.I..?.zzdvh0..N/.;z..2]MSZ,....1l.{7.ksz..Sz.\|D..]=.'.A..O...;...m.,..//......}R..gF...(]S.....y.h$@[.....

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\55206dd7-3cb9-4b20-97c6-b1b67812e477

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 1282565
Category:	dropped
Size (bytes):	139353
Entropy (8bit):	7.998562252502023
Encrypted:	true
SSDEEP:	3072:NanIOOg2YhbV17b48ctYY62tDk4pTcY6Dg9Qi:oZ/hb37U8cRj6vi
MD5:	4873B4A1C60C5210BF0EDEC1D2026E03
SHA1:	6CD4535389A78ED4D7E35DBFB4222C0722905041
SHA-256:	0FC29E8B24E13179EDD2268052933B4F0DB19AF8C589F86A14EC642CE8279C5E
SHA-512:	BD5E7D0362AB6E273BE37E4FC2F43FB1865EB8363327302A4839119DF95996C6B83CF104A7B7F2A72F0D1D36BC7EE5BD12441A143B271711365BBC0BA732ED13
Malicious:	true
Preview:	]..@................f......{3....&.7d..>$....`K...H.......4...^.a.)....0C:.6..n.f.c...j...$Px...........X.PMf$5.B....O..DN....[.d..s..s..M..:B..(.N..L.?7=~Rg.[...N!."..8......1uW.#....;u<Q..MC..Kl.#.9!U.3N..N...^....Gp..a.@....-.m..Q...c.6.....]..vK..I..(.<..s.1h.r..)y.]!J9%.../.(]X...%."....Y.,.J.......Z..T,....u1.&......n..&.!E$Dn<..;."....@..90H$Jk4..{i%.@^...q;.%.t!......Md..fJp) m.0..>3......hs...Y.4..<...Q8.$.@.n...u..N..X..ia.f..o.."....b<...^X...z.U;..[..[....A.`.W.0.X..l...v.GfM.9..y..q... $.....4E..Xd..[l.>..R...z../KjCd..9J...!.O..U.^.l..].S).zLS.[90....O."0...kX[$V!...b{...1&.@a{....\|.Bg.....d0K.KGS.....r.h.]m.9..}.>Y.Ha..Sh.\.UgmX.......Hm.!8.?..k..r)..z.M........bc0:...N9?Qf.w78.....j.C y...;...V8.8..'....HE.Ur..A.,.4.....k.:'Vm.M.J.`..V.....`.U#...\.8.T....C.K.H..#UD.?..#..;..#......P.!...(.QS..v*...>..T.....T...65.vX{l..8.G..E......A.....+.Q...G.<..!k.....f."._...&.t...Dm....wZ.-..W..uX.zb.....Ru..h.-.OV..c.^.l..`..

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\79420c8d-5996-46c1-a3fb-2956faafe53d

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 4883384
Category:	dropped
Size (bytes):	1425824
Entropy (8bit):	7.999861038873463
Encrypted:	true
SSDEEP:	24576:ezdQCcSGQSa/yndkS0Zm0VOfA/Jgc7aUFgsuPffupeOxAqzD4RyppH6wP0DmgOS:ezdjhGQnfgfA/JgwaNNP3upeOxAnAHbG
MD5:	3BC7FFD88AC7AF9413B613E0296AF775
SHA1:	4375F225A5CA303E2BDCBC6D8FC241D42295D015
SHA-256:	C32A7FD20A2A0FA4287AFF42C10FEFB2E43F9E8AC0F211695871B542083D78F0
SHA-512:	6A2285227650FCF3F52178A036E1958E82A12CC9F7058491A7B206C6F3E940BE791B28982082D4D196D81D5C2D1D11BC6FFAF5E5B5BDC7B2A4D1970D44E2F64C
Malicious:	true
Preview:	]..@...J......&..p.........../D.\|..y..:.}.._..G...5mA..aQ..c5t ..+........w.uRl.,E.u9....r....dV.....B.2.M...T0..C...SG.(....c...3..ln...O..5Z..F.....&cZ..z.H....H..M...+m.L.k..r..b1.!.I.W..F...P\......1..}.T.F.........9,1]P^.....p.U......0...P.t....gp..........[b.a...N....;...._.D...$...i..uu..[@..o.gWcL.U.....u....\..`^.....19.m5s..[...Y..Z.6z.'......(..<..R..`U..q..\|..<D...l:..e.(v..`0wx.j#.3.%...0p"c."5...j.n.8....&.4.C..v.....A>.wV.\|.0S-.)3.f.Nc.mx..d..D.V..)...YP..rLe.3.J.A...Y..$.../..f.%.h.4.K{f,sW.....j.....B'...`.9.~..0.....i..P"...h2T.k............!...5.t.....yp.....nQ.JA&.B.d6..S.J}..P$.i...A?...qvg.<..T.E....0..j74.......+e%..N..4vg.......Hs...`>K-.C.)....X....6..m..lR......8...5.U...3.oo.2....].d...8W.9..[...z..Ha .tQ\...x.J..rk.....PXU..9h.....}Z......._/m&.....oe.).<..s.......G...?.u......V.5....=n./.w.m.XO.+.H,..`....FF. b.^K?.N.H,WJ..o........9.,..N..v......?&g....P.x.\|i..(.A.M.v..n>.(..se.....)...[..1.A...SV;...K...

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\888a9693-2ee9-4e0f-aaf8-a5d42630bd8d

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 11635640
Category:	dropped
Size (bytes):	3770192
Entropy (8bit):	7.999948420411957
Encrypted:	true
SSDEEP:	49152:scNHjXM6E1fBYBuJ+s+NZknq/asMznpywRfX0I+K8FlBdAHdRyC3CbLxB/oWCDZF:fNHjXb+6Pp+ncwRr6PI8dZCDFwbTalV
MD5:	365FDBA69862880DCB1677A01C632E80
SHA1:	96CA44968BE75B563B12D41335CE973039E7B479
SHA-256:	6B4BE06AE95842FE7F25EE3F82A777466597476BA16C6B4218D1B609A27133CE
SHA-512:	BCF6838F0FEA102FD4D3BC20157E902F178FBD9C71A0085517D55DF59B0C3DE138994DA7C076E03C7B7F6D0E3B0188C9C0056A71A36819CE2A754C09FA534437
Malicious:	true
Preview:	].............&..p.........../D.\|....o.e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg..S...$R..O.^...@...2a......l........@.xqk..\.H..3......<A.6.....l...G.....BN...>..=..P..j[..........h..~soT..r...A..WG.Hs.........,.[..E.k..<K.....d.q.LCis.xs.z&.{......F...whNtn.1.o.u.E.N...T.h..E...."q.._..e...3k(.................w..>/.."..3!.n1H..,0"............B.YY.8q.t...Md0.........J.N....N.)...FuN.P.].....6[.4'b..Y..k-.16.~...U.g.+.Q..m.v..s.q"uH...xi\|.......V....m..b.W0b.....l...x.A.u..1#=.s.A..5.....p>,.IR.c.......q.{.6q..-F./...m....9Z\.N..&B.......N...K..+a.g..z...+.....#.j7...s.$l .5C..\...,...$-.e....W;......b.zC.."..7....hl3..os4.....)f..}...U..P\..M.6....5.>......P...YEn...........jT.y.5Uo.....XO..~@.+Z..:n..... `.. .S...,Q.4..wv.\|..<.J.k..4E..t.U.._h.f.......@..B.)pd..d]9...v.;n....Mp.E..&A...,.=..QS.m..:^!..`.*.#Z.[.HqE.@'U@.J5Y.E..?W.._=/...8.~.....r...52.ef.b:...`.#.e...p70h]1...X...?..q...]`_.K .?.?.........{.1.6

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\8939a096-e324-4ce6-8c6c-e43d344af8a5

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 337132
Category:	modified
Size (bytes):	341899
Entropy (8bit):	7.99938086548515
Encrypted:	true
SSDEEP:	6144:dXlWdkdyDt+De/kUagtUsALNmkRDXsopn0nsKfJdnsotq/y14t48ZZ:Cy8t+zUagLAZQE0sxoL44mZ
MD5:	E596094168938D6242C8C2266B47CB4E
SHA1:	8C864CFDA9FF4F2AF88D19CAF43ABDC7AF674F4E
SHA-256:	CAA65B7CE6C9728A01140C07027698B8C84FDED1108E095D9B90AC1D4E16BEA3
SHA-512:	77094540562C6313EEBDF274D2B9911464B3EF526453EABCC92703B97213F3DD1F4A79AA028DAD825E1446FE2C62553A8E75DA14CE1A458C867345049A62B3E0
Malicious:	true
Preview:	]..@..$.......~..E..8... .rZ.~0..9.I...JU...m.......u;bR.#.)w.`.d.........f....&.I.............I....mV...E_s......./.h3D`(.=....]q..\|......`\|H....4....V;Bf0..W@..(.)mcPe.=..]..D....$.H`.s....N...(.........Ax...N..cHU..3i..V...wt0O&.....m.{._.gR..Ie.5......<..3...LcG.._...c..~....5,....J..T....\|L...y.../.!....^J...g.c............%RP.n.A.......T.?.D..\.g..]..I...U....o....x.4B...<........D...s.$d...F.P.t~..^.....=.g@......B\...1d2.X...g..S....o...-...w\|.ub.U..x.}&...h,.v..i;5.q...G.j'...I.....>8.rj..9BD.,'-...9^f.....XV.....x.v.6!...>.n.a....9.C...~..;....Qx..p......T...C..._....4.Y.k...m....Tx..d....N,N.i.".4..H.'.8..LoP.C.a.G..I.....]/.!?;A.a&.q..B3$9.i.....!r..(Y#....a1...N.....(.'F.P?R.^.]A1K.O.%WRM.(@.x..~.`...t0.i....uwx..F(..6.....]Q..M..."o.#.... $...r.@.^......Q.X...l...ea.7\ne..z..s....L...w...]...6og4.<L.....D..&.\ru.R;.\|......]..- .5...vV.t.`........[.T...)..J.' ..>.`v.....\.%..@.v....=z....+.......y..cDq.&SS.....f...

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\bug_report.exe

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4883384
Entropy (8bit):	6.514490815961128
Encrypted:	false
SSDEEP:	49152:XMLnHnldNaUEQ2GRHk4FhlikpbQXKEx5qgWGgaFWU8fsMin0OpisWL6QZJJg7bGq:+yQ2S1ikQKcwF2WjhH6EH2z6
MD5:	F0AD6609B15FBA048671A46959B34D12
SHA1:	02EA65D9FB66AB8684215C388C04F496E570FFE3
SHA-256:	9522B2B05DC88174518CC635909BD39EA1AD017B972FC0B84C0B2C66FE20C7FA
SHA-512:	A86634798C703685F66E562E79BADD768BC168A6182CBDA4DF9A740177B3ACAB8BD5A33B31DE3FD77501ADFBB81FAB71796F76B678CC455B3D3061FD1E1CA4AE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......x.\.<.2.<.2.<.2..7...2.)...0.2.).6./.2..7.5.2.).7.K.2.).1.6.2..1.,.2.5...>.2..6.:.2.j.6..2.<.2.0.2.j.7...2...6.=.2..6...2..3...2.<.3.h.2..e;.d.2..e2.=.2..e..=.2.<..>.2..e0.=.2.Rich<.2.........PE..d...Q.Ie.........."....%..1..>.................@.............................PK.......J...`.........................................P~@.....8.@.,.....J.P....pH..L..HZJ.p)....J..g..P.9.......................9.(.....9.@.............1.h............................text...J.1.......1................. ..`.rdata..p.....1.......1.............@..@.data...@.....@.......@.............@....pdata...L...pH..N....G.............@..@_RDATA..\.....J.......I.............@..@.rsrc...P.....J.......I.............@..@.reloc...g....J..h....I.............@..B................................................................................................................................

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\d6a31c34-86f1-4249-93ce-0d01e616dee5

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 15296
Category:	dropped
Size (bytes):	9552
Entropy (8bit):	7.98045251015447
Encrypted:	false
SSDEEP:	192:FXoRJjbWx/Oyzmp4vHp108nVRWc7lzbg3i5PxNQ7lyMc2oShP:FXoC/OyUaJ15n2c7t8k/Q7lyjlY
MD5:	5751F90923D39573F3847A28A6EE4EEE
SHA1:	130EF41B16B7735C1F45EFA81331EA8E81B9A18E
SHA-256:	67C3B970F86558F3C769BCB301A89102616E19549DAFDA74E0EF201F023792BF
SHA-512:	231E356693A1A3C4C2A8F67B7580015387575A83F72E7A180E414C17887DA97537120A63CE81903D8F00287A8D0E737C7D196F788006DD91AB82658E7CE011F2
Malicious:	false
Preview:	]..@..;.......&..p.........../D.\|........{...cl..KN......TS;...p....."...gW.....~...~....oF~;...l..f.MP.%.B.d...w%.6g.T./........9....8../..}.??.j.O.<U\|.;.=wm.uz(._`h.f...];..N..k.{...PE.@'.u...h..d^2.l._..Ni=...cU...].m...q5.........n.......#.(l....s.,W....k.g .=;.v.W5.."Q.I$>.)..}..."7.}...$.........\.HW....RN=....\|_P.c.".x...5.z....p.j.`.$0.q...F...}..#Y....W..8....?"-Wc^R...F.5.-.a.7.`...2...V.!..>.a.rr.)5kq..U..e".Ji.Yk.T"..%...7.....;A+..7U.U/..>..$'..`.v......+....8:7...Y......W..#..K<....\|$....V?8..b.Z`..~..J.f.m^8T;...E.....lw;..c.H... .3R..j[..0{..EA..Z...J...7.t/Zmd%.P2./c......-w=...c...1N....JR....i.E....l.#.y.b...........{[..v..!..,...w.`.0Cm.......W....<.....%.:.... ..."....y...~....}!.D..I...b...."Q=?..xq..<..C(..I%.............{^$.]..\R.w`.S...C...2.d..=e_..<>n...lnKj.d....2.u..f0.....@..o..Q..a....R5.....GR.UN2.j.I..?.zzdvh0..N/.;z..2]MSZ,....1l.{7.ksz..Sz.\|D..]=.'.A..O...;...m.,..//......}R..gF...(]S.....y.h$@[.....

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\dump_process.exe

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1214392
Entropy (8bit):	6.594069750858168
Encrypted:	false
SSDEEP:	24576:8qvBHX/xSyN63t4d3fceY3IGpa4nPaFQNjDZYh0lhSMXl+XnOJkdV4Kz:9vxSkYt4dvcyGpa9Fmvf4OJIV4
MD5:	753B023DC1463ECD7B3F8807D2C5EFC9
SHA1:	EC45BED427E799844154D008BEE2AA9D7B07715B
SHA-256:	C2295B9476901AE35FDC80DFD888AA056D15D1EF8DE6DE4A3E85F583AD65A5E0
SHA-512:	59BDA01E96C0E3EFDA02DFB9ACE0EA5E962BB117BCA83F0AF0A02DF04A609BD755FD538BC1B960E154CCD23D596AFA6A46088E274CD96ECF239900505A0B9DB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......6.9.r.W.r.W.r.W..T.u.W..R..W..S.c.W.g..p.W.g.S.`.W.g.T.x.W..R.{.W.g.R...W.{...p.W.r.W.q.W..V.}.W.r.V...W.K.^./.W.K.W.s.W.K...s.W.r...p.W.K.U.s.W.Richr.W.........................PE..d...0.Ie.........."....%............P..........@..........................................`..........................................................p..`Y......$...H^..p)..........$...........................(...P;..@............ ......<...@....................text...l........................... ..`.rdata....... ......................@..@.data........ ...^..................@....pdata..$............b..............@..@.didat..P....P......................@..._RDATA..\....`......................@..@.rsrc...`Y...p...Z..................@..@.reloc...............H..............@..B........................................................................................................

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\ede4f3f7-3843-47ef-852c-3aec53ec39be

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 7523256
Category:	dropped
Size (bytes):	2257817
Entropy (8bit):	7.999930357134181
Encrypted:	true
SSDEEP:	49152:sE7HjF5mmoN004DBECLDjdETZj2VeGXU69eAe03JF+q1:s8DFMmoO01CrdENj2gGX19eAeeJFD1
MD5:	643453FAB6F5EE70CF09B21E872D552C
SHA1:	382162FED581CEF0B8BFDC832BE244C50EFDCA8F
SHA-256:	6F1F8669BE6B32D4935B5100698DF587E28D4631F3C7CD8378A8A6E0DFBB23A9
SHA-512:	3027FE46466F7FD39C2A251ADC9BBAB13D18F09A96A3F25F1C83795EEA46A0839FCACF4A9AB1B8401F3B9E9A418239EBB75C7E1DCA7C01D735F2EE3790027451
Malicious:	true
Preview:	]..@...r......&..p.........../D.\|......e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg.:.;..@.U.-s.T-..~hH.....6..+C.;..y._.E..0xq_....H2..... .vx....[Nvg..}j.<p.jR\|.....N..k.J.^7...{x..B.jb...~..f.3.........;..FX..B.... ..f..)....{2.....q..m.........6.f..o..}...\.H....\l..yS...W..S.....X...._Ns..+..'..J....`..{r.b..%\.j....k+.,...}.....5.>..).y$....v..X..C.{9/CT..I....W}+^........rn....0..86._........?.E...~ng.C7.....)+..,d.(....3.J...%.f..W{...b1.........{.........H.....Kz..?7.#.c.{......E...g.(....E......3@d.{.X.7.;~..?...O../N..,3...=[Q.............M.asw...'-.YP... ..2..T,Qcct...1./....[-=.X...B`..w.3...M8.fTb.$..z+.......)....D..+..#..7!@.:.-..3..nw4....?\...[.."..U.'..........-.....x8o}.].T....I.c0.$.j..Mt2......$...l.>......9.w....X...]..P..b#..X...H~...m{.C.T.....%..?..(1c..F.Q..W....f.w0...?d.[..6ga.:J.!........eb.....L..Ygy....ck.D...#...........Xp....HvF)O......Fne6i.jhx.d.G...w.h\....`..L>r....b...R.+..%I.

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\f1b663c5-9d18-4749-98f0-69e4d5030e6a

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 1214392
Category:	dropped
Size (bytes):	467612
Entropy (8bit):	7.999636345062246
Encrypted:	true
SSDEEP:	12288:dcg6aUZan52hK5wSdhcPtHw3PYdQ8dxo3JufpdQ:dKaUZo528mHw/Yu8hXQ
MD5:	BB8A675566D317C0724C47DCE085DD81
SHA1:	F4AF3F6C85C2E149597CF4D898740946A961361B
SHA-256:	083C39A778DA81D23317EBD195BA281A7322B9A7E1C7F6F6908F08F40A63BDFA
SHA-512:	6BE5F4C8B11980D69E6B4B812FEE8F3CEAFCBD6E1EC8FA2D50D24AF8A3C1C546CA56CDBE7E77B2DB6571747C5F94C56A30DE4EF6E9F2476E5C86C6EEBB328140
Malicious:	true
Preview:	]..@..........&..p.........../D.\|..N...mx...6.`....U....U6.2..}.a.Ys..NY..T..:D.0Ww..N...X...ara.I........[Hq......5C.{....rMl;.$...1.......M..)[.1..=....G.....,..2. ..Z.<......... ,`;...E.?.z...X.l.=...8p9z>..."7.3..l~-.''..J.=....q.".C.wfG......J0s/.,.&J..-.%...7.T.aT.@..f.I.O..mV..1S......./.}.y..'&....(..5.FL?h.K.7...\|/........+.GF....d....w+!R..an....9.j.....`R .q.`....F.3.U{."I....7.Y........A..!.K. .?.7.g})...Z.SS.L...L.s..........d.<.l.\.Z.......j.Dr>.A..>.4.k.._X.x..'y..QA=.9...y......N.n^..\|[0.....$,...q.4-....U......(cX].}.........Q......Z ..a.x.G..A'r^..>m.....{$L....m.....O..u......"p#hg.O......%..\|..../{...K...mY`\|.S.[R...f..qj...e..V.%..[w...a.C.}.`w83.dt5...O.....'z"........9..j.........E..h.g(8.>u...Y.1.j...p.d[..`k..U...C.O@.~ed....u..\|.... ......t...T.h..pW)...L..k......%..t#...Gu...e..Iny.....R..r.n).O`......`..t. "..9.%.l+>...q.........m.....K..RA..g8.......Q2U5...Yb..U.b)..l.}.z..f.Bq.h.EQ..R........#n.x.....7.

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus.exe

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7523256
Entropy (8bit):	6.460723535404394
Encrypted:	false
SSDEEP:	49152:SMLKH6ld1qO0X2eW0x84K+U/pTliYLrT5WVIyFMTnOy4Fh/dzsLxqtbwbmVXQwx4:3U78L/IVItOy8HtcyZ0lMf+Om4eO/l
MD5:	00F3158AA3CAC845A8DDBCE86CF20560
SHA1:	8A4F81C33DE9DF0B93408035E7F3B01549775299
SHA-256:	9AACB21993E4E40A503C34FB2FA0E5FC315902B76EBB902C2EEA340D84D17B33
SHA-512:	F3BF4729DDE81FB99A501725376FBDD57EB05F3290D314A5F9742C4DA7E794D3EA85B6BAD6C07F1103707261EF78B38D0A9AFD2FB75FC62ABFC27A59FF533A6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........Q.[.0...0...0..rB..w0...OL..0...O...0...O...0...O...0..rB...0..rB...0..;^...0..;^...0...H"..0...E...0...0...0...E...0..rB...0..cE...0..rB...0...0...2......M1.......0....N..0...0&..0.......0..Rich.0..........PE..d.....Ie.........."....%..N...$.......+........@..............................s.....2Qs...`...........................................d.....d.d.\|.....r.......n.\| ..H.r.p)... s.......[.......................[.(.....R.@.............O.......d......................text.....N.......N................. ..`.rdata...7....O..8....N.............@..@.data...`\|...@e......,e.............@....pdata..\| ....n.."....m.............@..@.didat..p.....q.......q.............@..._RDATA..\.....r.......q.............@..@.rsrc.........r.......q.............@..@.reloc....... s.......r.............@..B................................................................................

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus_mod.dll

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15296
Entropy (8bit):	6.94739231872254
Encrypted:	false
SSDEEP:	384:BgBkpyIYiif4GbFvAM+o/8E9VF0Nyb/vk:BPfYiilJvAMxkEpk
MD5:	D82C7E7541B0FB4BCC07230A464110F3
SHA1:	0A87229BCE0C54F6397CC27F77AF0CCC5455687D
SHA-256:	787F09B46F996C1835532A9A0BD03D3D02BA200655F59D09067AEA164E581FF7
SHA-512:	862FD12C2D73C5BA9795B4EA8017F32AB920DBC37A3993C9F8245168765856C2D868184915013D6A26BF6E40CF408EADB94B1F128AE4DEC3FD7F28C7E76C55E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I..I..I.....L..I..O..p..H..p..H..p.*.H..p..H..RichI..........PE..L.....Ie...........!...%..................... ...............................P............@E........................ !..\....#..<....0..............H...x)...@..(.... ............................................... .. ............................text...U........................... ..`.rdata....... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\icarus_ui.exe

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11635640
Entropy (8bit):	6.579272954760448
Encrypted:	false
SSDEEP:	196608:Sp+JtgBVfbVRzdjdx58M2p1feZsprqNobOzzh:q+JtibVRzxf58MIWZsprqNHzzh
MD5:	9E6DA0FFEC832DCB2BB0626E2FAB333D
SHA1:	A89F931B7C7FDC69D6255C4D7291EA3506A1B93E
SHA-256:	3746C214ADCC94110A99A9839C57CB1CB4B2CFD0F461909252BFE3AD2A0AD7D6
SHA-512:	B6553729876D1B80416470AC409EA72D6EB35EED6D858A9485ADE0DBB2A35A228DFF5A1046CFBD31D99BA3F5A49284B23DB102292728A9D2F90B10A50821A680
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......{^tO??..??..??...M...?..@..6?..@..+?..@..N?..@..3?...M.. ?...M..p?...C...?...C...?..6G..=?..??..9?..iJ..<?...J..>?...Q..=?...Q../?...M...?..??...<.......?......>?......>?..??..=?......>?..Rich??..................PE..d...z.Ie.........."....%..}...]..... ..........@.....................................G....`..........................................0.......0.......`.......p......Hb..p)...p..T....V.......................W..(....U..@.............}.x............................text....}.......}................. ..`.rdata...."...}..."...}.............@..@.data.....3......p...n..............@....pdata.......p.....................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc..T....p.....................@..B................................................................................................................

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\product-def.xml

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1282565
Entropy (8bit):	5.395525801611524
Encrypted:	false
SSDEEP:	6144:gpB2zS8iEkoRJAH4zs2IkXok6+x0hYB9EC5yTJ8C92JCxT+O:gpB2zSMkokH4Q2Rok6+x0aB9gNn2eT+O
MD5:	97F832193B02584FCD6F3AF773D68E78
SHA1:	5782B61E2DCEF7CAC0D27F0A3C5931664210FDD3
SHA-256:	1079579B769F00D14A28F4FA74377E79FB97A8EE3E9078531DB4E153DCE5573D
SHA-512:	181DF3F237F67811FFC3855F51A2DA57FBBF4DA921A66A5D18B9D9B912EBDC06D9893BACD387187162AD5E8378109A751314015159F445FEE8C1A9AE47F6E0EC
Malicious:	false
Preview:	<?xml version="1.0" ?>.<product name="avg-av">..<product-defs>...<config>....<install-folder name="Antivirus"/>....<program-data-folder name="Antivirus"/>....<registry-key name="Antivirus"/>....<full-name name="AVG Antivirus"/>....<languages>.....<lang>en-us</lang>.....<lang>cs-cz</lang>.....<lang>da-dk</lang>.....<lang>de-de</lang>.....<lang>es-es</lang>.....<lang>fi-fi</lang>.....<lang>fr-fr</lang>.....<lang>hu-hu</lang>.....<lang>id-id</lang>.....<lang>it-it</lang>.....<lang>ja-jp</lang>.....<lang>ko-kr</lang>.....<lang>ms-my</lang>.....<lang>nb-no</lang>.....<lang>nl-nl</lang>.....<lang>pl-pl</lang>.....<lang>pt-br</lang>.....<lang>pt-pt</lang>.....<lang>ru-ru</lang>.....<lang>sk-sk</lang>.....<lang>sr-sp</lang>.....<lang>sv-se</lang>.....<lang>tr-tr</lang>.....<lang>zh-cn</lang>.....<lang>zh-tw</lang>....</languages>...</config>...<vars>....<var name="%V_PRODUCT_PREFIX%">.....<desc lang="en-us">avg</desc>....</var>....<var name="%V_AV_SVC_MODULE%">.....<desc lang="en-us">AVGSvc.ex

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\product-info.xml

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	9649
Entropy (8bit):	5.275488374026463
Encrypted:	false
SSDEEP:	192:7jvIULVa+qmNrOt2XNzb9Uc9uQWASHFiqGVveIzwc2RM+Rz+CW3s+sZSP:7jwNZmNiMzueRewwcep3WnFP
MD5:	65778E16CBB222FB0400EEA279677D6F
SHA1:	23C740FD48A84B70C233BB281BD904D96E535BC6
SHA-256:	BC682E7D273A49660BCCF8612807135D7AAD1E6B0682089E792287BB1795F273
SHA-512:	888A89A75C0058FE5C6D739F0AEF81DE2F7CF7796F8203F2A1C990436279CF8D9C30215EAE7971D102DCBABD9F5C0C06B32562CF15BFBCFE8883DF0839128028
Malicious:	false
Preview:	<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av</name>..<version>23.12.8700.1355</version>..<build-time>1701795576</build-time>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>8639967dfe4310d2c942052a45e0c47d7ab4ef6a0ec245aa67df3a01e81e07a9</sha-256>....<timestamp>1701795469</timestamp>....<size>6656440</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>9aacb21993e4e40a503c34fb2fa0e5fc315902b76ebb902c2eea340d84d17b33</sha-256>....<timestamp>1701795469</timestamp>....<size>7523256</size>...</file>...<file>....<conditions>.....<os platform="arm64"/>....</conditions>....<nam

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\common\setupui.cont

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	XZ compressed data, checksum CRC32
Category:	dropped
Size (bytes):	337132
Entropy (8bit):	7.999469820311664
Encrypted:	true
SSDEEP:	6144:uw/ooQ5X1eiA7XrU9ICQXTFjutMguoJAGjK5ivSfO5Kzh1V9ON:uw/ooQ5XEiow6FXTFjvHoKIvSfjZYN
MD5:	CAEC84795D36C4FEE0531BD5909CD57F
SHA1:	11F80D629261CFB83FC8A25692231FF372B32478
SHA-256:	20BE6A7EC202B19F740F397C6BEF348851560FB3CCD60B0B2F0DF90A8E5C192F
SHA-512:	FEBD68EBACAD81A512798ECA24458CA56969A979110DC8251C5A6D495868F9081E410923C13C724B6E6A20491AD85BA1729E4F12122199FBBB833A2B650B58D6
Malicious:	true
Preview:	.7zXZ...i".6..!.....#..,.8..].0...?..Lm.K%. .6.X.....L.@#.....n......0.iz..,.z...s...$..fI.>.i......h...#..gL.t.\|z..(b.\|.l..J%..n0..~..-.:.+..".+^>Wt...Kb..#=.3#..q...........Fo.ed.....#.3..A%..}L.A.Bk-.]...S.>.AP..rz....8V..........?.v(..B...i....\.>...&..S..........wS...8...e.D.~._..#o.P6....e<Xs.1..vP..{.>.v..%.r2p..I..q..d..3}&.%+..p.;....7.>...qj.Y....#.y.A.~.......m.N.H!..q.Lxp&\i.F..o..}.l.!1..9.9p<.....9\|..J.n.T..R...8(.B.6..4.SM.)..P%c=^..6...Q7.....JBoo.[..h..A0....4_a...D......,!._[5(./....{..n8E....u...\..^.eZ.E.@...#k..6.A=.[.h}R.........Y..&.........8......[.5h..c^/..3..+..a.V=F.j.G.`e.>m...J.a.4..bQ...5/Ox..\..].....;.H.U.1....XD....5...G..'.1.k.4..r...7..4..v..u.;jJ..T.e.~x.%V.W..=.ul...42e.rxN.c.a...sT\...9M.A..0.8`.\|.G..hS.4...)...b..m.5%..%2.w......5~jP.g.$.GT...w/Pb;H..\_....4'v......I.a...W....c.B...'F.u.....D.m....,..'K..tQ2.eI.&..7......v....A.....>.D.y*`.".R......xaFx....3....F6.N.i{.3.j.{.;...z..q.}..\|..N..i..4.d%.&..f.......R

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\ecoo.edat

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.422577995321604
Encrypted:	false
SSDEEP:	3:1HRcMK:5RU
MD5:	3F44A3C655AC2A5C3AB32849ECB95672
SHA1:	93211445DCF90BB3200ABE3902C2A10FE2BAA8E4
SHA-256:	51516A61A1E25124173DEF4EF68A6B8BABEDC28CA143F9EEE3E729EBDC1EF31F
SHA-512:	D3F95262CF3E910DD707DFEEF8D2E9DB44DB76B2A13092D238D0145C822D87A529CA58CCBB24995DFCF6DAD1FFC8CED6D50948BB550760CD03049598C6943BC0
Malicious:	false
Preview:	mmm_irs_ppi_902_451_o

C:\Windows\Temp\asw-c277aecd-c2bc-4144-a431-0a0767dcef3a\icarus-info.xml

Process:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	5.38788224493304
Encrypted:	false
SSDEEP:	48:cEqpzf4TWhfPBpUc8Dq+F7B6yqSX10xVRRp2lEk8oM:upw8BWc8jFlqSXyxVt2FHM
MD5:	A5F2A0A887D897A1E73BEF1B6A06B5F0
SHA1:	816D3172C58C5261F713C318B73BB50FE1C1443E
SHA-256:	CD34404FDD28A771E08511922CEEF87D557F4F327BF6EE54010DF98E3A5C0B22
SHA-512:	F667551162F54BC612BD98F298AEB5300E5B12E1450926952EF20F87E0FF1F3419367BCD98D671F31C36B4E89A3BAE6865F9585C2A84A7D73ED0659D1DD1FE06
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<icarus-info xmlns:xs="http://www.w3.org/2001/XMLSchema-instance">..<file-list>...<file>....<alias>sfx-info.xml</alias>....<sha-256>63a4bb504f570077b8ee51bc1851b31a62886ce6e5dd8325250866400d5a756e</sha-256>....<offset>1446982</offset>....<size>719</size>....<timestamp>1702373978</timestamp>....<flags>0</flags>...</file>...<file>....<alias>avg-av\edition.edat</alias>....<sha-256>e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb</sha-256>....<offset>1447778</offset>....<size>2</size>....<timestamp>1702373978</timestamp>....<flags>0</flags>...</file>...<file>....<alias>avg-av\config.def.edat</alias>....<sha-256>bdbcc9120388fce0a244ab58eab7b04a127c45d973cc63c556621a882fd189d4</sha-256>....<offset>1447860</offset>....<size>7202</size>....<timestamp>1702373761</timestamp>....<flags>1</flags>...</file>..</file-list>..<file-mapping-sfx>...<handle>268</handle>...<size>1465808</size>..</file-mapping-sfx>..<sfx-cmd>/silent /ws /psh:92pTtVrMpG6

C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1465808
Entropy (8bit):	6.809986038107477
Encrypted:	false
SSDEEP:	24576:PqM0QHRzf+BooooEJ8GYgqGneBPuzBCxxAih0lhSMXlhe94e4/CkAYtpB:X0Oz2BooooEJsgmPmBCxG/k2e4rAYtb
MD5:	1ECAEBD87C30F9F50EDAC37404EAD036
SHA1:	8A7A10E3C815BC3761C5EBB55DFD2ED6002387CE
SHA-256:	739BCC9C66B95C704FA5FA6A5FBD49603069FBE7A8542E06FCC75F7B3C117FAC
SHA-512:	5B4130BDCCCC45E3A3FCA0D9CC026E9AF5AC6F9C2CA1423A26D3117E02C797A37ED63DECFFE5F5A63CDF220218FF5863EC42D01E87AFC22B21A194879FA972BE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$................?....?..R.....x.......................?......v..................?....?........^....6..z....6.....6z.........6....Rich..........................PE..L.....Ie...............%.`...j......@........p....@.......................................@..........................5.......6.......@...r..........X4..x)..................................@........v..@............p..l....3.......................text....^.......`.................. ..`.rdata..b....p.......d..............@..@.data...@....`.......F..............@....didat..T....0......................@....rsrc....r...@...t..................@..@.reloc...............X..............@..B........................................................................................................................................................................................

C:\Windows\Temp\asw.5eb092b1255993ad\ecoo.edat

Process:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.422577995321604
Encrypted:	false
SSDEEP:	3:1HRcMK:5RU
MD5:	3F44A3C655AC2A5C3AB32849ECB95672
SHA1:	93211445DCF90BB3200ABE3902C2A10FE2BAA8E4
SHA-256:	51516A61A1E25124173DEF4EF68A6B8BABEDC28CA143F9EEE3E729EBDC1EF31F
SHA-512:	D3F95262CF3E910DD707DFEEF8D2E9DB44DB76B2A13092D238D0145C822D87A529CA58CCBB24995DFCF6DAD1FFC8CED6D50948BB550760CD03049598C6943BC0
Malicious:	false
Preview:	mmm_irs_ppi_902_451_o

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.309913047042219
Encrypted:	false
SSDEEP:	6144:sSw8CE/ZeaJFSSP0Y6B0CvpuIUOa4+e9gFbJUjWKdHjj5+sJ1TREf4J59:sH8zWvp63qtdHH/eA3
MD5:	01F80BF836D461B9E25BDB442EC0586B
SHA1:	236DD17D1DFE20F6945736B700097E18D3804FA2
SHA-256:	5DBDCB072ED0FB6E5A024D23B446CC9E1DB0AA7502A453954655CFE4F076E7E9
SHA-512:	1B6C8DB546C66A41A1F02EAB8910428731778F068FEC19D65BD248AC853094CCE1C84725BBCDD5F2B8A0056EAEF4458671D780A160D2AC7735E6BB7EA9F69C16
Malicious:	false
Preview:	regfF...F....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.\|..\2..............................................................................................................................................................................................................................................................................................................................................X...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 155

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.788035787250117
Encrypted:	false
SSDEEP:	24:uYZaOrH7g1q2QAsMF6Az/0JBZrgXsEEpa9NJM9auR7:pprH01hscV/yBZMaa9v4HR7
MD5:	B72D387806EFDED87CA5235A747204AA
SHA1:	9E3520E6997E6EBF7B5EB5EF4196B002BB865CB2
SHA-256:	62B78FBEAAC879A591FB7563CE48AEF32F7E8C4C38CCE05BC8D9EEDC8BED7697
SHA-512:	B74CF0A002ABA1E70E7194A40441C9B30DA003E8FFF55A92193007D6BB47E755E21103355FB6B627D5A6BBF8C619ED3A46DFBC4C59CF58FD5BFE083B5E2CED8F
Malicious:	false
Preview:	RIFFd...WEBPVP8LX.../o......m..?......A..v..@...............,.l.....`.d..I.$..D(.h.....@VV.=...%[..n...rB._p..m..Z...p..rc.....mp.K...uV..Y.T.z.V..Q...o_...3..U...G....<K....~to..e...f.~gqI5?.d.X...\|.%W.U>uX.ik}.4.Wx..(.....Hd..u..SY,Q7..+?..JS.4..<..C...3.0..oBB.3C.W._....~.^Q.Z....f(.".@......!....i.C5.q....0TG.m."...J..[.2TKI4..P.1. ...S!...f^..Ya. .....P.z8.D.....@...j!..gy..W.. \3..........Te$..w...D..!J.c.a...L.h..rt}~]....o.9...H.X..I....Q:z.....wX.n,.C....P....2..O.....9....f....Z.....a?....e...:..h.....$b.y..^.<.P..0.d.!..Z...f>...o.\|..v.-f>......ChO...].2..89.W.0.B..'...6}......D.k?....<..)p.....<.<....'.bK....j..'...CA.....3....!.&09.......L.P.'<.'..l.eh.0.8.`..%..-g..E".5.P..G........m.B..d.u.C..!..\|0..w.....P4.e....M3.[...Q..#..f(........$...8...7......:2.EJQb...A....Tr#.uQz...9.'K.^...+.....#..r..o..Od..!.'..Vv.x...0..rT....Y.{e...%.K.q..K3V..h+.s...!.q.H..!.Su.T...ip..u.Rn...:Q,}..\X.....v+..V...:`,2t...@.Ig...Ja..!.

Chrome Cache Entry: 156

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 340 x 215, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	10814
Entropy (8bit):	7.958380780870667
Encrypted:	false
SSDEEP:	192:evZTv7aDAx3q5coMx+XFwuWY+jJWMADatCKAYnpe1ifmlttf:2ZfaDAx65Gx+1/8JdAGgKznoYmlf
MD5:	307DE82F2DA0800D7377C003A2C593BC
SHA1:	87A24BBF428E419B3F45DC8CD1931A71D07D9EB6
SHA-256:	A6D7703B3B8470DF04E955A45B7E1CB138B6989FE0AAC2D34848187E99F4AD97
SHA-512:	0297EFBC6020ACC3D7E3A800700371AC9C8734B913D9B73830E6FF8E0CE569F24C5D95A39BCDE81A27E56E8BD793AFA40DFF6D5D5A2742139113C7E353103BF3
Malicious:	false
Preview:	.PNG........IHDR...T.........r.YE....PLTE....$k.0..B...&.0o.5..B..8..C..?..A..3...!....7..+y. @.:..<...S.;..$h.#d..k.(t.?..>..(p.=..!a.6~./...K.-h.3y.D...E.7..8...W..Z........<.9..w.2s.<..=..>..&m.#J..>.)^..~.-}.B..2t.1p.C..!C....!^..)..8..:..1.&P.(W.,c.,`.#L..A..0..6. ]..;.........-z.3.....5{.........;........"F....>....Wdy..P.(Z.'S.-f.....++...3z.....6.....;..H.....F.jhg...."H.G.........x\|......X......................'U.z..%Q.$P.................pq}z...{q{qo......_Zf.....hjq..1..............~...uhj.....hs.z........si............x....~..........p\c..........................F...........iVL....n~......y.....RLWkw......mw.......b..;8;......g].go...Vm.k}.ef...MCF...j..w.......L[uOSf..........}.....s..@Ja....p_.w.YEpp..i...>>Q...]e.'Ej^U.<;U..]...tj......!K\|7A.I8.ny.;n.O..&.IDATx...\|...'4.M).!ICJZ...B....N...w...1.#........6.......W...Z...[F...,.mY~n].~ac.XX.........g$...~hd;.7....9..W.s...93...u.\.:.u..P.Z.._W..u.....9<..'JV.&...s8...W\u.U...;

Chrome Cache Entry: 157

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	7276
Entropy (8bit):	7.663057031848035
Encrypted:	false
SSDEEP:	96:IbN26MT0D5MdtbZPAVwzVqOcK/inrdl8sVOR+iCEjg/yTaI3Itoc1eGU6zk9aOpr:I2YNMtKworrdNVOR+iCAXFGRUH9Lc6
MD5:	E416811005C90530A730A5287D43A858
SHA1:	A8C46D154E19D3B025745980E65EF5225A0E9094
SHA-256:	1ADA5D6847DA8280CB91C16BEA3A27C5E0B5C3A5801B11C735F47C4F5A36E3EF
SHA-512:	F1AC2286574D191C678146E13978AB774F98DB65D504508AB26404902B78C09122DC58F98B1ED9935C18699BCC0E15D8B2E11335BC69473F8006067D32BB4A37
Malicious:	false
URL:	"https://images.sftcdn.net/image/upload/dpr_auto,f_auto,fl_sanitize,q_auto/download_intent/templates/corel-corporation/winzip-compression/winzip-feature-A"
Preview:	RIFFd...WEBPVP8X.... ......n..ICCPH......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1........

Chrome Cache Entry: 158

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 24.1 (Macintosh), datetime=2023:09:28 08:55:59], progressive, precision 8, 970x250, components 3
Category:	dropped
Size (bytes):	55783
Entropy (8bit):	7.688415177995569
Encrypted:	false
SSDEEP:	768:nm7fVJ7AYy4fI9J8cQou1C+S+lihfykb/F1LqUBaBo5TPL9PHa6WL2cAuPdTcN:n8VJMMfI8c8BMhfR2SJTPL9PJW1M
MD5:	2E450436C615BD552D2F70245C66259F
SHA1:	1063533E8C7DA37302A7998F26020CBF32D22D7A
SHA-256:	905D3E553E4422C5222B8C1280AE28AA047AABB4C71FD4CF8B8517C45E87E9BF
SHA-512:	C9DB525C1A5A3D848ABA5306A4B5FEB50F0DC284A09E4C55EC2ABE9A1A2BE30A428EC5BD14101B05E465142597059F002F4CE23885677305706199C30A7562EC
Malicious:	false
Preview:	......Exif..MM..............................b...........j.(...........1.....!...r.2...........i....................'.......'.Adobe Photoshop 24.1 (Macintosh).2023:09:28 08:55:59......................................................................"............(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................)...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....0.m..pe4...>.......X~..`?.at...hs.C.-..?.......{..O./..>...2............^..}OOb...[.^/E..,....[q....9...b..w;......D........1D.2.1.1. `x...~n.....

Chrome Cache Entry: 159

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	3810
Entropy (8bit):	7.948178133872469
Encrypted:	false
SSDEEP:	96:56f5kJbDof64uHVQL8aC78yrP1pjlLbLDnNbxCvU7:Uf5kJbES4U3786rvF
MD5:	B657596FD69CC3619301C799AC8E70B4
SHA1:	9F316C450D24AE72F88246657E7C4CBB00EBC128
SHA-256:	791FE7CC0B0AB00233E7BA3F98403FA05EA62540746165287B4F82171BC46FFC
SHA-512:	C783FE2BC00A996DB492936E2034DAE6BEC6A8D99808C8F0BE48D2A9BE9E88B3EE12C6D4BAD98EFD9381E90F44A1C52A5CB883E470C7AAC980A7DB65E1DE59A9
Malicious:	false
Preview:	RIFF....WEBPVP8L..../..7....m......l(n#...;...'..a..3.......2.O.....B..9.."...l.n.&.Dy.8......:......j.....I['......z.q>.t.R+@...._8c...y...........F.R_^{s.S.`..._...Uj..<O...n...`..(..u5Z..S..H...>...\|.....s. ..=.pe....._.....5..O.J..w.i.EvNk..T.....JrFt.b.w?..2bT.5.?ZJ..oR].o.5Uak.....o..mP8..1..W...rEo?.q...W.5.!.q].......)..\i.r..=O.][N....sm...^.H....8.V......#JtRx..3..w(/.\|...I..bRm...h8.O4..G..^4.1/..<....-.Q.!..<.p..Q1.W&.x.Z.....&..d.}U.\.9b...:..Z..nS.U.7R.7.z4P.(..G...j.E..G.[...._B...r...Iwn.....d.J}...I....B...F)~B?h...R..`cnlA.B2d..h..L2#<b.e/9!...n'.(.......u..+.....<<.itB.24d.Dg.M.4....r....T..{d.\|.y.......guF.f.<X.k..:..L..t....wQ@...).(+8Z.(/Y.O.?.O@.e1o....!....N.^..........K.C8.[..z.;SN...m.C.^..t.._!)5!{.6K..^/... .Z"E...@....E$]......x.p.@.7..>...\|/0.7.. ..B......lr...1oP.._RfB...yr..P.+@.tk._7..&.l.Q.ySgD.2..qE............}...m..EE..d.&drd<...Dk./8.....R.$..L.. 7...w..\|).......[.,....c.iI....r.}.d....(.j..g.&b.#EK.5

Chrome Cache Entry: 160

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 1-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	95
Entropy (8bit):	4.347811435468635
Encrypted:	false
SSDEEP:	3:yionv//thPlE+kSI+Dtmy/Y+sR3Qhl/Y3WlED//jp:6v/lhPfkCDtmywFghu3WlEDTp
MD5:	71A50DBBA44C78128B221B7DF7BB51F1
SHA1:	0EC63B140374BA704A58FA0C743CB357683313DD
SHA-256:	3EB10792D1F0C7E07E7248273540F1952D9A5A2996F4B5DF70AB026CD9F05517
SHA-512:	6AD523F5B65487369D305613366B9F68DCDEEE225291766E3B25FAF45439CA069F614030C08CA54C714FDBF7A944FAC489B1515A8BF9E0D3191E1BCBBFE6A9DF
Malicious:	false
URL:	https://sync.richaudience.com/2066127a3f7c6635eb4f6cac536feb5a/?gdpr=0&euconsent=&uid=ZYFg02kDskXAcMABkyNPagAACu4AAAIB
Preview:	.PNG........IHDR.............%.V.....PLTE....z=.....tRNS.@..f....IDAT..c`.......!.3....IEND.B`.

Chrome Cache Entry: 161

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7711)
Category:	downloaded
Size (bytes):	235919
Entropy (8bit):	5.585867673530724
Encrypted:	false
SSDEEP:	3072:aIsdZAlCIWYMuUyO1j2dypDDMlMT6LhA9DfFWkv+8rI2U5qd4w:lsfIHMuUy4sAT6LhA9DfY2frI2U8
MD5:	4B5E0871228A6C1B28B71104C615C60E
SHA1:	57B7B3044E7408914E1EA944CD3AB475E462A0B9
SHA-256:	514DD2E0948A3063AFA8A16C4D240132752E573B59F5E01F6FF976AAF490EA7D
SHA-512:	529CDF47ED5AEA472C006597061021F9F935C06FE990B2B1E795DD7BBA93A2E74CD5199E5B6B51217EAB77CB9B58F528CB781B74BBF4D61215CB5D7A20F99DD5
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=G-R5K71YRXMV&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_auto_events","priority":19,"vtp_enableScroll":true,"vtp_enableOutboundClick":false,"vtp_enableDownload":false,"vtp_enableHistoryEvents":false,"vtp_enableForm":false,"vtp_enableVideo":true,"vtp_enablePageView":true,"tag_id":111},{"function":"__ogt_1p_data_v2","priority":9,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CS

Chrome Cache Entry: 164

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2408
Entropy (8bit):	7.9151568759921584
Encrypted:	false
SSDEEP:	48:M0DoN7lmYxlJQL0H20H6LQaulp+A8V4QaUNb5UMVCr7/0sX6LJ:HU9oYxlqxPG+pNN5U//0sXgJ
MD5:	10D55A156EF0FB04B5772299F5E008B3
SHA1:	3A8F8E569EEC81F2854A80D0DD1B604A7E001331
SHA-256:	3B55B8D88B0912A2095D3EEA52617791EC20A1A968F7C136D18F45EF9E0706F6
SHA-512:	610FB718A353C2B2930B9216503570E138FFE77DF26475C78BE34FAA08B0711C50E29425D3C4C5A9B87A4A986E87B02EEFD22C2013BDCF3334F490C1B00AEE24
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/3599c54f-9c54-48c6-8d0e-bbfe7c8281a9/1991521449/the-caffeine-keep-your-pc-awake-icon.jpg
Preview:	RIFF`...WEBPVP8LT.../o...w.mU..\..4...he.......#.V.....bM.....w....v.H?.f.....r.i.d....`.C;........9..<...[....)x+._..W.....+.6-{..^.}..u..:..eX1.3..MO.......m3..@.q..`D..]......I.......@...P.1.18.@ .8....(...@08..>.}.`....L....-;.m..S...Z.nds%... ..B...@.F.....E+...A.._L..c]+........_../^....m.....zC5H...s:.\....B........\6........$Y..X.uk5....^]!.CF..E.yi\G...[...ea.......ADx1X.c.=..H\........../g.M...a..o....y...l.I.g.?a..tr..+...b\.9..j...A.e.)s.........#>\|UTT.....0.. ..!^T...4..j.E.R.:.........$hqx8N.... ..x.-.@..A=Y..m.ZH..a.wh...a3..(.A;>FNOR.'gf-K.7.gRl......:...xb!.w...S!2.2....8rr.+..r$.;.I.i.v.U....w{sg...Zb...).@v.2...).uW..$$....=m..v.ikw..R..7....#.=+.[.$"..V...NK.J.D.g2.....N............$q..F.".R..i....Z......3Ak'z...J.J..=...[."J.V.(. I.U...:2.:...z..W......zo.......\|.w..\m...B.T...X.K. ....K...J.....9...qV&...........H.. @.M.d..5...T..'..$.....7"... .[.mW. .;...#..I.L..P...!c=..PM}L......p.P.&Y..G.8C......

Chrome Cache Entry: 165

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (52990)
Category:	downloaded
Size (bytes):	53044
Entropy (8bit):	5.438374620694402
Encrypted:	false
SSDEEP:	768:Hcrbt0v6S3UbiINuGAIA0XieVpeB6ELQ1GHaLi9:HoBmM9e4E01GHa29
MD5:	0B6AA3AA07869D5163C8D489F7C66256
SHA1:	BD32C24DFC6C71AE54BF2E6473AD61FA6F81BE3B
SHA-256:	3D649C0B3E87FD6ABCB983656A0A1B3923A2A59885C3A30538641FD4F7126CBD
SHA-512:	D754CB423718F3BC335081D41A88386B58E2EB523635BD15773B43495064B52B0FBB9265DA8DD19E47A97CFAA1FABD40C73C36F9684F6C44F2A18E6502F44E88
Malicious:	false
URL:	https://acdn.adnxs.com/dmp/async_usersync.html
Preview:	<!DOCTYPE html>.<html>.<head>.</head>.<body>.<script type="text/javascript">!function(t){var e={};function a(n){if(e[n])return e[n].exports;var i=e[n]={i:n,l:!1,exports:{}};return t[n].call(i.exports,i,i.exports,a),i.l=!0,i.exports}a.m=t,a.c=e,a.d=function(t,e,n){a.o(t,e)\|\|Object.defineProperty(t,e,{enumerable:!0,get:n})},a.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},a.t=function(t,e){if(1&e&&(t=a(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var n=Object.create(null);if(a.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var i in t)a.d(n,i,function(e){return t[e]}.bind(null,i));return n},a.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return a.d(e,"a",e),e},a.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},a.p="./",a(a.s=114)}({1:functi

Chrome Cache Entry: 166

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1246
Entropy (8bit):	5.151199689075422
Encrypted:	false
SSDEEP:	24:Ysri5L/DwoTCo3AuupAKGYIefETCcHCa9M4Dku9seeWopvfU2XdqY:Yse5L/DwoTCo3GpAKGY/ETC49M4DBsC8
MD5:	2E1B4B106DD45E9E64A8BC1BFF917367
SHA1:	0B1BB8D196733566B998D7188418592F8D154AB2
SHA-256:	1C996FEBE2406193A8F4F29F33E6368F1AC678773895375FA183CFA2FABE6195
SHA-512:	47BBA2F1CBB1D8320ABB4B97DFAA1330D5787B2B0D9166FEC32425B5F4834B2B8190B736CBE50A8DAED7063B5844B25ACACD3B14C14367FFF845F8EEE3D96109
Malicious:	false
URL:	https://c.amazon-adsystem.com/cdn/prod/config?src=3177&u=https%3A%2F%2Fcaffeine.softonic.com.br
Preview:	{"3pvendor":"var lexiconPropertyId = '0013300001kQj1aAAC';\nif (lexiconPropertyId && lexiconPropertyId.charAt(0) !== '%') {\n if (!window._33AcrossIdMappingsProvider) {\n createlexiconScript(lexiconPropertyId);\n }\n}\n\nfunction createlexiconScript(id) {\n var lexiconScript = document.createElement('script');\n lexiconScript.src = 'https://cdn-ima.33across.com/ima.js';\n lexiconScript['onload'] = function (e) {\n const my33AcrossIdProvider = new _33AcrossIdMappingsProvider({\n pid: id,\n refreshInSeconds: 60 * 60 * 8,\n expires: 90,\n src: 'aps'\n });\n\n my33AcrossIdProvider.fetch();\n };\n document.head.appendChild(lexiconScript);\n};var id5PropertyId = '691';\nif (id5PropertyId && id5PropertyId.charAt(0) !== '%') {\n var id5Script = document.createElement('script');\n id5Script.src = '//cdn.id5-sync.com/api/1.0/id5-api.js';\n id5Script['onload'] = function(e) { \n ID5.init({ partnerId: Number(id5PropertyId) , provider: 'aps' })

Chrome Cache Entry: 167

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 168

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.403590365002627
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tJ8/V+/B6dS8p:6v/lhPfA/UJ63p
MD5:	EDB2AA47631C67A43709D4CCD2501E33
SHA1:	87475B448C53CF32FFE78AB121DB8BAB41D478E0
SHA-256:	6019C3C9E47DC991F8D9937DEAFBB0740C2E61E321324798CB508773B0814824
SHA-512:	65820EEAF261F01988570AFE7866D9B83901950DFBD89542009A1FAAAE520E1AF2FA08789B7E94A64B0E1A3BDC39256354EFE1D38856621851DD65E80505DBB2
Malicious:	false
URL:	https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=5184721251378344538&gdpr=0&gdpr_consent=
Preview:	.PNG........IHDR.....................IDATx.c........o.......IEND.B`.

Chrome Cache Entry: 169

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1136
Entropy (8bit):	7.799045186807843
Encrypted:	false
SSDEEP:	24:5YNBRmnxBFtchj1D32fF4ZZuyjH+PGL2D7Bo67N+oa7kVjT:GtcMhjV38iZzaO6D7DJ+7kxT
MD5:	59C756C9DD7A9ECF6084AB64AC3FE1D0
SHA1:	08B60D242458C101375EAFE653FB3E26BC4BAECB
SHA-256:	30822C038765843707954CBBE17FA9827401CFEDE0DE2B28C3BE40E76845E5C1
SHA-512:	EFF4F5733EED425A0DCAF7DFE13F446225A8E4CDA75C90F13CF46BB20ED5E671EE837B7504C37D44B1ED1EE61900E80430683197EB67E1CCABFFB552C8F3904A
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/1abdcd3e-c3c1-496a-a6eb-6b415cef852a/3643405520/hp-photosmart-printer-d110-driver-logo.png
Preview:	RIFFh...WEBPVP8L[.../o......m..?......A..v..@...........$.$....$.........X...m.M.w......x@.#..P....5..;...\:z[...... 7.I....W.....FI.R.:.9.fi.d$.;.G.'ks5^o.Y..T;.{..JP~V..=..{.}..:........).}t[=.O.r.[.W..O.......%.......J..q..F..d.G~$..S.....c...X#....c..&.M..P.7..c(z...5..]....d?..Q.g..f....i.C54<.f.A!a....._x....,lA.P-%........R...2t.d.-.3$.0T...@n..J..y..0T7..hC..j...3.r...&....O.Q..m.!9uj2..S...!,....#\2..`7....E`.\....7E..[...LXB.Bu#...z..-... .c...a..F0..?r<......2.6.7....././.nG..c1....MT.+....2.>.`.:..h.....I.%.N.?.y .M<..fBx.4"w......\g.3}#.7...\.IX{...Rc&D<9..o.bo..H...>.......K..bt.........!....AL......5.c..g(..!...V..L`..P2.!.&......6C.h...........VC+.0.1.JG)...q@6.PF<.#.%..r.l3... c.C2.v.._..C.....c.pn$.5.r.8C.$.N..<.g.1...0.....Jt..f(...4Cy.p..P...r.t.......P.....()1T.C4=.J.U(..C.U...........,.2=P.x"..N.lX.QO....x<I.T[...E.{C..`.Y#...1u..b....^K..0u$.b..Lq..R1.0/...hh.r........a.....`#.La..&V...V.Xd.U3.....n.1t.&

Chrome Cache Entry: 170

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	159
Entropy (8bit):	4.969097290298035
Encrypted:	false
SSDEEP:	3:8WiCLViemo/HHVIoCYKgQnIwBM4DCVeBZR8K0i8IxnODL6OMCfNh:8WiIUemo/H1fCYKbY4DCVeUVUODXVfX
MD5:	871314B1FB0A716E222A7F623A5C2A89
SHA1:	5B86AE61066F0B6DBC2B11A8F8813509E5B6D762
SHA-256:	6CB6AAB814BB4585646220E471F0A9345BB859E9ACCED6FC4736B782167E0A9F
SHA-512:	A2544E69A97CE05A1DF0DC52D81C0989A17728BCACC3A30B78E91681D1E9DE868A99428C8E8A9EC7907EE93CF6964FCF5DA28774193AAC2368969A4A0FF01F83
Malicious:	false
URL:	https://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=https%3A%2F%2Fcaffeine.softonic.com.br%2F&pid=sN2DceDyaHhkI&cb=0&ws=1280x907&v=23.1211.1645&t=1000&slots=%5B%7B%22sd%22%3A%22top-mpu-1__ad%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%2C%22300x180%22%2C%22300x150%22%2C%22250x250%22%2C%22200x200%22%2C%22180x150%22%2C%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fdesktop-Web-pt%2FApps%2FProgrampage%2FATF_MPU_First%22%7D%2C%7B%22sd%22%3A%22top-leaderboard-1__ad%22%2C%22s%22%3A%5B%221x1%22%2C%22970x250%22%2C%22970x90%22%2C%22960x90%22%2C%22950x90%22%2C%22728x90%22%2C%22500x90%22%2C%22468x90%22%2C%22468x60%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fdesktop-Web-pt%2FApps%2FProgrampage%2FATF_Leaderboard_First%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22Windows%22%7D%2C%22browsers%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%5B%22117%22%5D%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%5B%228%22%5D%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%5B%22117%22%5D%7D%5D%7D%7D%7D&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Preview:	apstag.punt({"cmp":"https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-onetag_pm-db5_rbd_rx_ox-db5_smrt_sovrn_3lift","cb":"0"})

Chrome Cache Entry: 171

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (632)
Category:	downloaded
Size (bytes):	831
Entropy (8bit):	5.481149221648905
Encrypted:	false
SSDEEP:	24:2e2C6hHfhiVIFK+zuh3pZvKzN9oGh9OSi6BvToQGBf:2e2C6lIqvzuXcnomFi6BvTdGBf
MD5:	23478D875B9C86C8354ACFA666918752
SHA1:	EDA71151A7AF5AD47DE1E3B02DC8FF363223F797
SHA-256:	E2B93349080AD2D22A5DBEDB75420003B84032F5C684CE6052191F9AB31C7FEB
SHA-512:	3CE0265FC460F2D615AD77AB484337198D8F700E00A586FE6C4D9012270651467CA32181ADC75432AB0D1FAD951E8FC7EB75BEE291AA9536740E51C9A6F02FC6
Malicious:	false
URL:	https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0
Preview:	<html>.<head><title>Pixels</title></head>.<body>.<script>if("browsingTopics"in document&&document.featurePolicy.allowsFeature("browsing-topics"))document.browsingTopics()</script>..<img src="https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=13de7dcb-57c4-8911-aa9b-7bf1acf99f35&gdpr=0"><img src="https://pr-bh.ybp.yahoo.com/sync/openx/dfcf67f2-dbc2-a0a2-5b42-ef933b9d999c?gdpr=0"><img src="https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=13de7dcb-57c4-8911-aa9b-7bf1acf99f35"><img src="https://match.adsrvr.org/track/cmf/openx?oxid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0"><img src="https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Njc2N2QyN2MtODIxOS02YzRmLTdmNzUtYTNkZjBlMjg5YWI1"><img src="https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc">..</body>.</html>.

Chrome Cache Entry: 172

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1843), with no line terminators
Category:	downloaded
Size (bytes):	1843
Entropy (8bit):	5.268154831196205
Encrypted:	false
SSDEEP:	24:kRUpKBG6FSPNSYmKOPgEnSYSYxBfidSqSYckSDSYRpKSY3uMrSY0GLSYmSYcWt05:kKKBpKmRFHxBfiTckS5RW3/DcF6Tt
MD5:	4869FF42D0A5F902C8DA311E015D75B0
SHA1:	D9673EA7C9605ADD0D8DA43E8C38464FBB50854B
SHA-256:	AEB575E090910535AF1468BA133B5CF644F12D10A562301479ADCCE46C7715BA
SHA-512:	EF7BE2F7DC0177D43DCE9AEEAA0F49CFAFA6D040C0CFA1B42933A4C7336F47350667F34ADFEF48EE9CB8B1E38B13EB6656B183BD5124EFCDC5D906E5D5EB78E0
Malicious:	false
URL:	https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.richaudience.com%2F2066127a3f7c6635eb4f6cac536feb5a%2F%3Fgdpr%3D0%26euconsent%3D%26uid%3D&gdpr=0&gdpr_consent=&s=201092&C=1
Preview:	<html><head><title></title></head><body><img src="https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZYFg02kDskXAcMABkyNPagAACu4AAAIB&gpp=&gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZYFg02kDskXAcMABkyNPagAACu4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZYFg02kDskXAcMABkyNPagAA%262798&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=" style="display:none" width="0

Chrome Cache Entry: 173

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (34559)
Category:	downloaded
Size (bytes):	322832
Entropy (8bit):	5.424234729705068
Encrypted:	false
SSDEEP:	1536:UQEpC3aSmjCd4RruF6akWkhbDwh2+PvYtnWVeBK9ats+CWy2DQzgxXJQsvdHkKzQ:UQERWk2rPDc6jWCgx4ySKVDc
MD5:	77B35B13D634B47EBF923B830F199018
SHA1:	2C73CF3E2713129F1F3340C0972F96DAD9DE81D2
SHA-256:	B0C765C850567A15927F1E96BB6F460F29FF061BBC53F1F5E693F46C86DC9D75
SHA-512:	B3BBF5D4E5903B6BB715E9335F3F52E81A0CEF0CC79AD4DF1A5B67510DDE38470414C27F9D20DEC2F3207D1C1AFD6A1E756E94F32B1DC4E6D8C1C115A39A1C6D
Malicious:	false
URL:	https://caffeine.softonic.com.br/
Preview:	<!DOCTYPE html><html lang="pt-BR"><head><meta charset="utf-8"><meta http-equiv="x-ua-compatible" content="ie=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Caffeine - Download</title><link rel="preconnect" href="https://sc.sftcdn.net"><link rel="preconnect" href="https://images.sftcdn.net"><link rel="preconnect" href="//sdk.privacy-center.org"><link rel="preconnect" href="//securepubads.g.doubleclick.net"><link rel="preconnect" href="//www.googletagmanager.com"><link rel="preconnect" href="//c.amazon-adsystem.com"><meta name="description" content="Caffeine, download gr.tis. Caffeine 1.5: Dose certa de cafe.na para o computador n.o dormir. "><meta name="robots" content="all"><link rel="canonical" href="https://caffeine.softonic.com.br"><link rel="alternate" hreflang="es" href="https://caffeine.softonic.com"><link rel="alternate" hreflang="nl" href="https://caffeine.softonic.nl"><link rel="alternate" hreflang="pt" href="https://caffeine.softonic.com.b

Chrome Cache Entry: 174

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	353017
Entropy (8bit):	5.339296247263515
Encrypted:	false
SSDEEP:	6144:k5APAe7O81PN93qADQWGC2MoNEGKb4PSj:9IeK8dXGC6PKbZj
MD5:	DA3D406C555A803914979E729D039216
SHA1:	3897E4A9DBEA26F8424A809BD0C078D311327000
SHA-256:	3EDFBC46685F6B4A7652DD6394237067F0A481D6631B1951A016A00E05058306
SHA-512:	92596142DB8BB11B79352ED3DA36AEFBBD2AE65935E81263D61E45FD27AB14920CF0A5075677A16F60F970C1CE68870F0692325D459AFE4E8131CBD8E39F2C83
Malicious:	false
URL:	https://softonic.com.br/revamp/sft-prebid.js
Preview:	if(window.pbjs&&window.pbjs.libLoaded)try{window.pbjs.getConfig("debug")&&console.warn("Attempted to load a copy of Prebid.js that clashes with the existing 'pbjs' instance. Load aborted.")}catch(e){}else (function(){!function(){var e,n={35706:function(e,n,t){t.d(n,{Pd:function(){return d},Th:function(){return s},_U:function(){return f}});var r=t(55730),i=t(64358),o=t(20265),a=t(34614),u=(0,t(78640).R)(),c="outstream";function s(e){var n=this,t=e.url,o=e.config,a=e.id,u=e.callback,s=e.loaded,d=e.adUnitCode,f=e.renderNow;this.url=t,this.config=o,this.handlers={},this.id=a,this.renderNow=f,this.loaded=s,this.cmd=[],this.push=function(e){"function"==typeof e?n.loaded?e.call():n.cmd.push(e):(0,i.logError)("Commands given to Renderer.push must be wrapped in a function")},this.callback=u\|\|function(){n.loaded=!0,n.process()},this.render=function(){var e=this,n=arguments,o=function(){e._render?e._render.apply(e,n):(0,i.logWarn)("No render function was provided, please use .setRender on the ren

Chrome Cache Entry: 175

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1132
Entropy (8bit):	7.788035787250117
Encrypted:	false
SSDEEP:	24:uYZaOrH7g1q2QAsMF6Az/0JBZrgXsEEpa9NJM9auR7:pprH01hscV/yBZMaa9v4HR7
MD5:	B72D387806EFDED87CA5235A747204AA
SHA1:	9E3520E6997E6EBF7B5EB5EF4196B002BB865CB2
SHA-256:	62B78FBEAAC879A591FB7563CE48AEF32F7E8C4C38CCE05BC8D9EEDC8BED7697
SHA-512:	B74CF0A002ABA1E70E7194A40441C9B30DA003E8FFF55A92193007D6BB47E755E21103355FB6B627D5A6BBF8C619ED3A46DFBC4C59CF58FD5BFE083B5E2CED8F
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/6512042b-c170-4f25-86f8-399702cd0cc4/455719081/hp-officejet-j3600-printer-series-drivers-logo.png
Preview:	RIFFd...WEBPVP8LX.../o......m..?......A..v..@...............,.l.....`.d..I.$..D(.h.....@VV.=...%[..n...rB._p..m..Z...p..rc.....mp.K...uV..Y.T.z.V..Q...o_...3..U...G....<K....~to..e...f.~gqI5?.d.X...\|.%W.U>uX.ik}.4.Wx..(.....Hd..u..SY,Q7..+?..JS.4..<..C...3.0..oBB.3C.W._....~.^Q.Z....f(.".@......!....i.C5.q....0TG.m."...J..[.2TKI4..P.1. ...S!...f^..Ya. .....P.z8.D.....@...j!..gy..W.. \3..........Te$..w...D..!J.c.a...L.h..rt}~]....o.9...H.X..I....Q:z.....wX.n,.C....P....2..O.....9....f....Z.....a?....e...:..h.....$b.y..^.<.P..0.d.!..Z...f>...o.\|..v.-f>......ChO...].2..89.W.0.B..'...6}......D.k?....<..)p.....<.<....'.bK....j..'...CA.....3....!.&09.......L.P.'<.'..l.eh.0.8.`..%..-g..E".5.P..G........m.B..d.u.C..!..\|0..w.....P4.e....M3.[...Q..#..f(........$...8...7......:2.EJQb...A....Tr#.uQz...9.'K.^...+.....#..r..o..Od..!.'..Vv.x...0..rT....Y.{e...%.K.q..K3V..h+.s...!.q.H..!.Su.T...ip..u.Rn...:Q,}..\X.....v+..V...:`,2t...@.Ig...Ja..!.

Chrome Cache Entry: 176

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2001), with no line terminators
Category:	downloaded
Size (bytes):	2001
Entropy (8bit):	5.276943648657026
Encrypted:	false
SSDEEP:	24:kR0uLhcSYMVenSYNXZZvhSqSY52iZ/jSqSYATSeCSYYWSY2g0rySYxBfidSqSYkL:kqTNXTX5hNJAUTJxBfiTkht
MD5:	E9D5E5D73E430F45CD0F9973E807FAEB
SHA1:	C0A0DFEB99F36A321B9C53834FE3C8210C28127F
SHA-256:	5B62A535AD9FF237B131F0E3B2D0510B782D1EF83597CAB2FC84D0FD32FEF8AE
SHA-512:	3F14954715169CF9A7EA0CAA6903227E7A16335BF06C1684E9683262BB7886ADA6E4E9686C6F87B794180543A9ED65E4A86C4DFB672813A7C5F129A0B103D622
Malicious:	false
URL:	https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fcaffeine.softonic.com.br%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Preview:	<html><head><title></title></head><body><img src="https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&us_privacy=1---" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://pr-bh.ybp.yahoo.com/sync/casale/ZYFg02kDskXAcMABkyNPagAACu4AAAIB?gdpr_consent=&us_privacy=1---&gdpr=&gpp=&gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://ads.stickyadstv.com/user-registering?dataProviderId=1025&userId=ZYFg02kDskXAcMABkyNPagAACu4AAAIB&gdpr_consent=&us_privacy=1---&gdpr=&gpp=&gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZYFg02kDskXAcMABkyNPagAACu4AAAIB&gdpr_consent=&us_privacy=1---&gdpr=&gpp=&gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://casale-match.dotomi

Chrome Cache Entry: 177

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	3004
Entropy (8bit):	7.92324515539755
Encrypted:	false
SSDEEP:	48:MHT8IbBe9ryJgSIxtZRSPZpNKrHAzcLXNbLZjDBGAnHiVAb5kHrI6Ecnww9M:MHQMGfjS6gzuNzG0GO5kH06Ecnww9M
MD5:	E92A0B54174144F64E0E45A4FC6F6A46
SHA1:	41002FFF9724F62196FEABE50B17221BE05B8E07
SHA-256:	8621A0FBE8397EA95082AD858E267B3160B87E2451BE78A0A4068B2C2571E86C
SHA-512:	0221B993985276F28C98EBD350E649A9A3B7D1725D7614588198B3D0E272C9E8158F679B03431766AB4F5DB44F1AD400489A2B0AEAED39C31EB8308537B7EA13
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/3b5462be-96d0-11e6-83ed-00163ec9f5fa/2190082916/driver-booster-free-Driver%20Booster%208_icon_size256.png
Preview:	RIFF....WEBPVP8L..../o...?...$E..e2.3..`.6..9...d\|.a.6......&3=......q.cZ..l.2#G'....~........)I..............P^l......3...c$........BB..m.m$....!...@...1..@s_.3...%[.r.!E..........\|...n..............B.d....]......d.i..VQ...y;.....H{B....i.y..L........!..J)........8%8.y...m.:..Lz.,Y...!...0-..2>...c......3..4...g....s....=........9=>.$V.9.....L.3...5q..~)...o'.C.".......72.....r.......S....<.8".Zb.....Ou.p...+n.......5..I..z.>.Cj9.{.[..Y[.)....!.j..\|....s.V.D..8...v.0k.../.RV.%r..d.:-...+\|.R..%.O.%...B\|..H]....."gG..s....*...d+..........H..D.oP...u./,s..9.#...y........G.S{.{.;..N.G.F....(.i.j ....[uQ..9.C.....<....~t..H4ka............0...v..F\|...).E..{T.6GC.\|4.:.....3......cn.W.H.\|v.a.h...@.\|6.k.+..I..Q?dW".. ..G..U.....6.....=.n+.RizIr......sK.E..T+]Of....h9.Iy.>..`.... (L.\|...U#.i.I...........'......{.}.!..X..m.x..Z`h.D.mh~...]......6.,......V...K..x...D_./47../..J.x..n&.....$.{.bj.E$.\2....#..3S..C...57S.1.O6.Z...Sl{.k....6...bB.. .(...9...L..

Chrome Cache Entry: 178

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	103492
Entropy (8bit):	5.3054846934724855
Encrypted:	false
SSDEEP:	1536:T0ZB5rglgS5U5SFCGZn/10NMZCIQ8z0a+UwyipyWHDniA8/a0J:eBtSp0NxIipyWH7y
MD5:	8F6845AE1A1844DE613C6951B290098E
SHA1:	E493BAFFE729DEE4699325C9216540287006D008
SHA-256:	F44CDECF0EA85B9EF48B516853E4ED2BA053A46CFCD68F8DA6F96203ED7DFD3A
SHA-512:	35247D70EC47FE8C4351974637F41F34F61F28763F6E64A85C4ACA19A5B0BDEF2044128D8A63F0C39CF226A49BE14B09ED5E7A15E2F1BA77928659C085497A3C
Malicious:	false
URL:	https://sc.sftcdn.net/scripts/23986-8f684.mjs
Preview:	!function(e){function t(t){for(var a,i,s=t[0],c=t[1],l=t[2],u=0,p=[];u<s.length;u++)i=s[u],Object.prototype.hasOwnProperty.call(n,i)&&n[i]&&p.push(n[i][0]),n[i]=0;for(a in c)Object.prototype.hasOwnProperty.call(c,a)&&(e[a]=c[a]);for(d&&d(t);p.length;)p.shift()();return o.push.apply(o,l\|\|[]),r()}function r(){for(var e,t=0;t<o.length;t++){for(var r=o[t],a=!0,s=1;s<r.length;s++){var c=r[s];0!==n[c]&&(a=!1)}a&&(o.splice(t--,1),e=i(i.s=r[0]))}return e}var a={},n={2:0},o=[];function i(t){if(a[t])return a[t].exports;var r=a[t]={i:t,l:!1,exports:{}};return e[t].call(r.exports,r,r.exports,i),r.l=!0,r.exports}i.e=function(e){var t=[],r=n[e];if(0!==r)if(r)t.push(r[2]);else{var a=new Promise((function(t,a){r=n[e]=[t,a]}));t.push(r[2]=a);var o,s=document.createElement("script");s.charset="utf-8",s.timeout=120,i.nc&&s.setAttribute("nonce",i.nc),s.src=function(e){return i.p+"chunk"+e+"-"+{0:"e19829",1:"5e05e3",4:"1f1edc",5:"e5448f",6:"1770ad",7:"cf6bbd",8:"b39f69",9:"5ab865",10:"6e31e6",11:"cd8475",1

Chrome Cache Entry: 179

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 1-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	95
Entropy (8bit):	4.347811435468635
Encrypted:	false
SSDEEP:	3:yionv//thPlE+kSI+Dtmy/Y+sR3Qhl/Y3WlED//jp:6v/lhPfkCDtmywFghu3WlEDTp
MD5:	71A50DBBA44C78128B221B7DF7BB51F1
SHA1:	0EC63B140374BA704A58FA0C743CB357683313DD
SHA-256:	3EB10792D1F0C7E07E7248273540F1952D9A5A2996F4B5DF70AB026CD9F05517
SHA-512:	6AD523F5B65487369D305613366B9F68DCDEEE225291766E3B25FAF45439CA069F614030C08CA54C714FDBF7A944FAC489B1515A8BF9E0D3191E1BCBBFE6A9DF
Malicious:	false
URL:	https://sync.richaudience.com/056f32ee5cf49404607e368bd8d3f2af/?gdpr=0&euconsent=&uid=9f860467-d79c-45d4-bcf9-51ad3d856e68
Preview:	.PNG........IHDR.............%.V.....PLTE....z=.....tRNS.@..f....IDAT..c`.......!.3....IEND.B`.

Chrome Cache Entry: 180

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1246
Entropy (8bit):	5.151199689075422
Encrypted:	false
SSDEEP:	24:Ysri5L/DwoTCo3AuupAKGYIefETCcHCa9M4Dku9seeWopvfU2XdqY:Yse5L/DwoTCo3GpAKGY/ETC49M4DBsC8
MD5:	2E1B4B106DD45E9E64A8BC1BFF917367
SHA1:	0B1BB8D196733566B998D7188418592F8D154AB2
SHA-256:	1C996FEBE2406193A8F4F29F33E6368F1AC678773895375FA183CFA2FABE6195
SHA-512:	47BBA2F1CBB1D8320ABB4B97DFAA1330D5787B2B0D9166FEC32425B5F4834B2B8190B736CBE50A8DAED7063B5844B25ACACD3B14C14367FFF845F8EEE3D96109
Malicious:	false
Preview:	{"3pvendor":"var lexiconPropertyId = '0013300001kQj1aAAC';\nif (lexiconPropertyId && lexiconPropertyId.charAt(0) !== '%') {\n if (!window._33AcrossIdMappingsProvider) {\n createlexiconScript(lexiconPropertyId);\n }\n}\n\nfunction createlexiconScript(id) {\n var lexiconScript = document.createElement('script');\n lexiconScript.src = 'https://cdn-ima.33across.com/ima.js';\n lexiconScript['onload'] = function (e) {\n const my33AcrossIdProvider = new _33AcrossIdMappingsProvider({\n pid: id,\n refreshInSeconds: 60 * 60 * 8,\n expires: 90,\n src: 'aps'\n });\n\n my33AcrossIdProvider.fetch();\n };\n document.head.appendChild(lexiconScript);\n};var id5PropertyId = '691';\nif (id5PropertyId && id5PropertyId.charAt(0) !== '%') {\n var id5Script = document.createElement('script');\n id5Script.src = '//cdn.id5-sync.com/api/1.0/id5-api.js';\n id5Script['onload'] = function(e) { \n ID5.init({ partnerId: Number(id5PropertyId) , provider: 'aps' })

Chrome Cache Entry: 181

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (647)
Category:	downloaded
Size (bytes):	514678
Entropy (8bit):	5.669850658889447
Encrypted:	false
SSDEEP:	6144:58+cCxHn6/Wk+Zx1raepBj8oQHOlkjc7n/NrfQjFw/hrPutvvQmkUtV6:5/bZk/ShQumirfqFw/MKmkUK
MD5:	37C6AF40DD48A63FCC1BE84EAAF44F05
SHA1:	1D708ACE806D9E78A21F2A5F89424372E249F718
SHA-256:	DAF20B4DBC2EE9CC700E99C7BE570105ECAF649D9C044ADB62A2098CF4662D24
SHA-512:	A159BF35FC7F6EFDBE911B2F24019DCA5907DB8CF9BA516BF18E3A228009055BCD9B26A3486823D56EACC391A3E0CC4AE917607BD95A3AD2F02676430DE03E07
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././*.. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. o

Chrome Cache Entry: 182

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	334075
Entropy (8bit):	5.51253772352316
Encrypted:	false
SSDEEP:	6144:KeP9t1ghNU/fV0KlPy0o+nmanmFBv3bioMctdPdQBFs:z1tWNK0yCPdQw
MD5:	8C05FAF92017F5950C2F6E43CE4C4A84
SHA1:	6FC8DE6F28BC080221747E8C7FC1C8E0C87D3E35
SHA-256:	5D4EE71AE31D3120FE8922A7BA48EFAF28E1721B0BAB117083B7E5CCC0F4284C
SHA-512:	577DF1B9D66E538491C2DDF732B9356DED12935A2E1C4BE1BB2BE78C20C9F91D6DBE66E90682F5C0CE7EE382ACF81928DBBCA176267C6C99C020471919B5E71B
Malicious:	false
URL:	https://softonic.com.br/revamp/sft-bundle.js?modern=1
Preview:	(()=>{"use strict";var e,t={2131:e=>{function t(e){return(t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}e.exports=function(){for(var e,r,n="__tcfapiLocator",o=[],i=window,s=i;s;){try{if(s.frames[n]){e=s;break}}catch(e){}if(s===i.top)break;s=i.parent}e\|\|(function e(){var t=i.document,r=!!i.frames[n];if(!r)if(t.body){var o=t.createElement("iframe");o.style.cssText="display:none",o.name=n,t.body.appendChild(o)}else setTimeout(e,5);return!r}(),i.__tcfapi=function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];if(!t.length)return o;"setGdprApplies"===t[0]?t.length>3&&2===parseInt(t[1],10)&&"boolean"==typeof t[3]&&(r=t[3],"function"==typeof t[2]&&t[2]("set",!0)):"ping"===t[0]?"function"==typeof t[2]&&t[2]({gdprApplies:r,cmpLoaded:!1,cmpStatus:"stub"}):o.push(t)},i.addEventListener("message",(function(e){va

Chrome Cache Entry: 183

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 184

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3026)
Category:	downloaded
Size (bytes):	198978
Entropy (8bit):	5.54353220466142
Encrypted:	false
SSDEEP:	3072:LldZAlCIWYVUyO1jebypDDMv0MWXdXAhA9DfFWks54w:RfIHVUy4S3WtwhA9DfYfR
MD5:	75D30907FCD57517BED935884AB567FA
SHA1:	3F9A3469FC90AEA3A5CB4BD7811A970E8F5CC058
SHA-256:	74E1CE47E33013F431919034811E09E3D9515B31FC0848CF0AA07FC3388A5CB7
SHA-512:	F644007F2D95B5A085ECD9D93A6CE6EF2335DDBF7CA28B9F1CDFF7304688FDA66BE2C973C90E67ADFCE142D56A86B6218EE1BED1AC734E40F002F32D9DAD82FA
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=AW-631321069&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. .].,"entities":{."__cid":{"4":true,"3":true}...}.,"permissions":{."__cid":{"read_container_data":{}}...}....,"security_groups":{."google":[."__cid"..]...}....};...var aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ea=function(a){return a.raw=a},fa=function(a,b){a.raw=b;return a},ia=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:ba(a)};throw Error(String

Chrome Cache Entry: 185

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (20544), with no line terminators
Category:	downloaded
Size (bytes):	20563
Entropy (8bit):	5.1574875073478434
Encrypted:	false
SSDEEP:	384:b53ZHN0YtZybYGEbbGTaBaGJ5W6ogx18bn:b1T00brAGHWTgQ
MD5:	D23204BC667A8573EAAFB32EFB0F3B26
SHA1:	8219A69C03F49FAE1DBDD27BCD452897224C0D34
SHA-256:	7928D68110A61142AC733C72BC92FC1BBEF1DF98B44DA65B7830B8759AD0DFDA
SHA-512:	93D5B068F614F35F83756904E9D60EF5C53C43B7CD026A0E028745B71E4EEEC634D4CEED8671BFE228F1E1538838E878316FB917A792F51876B643C539D26724
Malicious:	false
URL:	https://sc.sftcdn.net/scripts/chunk1-5e05e3.mjs
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[1],{142:function(e,t,i){"use strict";i.d(t,"f",(function(){return M})),i.d(t,"e",(function(){return O})),i.d(t,"c",(function(){return q})),i.d(t,"h",(function(){return H})),i.d(t,"k",(function(){return P})),i.d(t,"a",(function(){return V})),i.d(t,"l",(function(){return N})),i.d(t,"m",(function(){return U})),i.d(t,"j",(function(){return R})),i.d(t,"d",(function(){return K})),i.d(t,"g",(function(){return W})),i.d(t,"b",(function(){return F})),i.d(t,"i",(function(){return G}));var s=i(20),o=i.n(s),n=i(151),r=i.n(n);class l{constructor(e){var{sam:t,slotId:i,displayedTime:s=100,emptyTime:o=100,timeoutTime:n=2e3,onDisplayed:r=(()=>{}),onEmpty:l=(()=>{}),onTimeout:a=(()=>{})}=e;this._sam=t,this._slotId=i,this._displayedTime=s,this._emptyTime=o,this._timeoutTime=n,this._onDisplayed=r,this._onEmpty=l,this._onTimeout=a,this._timeout=null,this._onDisplayAd=this._onDisplayAd.bind(this),this._onEmptyAd=this._onEmptyAd.bind(this)}start(){this._sam

Chrome Cache Entry: 186

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	33
Entropy (8bit):	4.498939573903908
Encrypted:	false
SSDEEP:	3:YJH/PTLHl2r4n:YJ/rZl
MD5:	766DD3A980C8E609AE87CA07B65F3A6E
SHA1:	39635322B78E14EE7BA3AE6BE8240120CE26C87E
SHA-256:	788026E09A66C3D605588B6D9AEE88BA60F7824325EA1C14E8E89077DEA4177F
SHA-512:	D641444E1AAF09478613F4EB2E72F24EE7FF9DACABF1EC5DCF1B556A9E9FF7A84E22B6503AC89440223A4A62F9336DB844B96F73A72CB59295631601ADC807E8
Malicious:	false
URL:	https://lb.eu-1-id5-sync.com/lb/v1
Preview:	{"lb":"+evDpv7XuNTdiAMNOs6ibQ=="}

Chrome Cache Entry: 187

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6482), with no line terminators
Category:	dropped
Size (bytes):	6482
Entropy (8bit):	5.386219794662181
Encrypted:	false
SSDEEP:	192:UaveH+XTFLLgXxQRCJS3ZE1m1j/YMvKTP+pmY2/:UdqTFPKt16EMiY2/
MD5:	A4D296427FC806B21335359E398C025C
SHA1:	46928CCD1407B4E55192BB9D0A07DCFEBD9687B7
SHA-256:	06B99248A163333E36980A6CFB756F1A7DE60FA49517162B87B1A44D5D48F844
SHA-512:	4C0326040E2C7837FA78185CC5A185EA43697DD4F3591757F84BDA76BAC746BADFBE047DAC2C1DC677561FD6CC6C5D5B4BEBB7D671CB82AB04E070DA766FE6AF
Malicious:	false
Preview:	var amzn_aps_csm=amzn_aps_csm\|\|{};amzn_aps_csm.errors=[],amzn_aps_csm.reportErrors=function(a){var b,c;for(/^https?:\/\//.test(a)===!1&&(a=document.location.protocol+"//"+a),"/"!==a.substr(a.length-1)&&(a+="/"),b=0;b<amzn_aps_csm.errors.length;b++)c='{"adViewability":[{"error": {"m": "'+amzn_aps_csm.errors[b]+'"}}], "c": "aps_communicator", "api": "RTB", "error": 1}',"https:"===document.location.protocol&&/^http:\/\//.test(a)===!0&&(a=a.replace("http://","https://")),(new Image).src=a+c+"?cb="+Math.round(1e7*Math.random());amzn_aps_csm.errors=[]},function(a){function b(a){return a?a.replace(/^\s+\|\s+$/g,""):a}function c(a){if(a&&a.s){var b,c=a.s.length>0?a.s[0]:"",d=a.s.length>1?a.s[1]:"";c&&(b=c.match(j)),b&&3===b.length\|\|!d\|\|(b=d.match(i)),b&&3===b.length&&(a.f=b[1],a.l=b[2])}}function d(a,d){if(d=d\|\|{},!a)return{};a.m&&a.m.message&&(a=a.m);var i,j,k,l,m,n={m:e(a,d),c:a.c?""+a.c:a.c,s:[],l:a.l\|\|a.line\|\|a.lineno\|\|a.lineNumber,name:a.name,type:a.type},o=0,p=0;if(i=a.stack\|\|(a.err?a.err

Chrome Cache Entry: 188

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1888)
Category:	downloaded
Size (bytes):	145912
Entropy (8bit):	5.557530917512182
Encrypted:	false
SSDEEP:	1536:dbbz4ukqU9PyAgPn2XMfmOU2a9YKtVv2wQc6JSbnjXXuQeKyD0cu1g1t0APO4HNJ:Wt2Idv2H2bnjXrazuI3PCrg2Jc51CVCb
MD5:	B351ED42082BECCDA5B44FB44D6DC3F7
SHA1:	8CF5D40EC4B0B1EC4506DE1D9C155AB90672E85D
SHA-256:	692DBC3B77402B9EBD33F35BD6F29A6FB7880EC1161B2D9B68B9A4EC77B82A8E
SHA-512:	79F18E55F91DEAD5F3F36C757DF55EFD18E01422D25EE0704B3380C3C4C7B388244A3F16A7337218CCF3EB26537F18D88F81117C35FEF3F51C32B358C947CB48
Malicious:	false
URL:	https://www.google.com/adsense/search/ads.js
Preview:	if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"15754572537997874545",packages:"search",module:"ads",version:"3",m:{cei:"17300002,17301383",ah:true,uatm:500,ecfc2:true,llrm:1000,lldl:"bS5zZWFycy5jb20=",abf:{"_enableLazyLoading":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2csdWsuY29tLHVzLmNvbSx3ZWIuYXBw",rsm:0,cdh:""}};var m;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)retu

Chrome Cache Entry: 189

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1486), with no line terminators
Category:	downloaded
Size (bytes):	1486
Entropy (8bit):	5.490104535688466
Encrypted:	false
SSDEEP:	24:haHE+F7dH9fNK1unYigKUwgcA9B/TmlBIuCL88qcWX2mwuCLNQEmQJYuCLekQAqr:sF7f1KeYigKrgcA7/TmMEcWX2mwjQEmU
MD5:	BFDCF15CA8DD895481083D213AD1BA21
SHA1:	7F4EEC7F7E9CB548CE855F88F14D28D902C1B082
SHA-256:	07401C1EF62B998371CF987912298954E40503568681BB483C702865491E3A6C
SHA-512:	719B3195445C05CA1901480C03445C9E253A69A73885CC7646C5F08B5CEEFBBEF74DBF191159AA0FCA30CC7A0134F7B5F725A3B64E29CDC0BFD391B9BCB107CF
Malicious:	false
URL:	https://s.spotim.market/sync.html?aid=750078&gdpr=0&gdpr_consent=
Preview:	<!DOCTYPE html><html><head><meta charset="UTF-8"> </head><body><script type="text/javascript">(function(parent){function addPixel(link) {var sc = new Image();sc.src = link;parent.appendChild(sc);};function addIframe(link) {var iframe = document.createElement('iframe');iframe.style.display = "none";iframe.src = link;parent.appendChild(iframe);};addIframe("https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156813&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID%26traffic_source%3Dsnippet%26session%3D14A0FC939D6A6483%26sp%3D750078%26pb%3D612004%26c%3D570607%26a%3D281178%26domain%3Dvisitor.omnitagjs.com");addIframe("https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D644680%26extuid%3D%24UID%26traffic_source%3Dsnippet%26session%3D14A0FC939D6A6483%26sp%3D750078%26pb%3D612004%26c%3D649285%26a%3D644680%26domain%3Dvisitor.omnitagjs.com&gdpr=0&gdpr_consent={gdpr_consent}");addPixel("//rtb.open

Chrome Cache Entry: 190

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2348)
Category:	downloaded
Size (bytes):	6105
Entropy (8bit):	5.437874807472625
Encrypted:	false
SSDEEP:	96:5NcjRhp0zrAPKI1xtOXVy6s9R4Y1CfPDqZaw2PMTBxj6kDxx1vnysfRjUlEYdO6s:5NcjR30zK3ws6s9R4YAfPDhNETflDBy2
MD5:	8E62FBC0AD68AF20BD820DED5B8DE62A
SHA1:	7EB712F30E1355CF59F28033C3F513EE0B5C8981
SHA-256:	367E9BA17BEE1E676E15D01DAA52D8FEC079988777F11440D25CF1710ECDA7EB
SHA-512:	9F3F76B22EC6C27AF29821A8DF0AE0009E63803E95EFF99D9A4E1047FD89A426899B147ACA03C1DBB18CDC529F3E74A31C1AE0B9E77F76E17CFFCD2064EB4827
Malicious:	false
URL:	https://securepubads.g.doubleclick.net/pagead/js/car.js
Preview:	/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 ./ .var f=this\|\|self,h=function(a,c){function b(){}b.prototype=c.prototype;a.D=c.prototype;a.prototype=new b;a.prototype.constructor=a;a.C=function(d,e,g){for(var y=Array(arguments.length-2),l=2;l<arguments.length;l++)y[l-2]=arguments[l];return c.prototype[e].apply(d,y)}},k=function(a){return a};/ . . SPDX-License-Identifier: Apache-2.0 .*/ .function m(a){return Object.isFrozen(a)&&Object.isFrozen(a.raw)}function n(a){return-1===a.toString().indexOf("`")}const p=n(a=>a``)\|\|n(a=>a`\0`)\|\|n(a=>a`\n`)\|\|n(a=>a`\u0000`),q=m``&&m`\0`&&m`\n`&&m`\u0000`;function r(a,c){if(Error.captureStackTrace)Error.captureStackTrace(this,r);else{const b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a));void 0!==c&&(this.cause=c)}h(r,Error);r.prototype.name="CustomError";function t(a,c){a=a.split("%s");let b="";const d=a.length-1;for(let e=0;e<d;e++)b+=a[e]+(e<c.length?c[e]:"%s");r.call(this,b+a[d])}h(t,r);t.protot

Chrome Cache Entry: 191

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	1596
Entropy (8bit):	7.889824203219796
Encrypted:	false
SSDEEP:	24:EZK+U6/cskh89t1Xpk3+3/rZRhPlh4QL9mKEqJ8ZxqKjs416JGCkXzrezTv/OyP0:GEsjs3+PZPL4a99u7RQ416ICkXuzUyut
MD5:	586D0A208548FEA97903102C16246848
SHA1:	061CE8BA7DBECCCB248D4541A39D7DB52F5D0F70
SHA-256:	04DB713A500BA4C8B85CF37C2D6872C12729AE058019630B5166D006EE2C29B9
SHA-512:	1130BBC3FD60D4E557A237D3AA39AF0FADCB0CAB66AC9F7BF35A1D311F5AA5DEDF2FC5C54B21B6D541B034F50E17AAECCBE2ED9FEB37D643A6F2816B60A022D6
Malicious:	false
Preview:	RIFF4...WEBPVP8 (...p!...*p.p.>.N.L.#.",sl....l;\|.. ...W.......>.v<.:6.....b.O.U.%.7.Y_..J..fi.......S....=.....W.-.E2.5....8..t..S..Z...Jj..Y..@....}f;.+}#.vI.]).........!.]..(X..lu($w.-....{. .X..zp........&.G\.....&.n.\.g$.2......T..)&...:}.R .8.y.Y.!U.\|...l..m..%.>.E...g...H7.......7...d..s.i...R.,...%.....)Fw.N.dz..L.9.3..\x.].h.....fu.....\..vM...<..jM&.i...F......4..../..n4.\|...&.$<.&...O.h.,a....S~...../..T:l.t....B.../..o...P.....U8s......`...4..M..I......G..'.^....C..4.A......2...A..e.kN......t.eG.f..%.0..i.LP......pe?.vJ2.?[g.....$f......+..Xd.p.C.jR....j7`5H.t_.!..Z.K.v7.X.;...J@..K..u.^1>.Y.\|..JY.#..h....^......M..tW&....6...F..y.-x.Mz..S..%c.....dB8.. .+i^...f".....v.../....o...&I..&...;Eh#.0jKA/.?.....K...4..;.b.cLk.....=P"}+$........6.2D. ...m....BZb.^2.rYzs.U.Z.[.p..P^.u..K.r..boTtC...'X..`s..q.>.z.P...I.o.1...9+Tr+.`6.mh..S.B....S./...\.Me.-..-"2..#........J...C3)Y.h/.Gd..Yi.5fL....F]...b....../...X?...q.P"ycT..j

Chrome Cache Entry: 192

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	2116
Entropy (8bit):	7.911979637767656
Encrypted:	false
SSDEEP:	48:M7lQglFnzN8rFUCPqi67v2RKMRhrzCc4IbB8HI8X8I:MhjlFJuCiPK6Icb6bH
MD5:	8507E6E841B838DB669FD465275DA20B
SHA1:	972E3714D4E543877F3019E602226768A8427CCF
SHA-256:	921C98029D132A4A23CAA6995174E0BA48EF62BE1D9817FA58D34240FE2D1724
SHA-512:	9A07C8231387DDB8C19A0410288F4F61008DB49C80079CDFC368F02BDC1EAC5FB6487008DD5691B62B6CA817FAD5A9884F0679F6B0C028FEBA988F751FB1B007
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/5b51fca4-9b24-11e6-8db8-00163ec9f5fa/2230710921/granola-logo.png
Preview:	RIFF<...WEBPVP8 0....&...p.p.>U&.E..!....8.D..<x.(bE6..h<.n.~.u.z.t...~..D/?....r.w.y../........?......O<.......=@.k.'.O...v.z......?.}.?7...\...w.......9...C...O....e..vk:.B....Y..r....b.T .......e..f.W.}/...F.0..c1.II;.W..f...NrQ../;.[.yG.......r..I.........3...Q.\b..,....2z..P'N..v.A.......u.....m.t...s...f.......`..[..b."3..Y0.d....F-4...>.pC=2.$<..c..ar.Q..........g..N....n-.q...e..$.}]..._.m.M..Z..c.^......E...FK....X.F.q..$Z[.7..(...-..w"..w..;4"C..-..%1D.....>=^.O.w./.8";.9S..(g..3....>..3>..s.[......F.P..;.f.......M.......u.L...h.`2...O.@....+;......J...!.......`.;.H.-"$....s..d.....qx.../...78...3ZL.O...t.i..>..B./.D.....Y....\|c.......]9.=..I.U.l.be...<l....y.-.....r...v\..t.c.\|...o..rX~...{~f..y..\|.iq=.2.VT5...1.....z.9.o.U.jdg..].^....6.~....3?.Cp..N..i....[.?%.....f7.9.AfX...>G.h.....d:....0.Az.A.+.+?P..n.}>l..!.j...a<u...0qDw..4q...`...A..`.5....Sx.gM.Q.0...j..F..I..@.......5TG..`}mj..~...\...W...^%.}PU...=.S).5...h/(.Zm......

Chrome Cache Entry: 193

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:HkiCR:EL
MD5:	27B4023F8C32401724EFF0679EBE5F8A
SHA1:	D7CDF88E200D2F1E3240BFCE80D6E1498E756EC5
SHA-256:	66B256294D78D9B70878D1B1177F937BD4CE543E310DA3105817818AF7101D19
SHA-512:	846E242375C8D914FE6E6E1E6BD9EC25909E5B5892251A53AF60E0334C9F0928836DC3CE185293EEB95210B0A1A2DEF2A795D2290952B47339B95645D3304C5C
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAm7xWDeV_CISxIFDVGRAKs=?alt=proto
Preview:	CgkKBw1RkQCrGgA=

Chrome Cache Entry: 194

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	751
Entropy (8bit):	5.276912741741439
Encrypted:	false
SSDEEP:	12:YparveYGkH0SLbjRGdhQdjutMvpsjRGdJnz/it6Lc1p5Jk:YI6YGkUSLbjRQQAUsjRwnz/itIc5O
MD5:	B27183CD377C2B395B8D7350F7EFF9BD
SHA1:	979A79CC9475B3996D06AE78C29DEFED7866282C
SHA-256:	B94A034A6F36BDF5DF05046DF995495EC32707D6654B1FED9965D63AC3CA07C0
SHA-512:	504FDC32180D7525ECE74E2ED3EAC5F73E33BD28302764B85F49D4EB12E7D967E420A1D565F17340A087372476EC3C95399F2C3EE51CDC204956940E57EC40CC
Malicious:	false
URL:	https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3694862415250323&correlator=3128165725747980&eid=31079783%2C44807747%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&trt=2&iu_parts=5302%2Cdesktop%2Cdesktop-Web-pt%2CApps%2CProgrampage%2CATF_OOP_Wallpaper&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=1x1&ifi=1&sfv=1-0-40&ists=1&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1702977741711&lmt=1702977741&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fcaffeine.softonic.com.br%2F&vis=1&psz=0x0&msz=0x0&fws=128&ohw=0&ga_vid=430166992.1702977739&ga_sid=1702977742&ga_hid=1147585949&ga_fc=true&td=1&topics=9&tps=9&htps=10&a3p=EhsKDGlkNS1zeW5jLmNvbRiIx4iLyDFIAFICCGQ.&nt=1&psd=WzE1LFsyLFtbIi81MzAyL2Rlc2t0b3AvZGVza3RvcC1XZWItcHQvQXBwcy9Qcm9ncmFtcGFnZS9BVEZfT09QX1dhbGxwYXBlciIsW11dXV0sbnVsbCwzXQ..&dlt=1702977735228&idt=6425&prev_scp=pos%3Dtop%26countryCluster%3DA1%26td-slot%3Dtop-wallpaper%26hvi%3Dfalse%26type%3Doop_display_wallpaper&cust_params=medium%3Dorganic%26campaign%3D%26source%3Dnone%26medium_campaign%3Dorganic%26medium_source%3Dorganic-none%26file%3Df46a4db4-96d4-11e6-b215-00163ec9f5fa%26reviewvecna%3Dfalse%26recat%3Dutilities-tools%26hosted%3Dfalse%26compliant%3D1%26devel%3D0%26locale%3Dpt-BR%26author%3DZhornsoftware%26content%3Drich%26country%3DUS%26region%3DA%26platformId%3Dwindows%26ad_session_id%3Dca334998-1875-4288-9025-8f913da6a89a%26pv%3D1%26ab_upr%3D6%26personalized%3D1&adks=968654847&frm=20
Preview:	{"/5302/desktop/desktop-Web-pt/Apps/Programpage/ATF_OOP_Wallpaper":["html",0,0,null,0,0,0,1,0,null,null,null,null,[["ID=9381b8e90d93be2b:T=1702977743:RT=1702977743:S=ALNI_MbU4AAiHXcNsr0W8VN64xuPnRvBpQ",1736673743,"/","softonic.com.br",1],["UID=00000dab025b3630:T=1702977743:RT=1702977743:S=ALNI_Mbse_BVZmeYJmTfBkLbLaJBGm75gQ",1736673743,"/","softonic.com.br",2]],null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CJGK1ruWm4MDFczMKAUd8NkLcQ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qO8iXbnzDRVVo7u4sQJrpC1D1IT4uddeSm3Tnz3lhszdYxFNqn0XLrJRZpC5-MvnHxlftzK_1Suj2OduOrk3XV_jg",null,null,1]}..

Chrome Cache Entry: 195

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (15907), with no line terminators
Category:	downloaded
Size (bytes):	15907
Entropy (8bit):	5.514273213911923
Encrypted:	false
SSDEEP:	384:DnAJ01yJnUyOd1VxkZjhwq9+5yu85w+TINmNPvncM:jAJ00JnLOH4ZjhwDi2+0s9R
MD5:	AE79DB664406C9254F4F32DAF70C93AC
SHA1:	FAE0AE1FCEB99F996F315545F1C75EB04939B20C
SHA-256:	8E53E50181B7A9E2CAA94173C37FCD9DE8FA75750764A2AD8AD02FAC3306D652
SHA-512:	FBD5EC409CE57592EFF6BDFB2DF69C2414A79D84CB9B1BE5B6C5110985A0FF4D192B7D31160D9F14F3E3DBA21628129ECF9BC925597F968AC1CF6DF849346AF6
Malicious:	false
URL:	https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Preview:	<html><body><script type="text/javascript">(function(){var aa=window,p=navigator,aj=aa.top\|\|aa,ak=aa.location.search.substr(1),A=encodeURIComponent,W=decodeURIComponent,aA=aa.parseInt,P=aa.PubMatic\|\|(aa.PubMatic={}),K=0,ad=0,b=0,ap="pubmatic.com",V="ads."+ap,am=1,Q="https://",a=(aa.__cmp?1:0),ao=function(aF){return typeof aF==="function"},av=console.log.bind(console,"PubMatic:"),au=function(aJ,aI){var aG=0,aF=aJ.length,aH=false;for(;aG<aF;aG++){if(aJ[aG]===aI){aH=true;break}}return aH},n=function(aF,aI){var aH=aa.document.createElement("script");aH.type="text/javascript";aH.src=aF;aH.async=true;if(ao(aI)){aH.onload=aH.onreadystatechange=aI}var aG=aa.document.getElementsByTagName("script")[0];aG&&aG.parentNode&&ao(aG.parentNode.appendChild)&&aG.parentNode.appendChild(aH)},ar=function(aH){var aG=aa.document.createElement("iframe");aG.src=aH;aG.style.height="0px";aG.style.width="0px";aG.style.display="none";aG.height=0;aG.width=0;aG.border="0px";aG.hspace="0";aG.vspace="0";aG.marginWidth=

Chrome Cache Entry: 196

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	1054
Entropy (8bit):	5.392740471938003
Encrypted:	false
SSDEEP:	12:kxP52o2s3AbtuWOrHgWD+sUqN3hM/oQfCYKWXUhO+EhwtAoV0oARO+Eiudb0+sUs:k3iVwgWLpNxMnKWk4dwtnJ2uMU8
MD5:	489C2E0D0B7727201E44C2C0F5D7943E
SHA1:	A13A5714A9C91E7FAE927FEBDAB1705BF472EBD9
SHA-256:	A47E33EE8F39ADA070A0139E7DE2ECC4B14C94E4059FFEEED94C5CE75571A18A
SHA-512:	E5A0B95A6E5173601A62D4E3CAE23B6404CC53F51BF7495502F08879C2C65E458DD4E5CFCAF9876EF9E8920512A7953A55A6D9FB45FF54CC5FEDA957E1BE42C9
Malicious:	false
URL:	https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Preview:	<html><head></head><body><img src="//visitor.omnitagjs.com/visitor/sync?uid=9276a8c8d010b77af50144c60047b781&visitor=5184721251378344538&name=SMARTADSERVER&gdpr=0&gdpr_consent=" />.<img src="https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent=" />.<img src="https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fdcm%3Fpid%3Df7a5db36-1d5c-4c26-81b6-b4d0807faffb%26id%3DSMART_USER_ID&gdpr=0&gdpr_consent=" />.<img src="https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DSMART_USER_ID&gdpr=0&gdpr_consent=" />.<img src="https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partner

Chrome Cache Entry: 197

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (40779)
Category:	downloaded
Size (bytes):	442977
Entropy (8bit):	5.596016249464725
Encrypted:	false
SSDEEP:	6144:at7quqg6UrtdZf3HwUy4B37tghA9DfYTV4/mZx:mnFPtbQUyC3W
MD5:	FA88FA0E9DD008839BD8250CB2EEF286
SHA1:	B6BEAADA8C9A291B56E48B64E2F879E86C52D23B
SHA-256:	BFDA91F55750E6DC34F6CABCC4E49E0C21C210D6266242A1ACBEC4364F149C82
SHA-512:	EB8CF7FDD482177CAE4036F497B3916EFA16E6908ED98EC98AD7307F1F9E1A22142FF9230816A02B340C96082376A0CB4617CCD6363076D46FA7993F8EEEBA8E
Malicious:	false
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-5LWWHP
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"666",. . "macros":[{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"didomiGDPRApplies"},{"function":"__e"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"didomiVendorsConsent"},{"function":"__v","vtp_name":"documentPath","vtp_dataLayerVersion":2},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"userId"},{"function":"__v","vtp_name":"platform","vtp_dataLayerVersion":2},{"function":"__v","vtp_name":"newsEditor","vtp_dataLayerVersion":2},{"function":"__v","vtp_name":"pageType","vtp_dataLayerVersion":2},{"function":"__v","vtp_name":"reviewType","vtp_dataLayerVersion":2},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"hasOffer"},{"function":"__v

Chrome Cache Entry: 198

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	2116
Entropy (8bit):	7.913754837353188
Encrypted:	false
SSDEEP:	48:MWuDv8yI6fzTB+RvbxYr7lt7av2n+TExEI3cHZuTJPNy/u:MWGlPfzTQOqvgP3IZEJPNWu
MD5:	0F2F47A40E435E6D0B2832DE1C8871B6
SHA1:	6CE7EE71672607391D54243F9E5F21BDB514A51D
SHA-256:	70F7B1A43EAB885021756F6F4C4359D946D0C3EB843A2F8FCC9BC1A0FA77E17F
SHA-512:	799F4E3E5729E87677ABBE3B70A635A9F5B089501EA1A1EFB7AC2AD76558ACE9C92F8E4E0CCF63C14E39926229A0417F4A6559840A05DF3BB597A2AE28EA633A
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/65f42134-96d1-11e6-87df-00163ed833e7/3526594866/droidcam-Download-DroidCam.jpg
Preview:	RIFF<...WEBPVP8 0...P'...p.p.>U$.E..!.._l8.D..dK.?I.b.............O....l.8.....w.....S.....G...o._.>........!~.{.ye~.\|%~....M..Z...N.ff>.~.....`..M.<A........ES.._..G.........lr..>.....y...,................)4.3D.}..(.A9m4.%SR...r..7........'.<.7.P.G.n0......!T.>v`rt.v...t...2<,..8.g3.....i.P...p<...V<....hX$Y.....a.....kC.${........F...%...J.......+..@....%.nu..R...OM...6.z.....D1x...R.....,%W1+~..=;.....tn.G..X.)...m.%...]..^[[*..."..[..<.b.w.g.o'....Ej.k......jMEt..,.....E.....]..j.VLz./...12.&.<....i.Z..o\|.e>o...)..r...v&..FG....)...2;.Yf.'...zr.....Fd.y'....\|&O@.G.<...w...H.x...NC...1......u.t....D.m...6...3..<..?.w.+e...~E..U:..s.Xn..?...G.p=q._. .rA]..o.{...5;.7....JAuK....=...+{....U..]...lH.u...{O........B........c.NG <a..{CD....g....P...B.;8...Y.a.....-y...c.b.!m.F...J..Y........^.U...D.."..%...t...)........q.........@(X.s...u...EO..lT..{...+n(7HwN....w.tW0.A.5...j..L...h.U.F....x..]...U.N.:..F..$..@[z...._T....f.4..

Chrome Cache Entry: 199

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2577)
Category:	downloaded
Size (bytes):	4715
Entropy (8bit):	5.524237299287097
Encrypted:	false
SSDEEP:	96:OhLAfDLwfWmfN7rfrfd22fQLE2B1yOZoyf2hf9f/lCUybFuuI9j3obFuBi/Wbz:aL8Lq8bLE2B1yZ3ybFuN9LobFuBiObz
MD5:	2E6F576FC6181F068DC926454B85D559
SHA1:	B84A626998ABF013FCE48BE5141675CD52B5DFFF
SHA-256:	4BCDE388C3F95AACF451B59EA8C2137655F860B5F41802FA9C3C8E9A114433D8
SHA-512:	264C9251A808B4723ACE7364DA2614FD9232FB5B34B5A831F7A86C3F73E47563F086614B4CFAA6A5507F6569C4C55A90D93DF8E1A628E061CCE67DE64FF42C11
Malicious:	false
URL:	https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <title>Sync Pixels</title>.</head>.<body>..<script>.. var syncPixels = "https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING} https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING} https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D$UID https://ads.stickyadstv.com/user-matching?id=3679&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING} https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY https://cs.admanmedia.com/73c1e1bfc3bde354d60b80e601ae3914.gif?puid=[UID]&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D164%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%5BUID%5D&gdpr=${GDPR}&gdpr_c

Chrome Cache Entry: 200

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	3004
Entropy (8bit):	7.92324515539755
Encrypted:	false
SSDEEP:	48:MHT8IbBe9ryJgSIxtZRSPZpNKrHAzcLXNbLZjDBGAnHiVAb5kHrI6Ecnww9M:MHQMGfjS6gzuNzG0GO5kH06Ecnww9M
MD5:	E92A0B54174144F64E0E45A4FC6F6A46
SHA1:	41002FFF9724F62196FEABE50B17221BE05B8E07
SHA-256:	8621A0FBE8397EA95082AD858E267B3160B87E2451BE78A0A4068B2C2571E86C
SHA-512:	0221B993985276F28C98EBD350E649A9A3B7D1725D7614588198B3D0E272C9E8158F679B03431766AB4F5DB44F1AD400489A2B0AEAED39C31EB8308537B7EA13
Malicious:	false
Preview:	RIFF....WEBPVP8L..../o...?...$E..e2.3..`.6..9...d\|.a.6......&3=......q.cZ..l.2#G'....~........)I..............P^l......3...c$........BB..m.m$....!...@...1..@s_.3...%[.r.!E..........\|...n..............B.d....]......d.i..VQ...y;.....H{B....i.y..L........!..J)........8%8.y...m.:..Lz.,Y...!...0-..2>...c......3..4...g....s....=........9=>.$V.9.....L.3...5q..~)...o'.C.".......72.....r.......S....<.8".Zb.....Ou.p...+n.......5..I..z.>.Cj9.{.[..Y[.)....!.j..\|....s.V.D..8...v.0k.../.RV.%r..d.:-...+\|.R..%.O.%...B\|..H]....."gG..s....*...d+..........H..D.oP...u./,s..9.#...y........G.S{.{.;..N.G.F....(.i.j ....[uQ..9.C.....<....~t..H4ka............0...v..F\|...).E..{T.6GC.\|4.:.....3......cn.W.H.\|v.a.h...@.\|6.k.+..I..Q?dW".. ..G..U.....6.....=.n+.RizIr......sK.E..T+]Of....h9.Iy.>..`.... (L.\|...U#.i.I...........'......{.}.!..X..m.x..Z`h.D.mh~...]......6.,......V...K..x...D_./47../..J.x..n&.....$.{.bj.E$.\2....#..3S..C...57S.1.O6.Z...Sl{.k....6...bB.. .(...9...L..

Chrome Cache Entry: 201

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (711), with no line terminators
Category:	downloaded
Size (bytes):	711
Entropy (8bit):	5.563814934215437
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4A1ZHh8ZAKRL7+0YT68rTiUMGT2IWSBW5BdBa2W2KD:hMiRO9AFs0+n8G9xMpyl
MD5:	07A394B2728063193C665CBCF601C5F5
SHA1:	12686A9C8C3B88549B16A7A3A56D5D86218F60B1
SHA-256:	BD3230C53D09D63D9A86CF6B4BF932849F2D1EE60BC50BD203D2BE5B0EA5664E
SHA-512:	1E1D6BBD926B1A76EB89BFEE62D11211A0E4B92E7F85B73C7293A383B84238D65474E3B8B67553C05792121CB5AE66D81C25B8371CFE9E68C65B3B0B9EFE1684
Malicious:	false
URL:	https://12325200.fls.doubleclick.net/activityi;dc_pre=CIrI0bmWm4MDFaa60QQdFz4Btw;src=12325200;type=invmedia;cat=softo003;ord=6058147887192;auiddc=133230612.1702977737;ps=1;pcor=1728039348;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><iframe src="https://adservice.google.com/ddm/fls/i/dc_pre=CIrI0bmWm4MDFaa60QQdFz4Btw;src=12325200;type=invmedia;cat=softo003;ord=6058147887192;auiddc=133230612.1702977737;ps=1;pcor=1728039348;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F" width="1" height="1" frameborder="0" style="display:none"></iframe></body></html>

Chrome Cache Entry: 202

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:HkiCR:EL
MD5:	27B4023F8C32401724EFF0679EBE5F8A
SHA1:	D7CDF88E200D2F1E3240BFCE80D6E1498E756EC5
SHA-256:	66B256294D78D9B70878D1B1177F937BD4CE543E310DA3105817818AF7101D19
SHA-512:	846E242375C8D914FE6E6E1E6BD9EC25909E5B5892251A53AF60E0334C9F0928836DC3CE185293EEB95210B0A1A2DEF2A795D2290952B47339B95645D3304C5C
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnFhRSenoPJJRIFDVGRAKs=?alt=proto
Preview:	CgkKBw1RkQCrGgA=

Chrome Cache Entry: 203

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1629
Entropy (8bit):	5.338465464683756
Encrypted:	false
SSDEEP:	24:hY6svD+6zSU6pedQf3Zvcn1BZdAe1nCr1LTHI5z8xDbvxL1US8f:3qD+2+pUAew85zsDbJL1LA
MD5:	8B2690ECF96B153D031D31C75F5C9F5B
SHA1:	91737C987F5EC480BCBD4968566D97757FBBB09C
SHA-256:	22C6358B31973F1F34FD4630A96BAAD42393D23806AFC973D93A8C15973E74F0
SHA-512:	2D3F306F3D12092FFFC3864F7F9ADC304B2C3B20649A09AE4F1DFAF4B47E7468968301E8BC4E1A9ACE825E374226B1795E80E9E99B04C145CD767AE9E98F5E9A
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.

Chrome Cache Entry: 204

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	334075
Entropy (8bit):	5.51253772352316
Encrypted:	false
SSDEEP:	6144:KeP9t1ghNU/fV0KlPy0o+nmanmFBv3bioMctdPdQBFs:z1tWNK0yCPdQw
MD5:	8C05FAF92017F5950C2F6E43CE4C4A84
SHA1:	6FC8DE6F28BC080221747E8C7FC1C8E0C87D3E35
SHA-256:	5D4EE71AE31D3120FE8922A7BA48EFAF28E1721B0BAB117083B7E5CCC0F4284C
SHA-512:	577DF1B9D66E538491C2DDF732B9356DED12935A2E1C4BE1BB2BE78C20C9F91D6DBE66E90682F5C0CE7EE382ACF81928DBBCA176267C6C99C020471919B5E71B
Malicious:	false
Preview:	(()=>{"use strict";var e,t={2131:e=>{function t(e){return(t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}e.exports=function(){for(var e,r,n="__tcfapiLocator",o=[],i=window,s=i;s;){try{if(s.frames[n]){e=s;break}}catch(e){}if(s===i.top)break;s=i.parent}e\|\|(function e(){var t=i.document,r=!!i.frames[n];if(!r)if(t.body){var o=t.createElement("iframe");o.style.cssText="display:none",o.name=n,t.body.appendChild(o)}else setTimeout(e,5);return!r}(),i.__tcfapi=function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];if(!t.length)return o;"setGdprApplies"===t[0]?t.length>3&&2===parseInt(t[1],10)&&"boolean"==typeof t[3]&&(r=t[3],"function"==typeof t[2]&&t[2]("set",!0)):"ping"===t[0]?"function"==typeof t[2]&&t[2]({gdprApplies:r,cmpLoaded:!1,cmpStatus:"stub"}):o.push(t)},i.addEventListener("message",(function(e){va

Chrome Cache Entry: 205

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6482), with no line terminators
Category:	downloaded
Size (bytes):	6482
Entropy (8bit):	5.386219794662181
Encrypted:	false
SSDEEP:	192:UaveH+XTFLLgXxQRCJS3ZE1m1j/YMvKTP+pmY2/:UdqTFPKt16EMiY2/
MD5:	A4D296427FC806B21335359E398C025C
SHA1:	46928CCD1407B4E55192BB9D0A07DCFEBD9687B7
SHA-256:	06B99248A163333E36980A6CFB756F1A7DE60FA49517162B87B1A44D5D48F844
SHA-512:	4C0326040E2C7837FA78185CC5A185EA43697DD4F3591757F84BDA76BAC746BADFBE047DAC2C1DC677561FD6CC6C5D5B4BEBB7D671CB82AB04E070DA766FE6AF
Malicious:	false
URL:	https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Preview:	var amzn_aps_csm=amzn_aps_csm\|\|{};amzn_aps_csm.errors=[],amzn_aps_csm.reportErrors=function(a){var b,c;for(/^https?:\/\//.test(a)===!1&&(a=document.location.protocol+"//"+a),"/"!==a.substr(a.length-1)&&(a+="/"),b=0;b<amzn_aps_csm.errors.length;b++)c='{"adViewability":[{"error": {"m": "'+amzn_aps_csm.errors[b]+'"}}], "c": "aps_communicator", "api": "RTB", "error": 1}',"https:"===document.location.protocol&&/^http:\/\//.test(a)===!0&&(a=a.replace("http://","https://")),(new Image).src=a+c+"?cb="+Math.round(1e7*Math.random());amzn_aps_csm.errors=[]},function(a){function b(a){return a?a.replace(/^\s+\|\s+$/g,""):a}function c(a){if(a&&a.s){var b,c=a.s.length>0?a.s[0]:"",d=a.s.length>1?a.s[1]:"";c&&(b=c.match(j)),b&&3===b.length\|\|!d\|\|(b=d.match(i)),b&&3===b.length&&(a.f=b[1],a.l=b[2])}}function d(a,d){if(d=d\|\|{},!a)return{};a.m&&a.m.message&&(a=a.m);var i,j,k,l,m,n={m:e(a,d),c:a.c?""+a.c:a.c,s:[],l:a.l\|\|a.line\|\|a.lineno\|\|a.lineNumber,name:a.name,type:a.type},o=0,p=0;if(i=a.stack\|\|(a.err?a.err

Chrome Cache Entry: 206

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	3810
Entropy (8bit):	7.948178133872469
Encrypted:	false
SSDEEP:	96:56f5kJbDof64uHVQL8aC78yrP1pjlLbLDnNbxCvU7:Uf5kJbES4U3786rvF
MD5:	B657596FD69CC3619301C799AC8E70B4
SHA1:	9F316C450D24AE72F88246657E7C4CBB00EBC128
SHA-256:	791FE7CC0B0AB00233E7BA3F98403FA05EA62540746165287B4F82171BC46FFC
SHA-512:	C783FE2BC00A996DB492936E2034DAE6BEC6A8D99808C8F0BE48D2A9BE9E88B3EE12C6D4BAD98EFD9381E90F44A1C52A5CB883E470C7AAC980A7DB65E1DE59A9
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-m/p/b6f35774-96bf-11e6-968c-00163ec9f5fa/1227406/daemon-tools-lite-logo.png
Preview:	RIFF....WEBPVP8L..../..7....m......l(n#...;...'..a..3.......2.O.....B..9.."...l.n.&.Dy.8......:......j.....I['......z.q>.t.R+@...._8c...y...........F.R_^{s.S.`..._...Uj..<O...n...`..(..u5Z..S..H...>...\|.....s. ..=.pe....._.....5..O.J..w.i.EvNk..T.....JrFt.b.w?..2bT.5.?ZJ..oR].o.5Uak.....o..mP8..1..W...rEo?.q...W.5.!.q].......)..\i.r..=O.][N....sm...^.H....8.V......#JtRx..3..w(/.\|...I..bRm...h8.O4..G..^4.1/..<....-.Q.!..<.p..Q1.W&.x.Z.....&..d.}U.\.9b...:..Z..nS.U.7R.7.z4P.(..G...j.E..G.[...._B...r...Iwn.....d.J}...I....B...F)~B?h...R..`cnlA.B2d..h..L2#<b.e/9!...n'.(.......u..+.....<<.itB.24d.Dg.M.4....r....T..{d.\|.y.......guF.f.<X.k..:..L..t....wQ@...).(+8Z.(/Y.O.?.O@.e1o....!....N.^..........K.C8.[..z.;SN...m.C.^..t.._!)5!{.6K..^/... .Z"E...@....E$]......x.p.@.7..>...\|/0.7.. ..B......lr...1oP.._RfB...yr..P.+@.tk._7..&.l.Q.ySgD.2..qE............}...m..EE..d.&drd<...Dk./8.....R.$..L.. 7...w..\|).......[.,....c.iI....r.}.d....(.j..g.&b.#EK.5

Chrome Cache Entry: 207

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.735378981631706
Encrypted:	false
SSDEEP:	3:xW8QHLGKwLHLWvHLGKwLTyTFWSJwXoJIRCtCWWyBBdv64RNU64S0SHy4JsJY:xILGKwILGKw0bJw4WwcR8HTuJY
MD5:	04348EB1B25DB3E4B17F264081BF5C5D
SHA1:	FDDF60804C6EC72387C4020C37574853AE933026
SHA-256:	AAFDFEF9EC7B5C36C0DFF6F8550AC1B0B790A7E3FD487960B9CA394054E114BF
SHA-512:	1F5ED8F6015B76DE85946F97A74ECF3D3BA8ACC539636227AA23C8532F69B39D1FDAE3A152E2C884CDDDD4ADDCDB875100A0D123336B0EE9C01337DE8952894F
Malicious:	false
Preview:	[["softonic.com.br",null,"www.softonic.com.br",null,null,["52555387","5302"]],[],[],[31079525],null,[["5302",[["id5-sync.com","https://cdn.id5-sync.com/api/1.0/esp.js"]]]],null,[]]

Chrome Cache Entry: 208

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 24.1 (Macintosh), datetime=2023:09:28 09:08:15], progressive, precision 8, 300x600, components 3
Category:	downloaded
Size (bytes):	63909
Entropy (8bit):	7.7554777108692665
Encrypted:	false
SSDEEP:	1536:09adJ9adANxeVbNZkkrBm0j0DXpRPyqziTILr:Ds4xeVpWkrJgl/ziTSr
MD5:	C610514E5756020CFB3C727B77B2C83E
SHA1:	4083CC96DB7AF4DEAC95B32329BAA78B7A584F49
SHA-256:	0148F8F91E2EF35D38BA66C9E01F3DEEAB27BFEDCDDC77CD782908C401AC9CA8
SHA-512:	039625607B59612A9EEFA3BD00A07BE62CB531AA201D1413DA190ECC9FF33E35A8C7A4D095615DC3D08856DE1C0FF6C4E080BEE8B7CA53174F78D349A2FC6572
Malicious:	false
URL:	https://tpc.googlesyndication.com/simgad/4458307077342190409
Preview:	.....UExif..MM..............................b...........j.(...........1.....!...r.2...........i....................'.......'.Adobe Photoshop 24.1 (Macintosh).2023:09:28 09:08:15...........................,...........X..............................."............(.....................2...................H.......H..........Adobe_CM......Adobe.d...................................................................................................................................................P.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..T.X.X....:..}\|.D.@;a..]s..M...?3.'.%!.d.d.&i.x.e9l.....R...V....<SY............U..j....8.u.....[w:.e....8.....).....M........^Nx..2pi?j\~....$.Ok)$.

Chrome Cache Entry: 209

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.498939573903908
Encrypted:	false
SSDEEP:	3:YJH/PTLHl2r4n:YJ/rZl
MD5:	766DD3A980C8E609AE87CA07B65F3A6E
SHA1:	39635322B78E14EE7BA3AE6BE8240120CE26C87E
SHA-256:	788026E09A66C3D605588B6D9AEE88BA60F7824325EA1C14E8E89077DEA4177F
SHA-512:	D641444E1AAF09478613F4EB2E72F24EE7FF9DACABF1EC5DCF1B556A9E9FF7A84E22B6503AC89440223A4A62F9336DB844B96F73A72CB59295631601ADC807E8
Malicious:	false
Preview:	{"lb":"+evDpv7XuNTdiAMNOs6ibQ=="}

Chrome Cache Entry: 210

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssvqDaOJT50i-OS_q9-Ar35EFcW75Nuh-UDIMLfbmvfg9Dd0MAfaiX6EG0yyp8OpJ8qhZilsprFma98juivR-UbbBeQQHsRCxOZlZlyoVOev_b-yZIBmd7JY4UNteKvsMm91WEzwR0jUvJjq0fmKbex8_R-Ao4&sig=Cg0ArKJSzGcVHqjwhWUrEAE&id=lidar2&mcvt=1014&p=133,146,383,1116&mtos=1014,1014,1014,1014,1014&tos=1014,0,0,0,0&v=20231213&bin=7&avms=nio&bs=1263,907&mc=1&vu=1&app=0&itpl=3&adk=1886130427&rs=4&la=1&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&vs=4&r=v&rst=1702977743999&rpt=2232&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0"
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 211

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
Category:	downloaded
Size (bytes):	15744
Entropy (8bit):	7.986588355476176
Encrypted:	false
SSDEEP:	384:z1TLklSElcS5V6qQTMUP07JwirW6RlLwK79/:p7EJ5E2bJwi5jLwK79/
MD5:	15D9F621C3BD1599F0169DCF0BD5E63E
SHA1:	7CA9C5967F3BB8BFFEAB24B639B49C1E7D03FA52
SHA-256:	F6734F8177112C0839B961F96D813FCB189D81B60E96C33278C1983B6F419615
SHA-512:	D35A47162FC160CD5F806C3BB7FEB50EC96FDFC81753660EAD22EF33F89BE6B1BFD63D1135F6B479D35C2E9D30F2360FFC8819EFCA672270E230635BCB206C82
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......=........t..=..........................d..d..^.`.. .T..<.....\|..{........6.$.... ..t. ..I.3.%.....8..&....4Z.\|t .8.........D...$.uNE.P.E.Ak...=.x.9Xz.`.I..R....#F+B`..}.RP\|E...Z\.W[.............C...QB....m...cm.?.F.g.......Q....3......p...L2.[......!+@U..^~.......D.?.......j...U...c..U.l.6{...m.CD].h.t.....Q8.....@P...L.c.....+...ZD..2.K...:..4{g..:..~....v......<..H^.R.'....8....?.;...uy.VW..8=.".F..*.....@E....c....=..Ib.....y8$.a){.......KiIW.&..~.}..1..w.M..{.4......!..{..F.H.5#K...t..5.w...ve;. '......NJ......'(%;...?...D...M.Cq,<.=?.f......._...V..bA.(..37..v....+.uY.C.b.w8AF..3.n.-..'..U%.2....o.l."...^bj..aoF.!`....A....j...'.:Z.u...[..p.GW:U%.Ejq...:I...C........S.C...sJe.6D...<.UM,..&h..z}.y\|..9...D..j...n..B.$..T....?../.Q..=B...C._.f.#.:Bo.@]T.(..v..F..+d...". ......R..R..R....!..~A....X............>!`p..,08. 9.../.....r..Q.......Qpg.\ko...C..3..Y.y..t'.d9..>#\|..3..?.#..$....i........g5.z....S....{3..Sp..S2..w.6........

Chrome Cache Entry: 212

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3385)
Category:	downloaded
Size (bytes):	208279
Entropy (8bit):	5.398431757224146
Encrypted:	false
SSDEEP:	3072:cY28k3G/4uD/KIUrm1r/rsr6LnsmmEC5NvIM+vYexeRpBC:52ZluDKOD66ommEoIM+vYexeRpA
MD5:	687F36959D3133324C89C89FA708B3DA
SHA1:	D95EECEF21AC59FF2D9359D452394EBFDBCD8181
SHA-256:	566012676F5D43ACFEA4DC0BC5D9BB2C0805D8775FCDD081B1C895310956829A
SHA-512:	CD732600D7F757FD7D031C035DB9445B2564936A79C1D8AD7B481FC295989C7D2C10BFC0C0CEC53656C99CE5479A76D5F231DDF2322C9AE2496611FC287B4F5A
Malicious:	false
URL:	https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Preview:	(function(){var n,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");},da=.ca(this),p=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.p("Symbol",function(a){if(a)return a;var b=function(f,g){this.Ng=f;ba(this,"description",{configurable:!0,writable:!0,value:g})};b.prototype.toString=function(){return this.Ng};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function(f){if(this instanceof e

Chrome Cache Entry: 213

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 1-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	95
Entropy (8bit):	4.347811435468635
Encrypted:	false
SSDEEP:	3:yionv//thPlE+kSI+Dtmy/Y+sR3Qhl/Y3WlED//jp:6v/lhPfkCDtmywFghu3WlEDTp
MD5:	71A50DBBA44C78128B221B7DF7BB51F1
SHA1:	0EC63B140374BA704A58FA0C743CB357683313DD
SHA-256:	3EB10792D1F0C7E07E7248273540F1952D9A5A2996F4B5DF70AB026CD9F05517
SHA-512:	6AD523F5B65487369D305613366B9F68DCDEEE225291766E3B25FAF45439CA069F614030C08CA54C714FDBF7A944FAC489B1515A8BF9E0D3191E1BCBBFE6A9DF
Malicious:	false
URL:	https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AACk507LAsIAABM7-sg6gA&gdpr=0
Preview:	.PNG........IHDR.............%.V.....PLTE....z=.....tRNS.@..f....IDAT..c`.......!.3....IEND.B`.

Chrome Cache Entry: 214

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1132
Entropy (8bit):	7.788035787250117
Encrypted:	false
SSDEEP:	24:uYZaOrH7g1q2QAsMF6Az/0JBZrgXsEEpa9NJM9auR7:pprH01hscV/yBZMaa9v4HR7
MD5:	B72D387806EFDED87CA5235A747204AA
SHA1:	9E3520E6997E6EBF7B5EB5EF4196B002BB865CB2
SHA-256:	62B78FBEAAC879A591FB7563CE48AEF32F7E8C4C38CCE05BC8D9EEDC8BED7697
SHA-512:	B74CF0A002ABA1E70E7194A40441C9B30DA003E8FFF55A92193007D6BB47E755E21103355FB6B627D5A6BBF8C619ED3A46DFBC4C59CF58FD5BFE083B5E2CED8F
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/0ef0ab2d-eea0-4e45-9e58-6e88dd0d25cb/455719081/hp-pavilion-dv6-3250us-entertainment-notebook-pc-drivers-logo.png
Preview:	RIFFd...WEBPVP8LX.../o......m..?......A..v..@...............,.l.....`.d..I.$..D(.h.....@VV.=...%[..n...rB._p..m..Z...p..rc.....mp.K...uV..Y.T.z.V..Q...o_...3..U...G....<K....~to..e...f.~gqI5?.d.X...\|.%W.U>uX.ik}.4.Wx..(.....Hd..u..SY,Q7..+?..JS.4..<..C...3.0..oBB.3C.W._....~.^Q.Z....f(.".@......!....i.C5.q....0TG.m."...J..[.2TKI4..P.1. ...S!...f^..Ya. .....P.z8.D.....@...j!..gy..W.. \3..........Te$..w...D..!J.c.a...L.h..rt}~]....o.9...H.X..I....Q:z.....wX.n,.C....P....2..O.....9....f....Z.....a?....e...:..h.....$b.y..^.<.P..0.d.!..Z...f>...o.\|..v.-f>......ChO...].2..89.W.0.B..'...6}......D.k?....<..)p.....<.<....'.bK....j..'...CA.....3....!.&09.......L.P.'<.'..l.eh.0.8.`..%..-g..E".5.P..G........m.B..d.u.C..!..\|0..w.....P4.e....M3.[...Q..#..f(........$...8...7......:2.EJQb...A....Tr#.uQz...9.'K.^...+.....#..r..o..Od..!.'..Vv.x...0..rT....Y.{e...%.K.q..K3V..h+.s...!.q.H..!.Su.T...ip..u.Rn...:Q,}..\X.....v+..V...:`,2t...@.Ig...Ja..!.

Chrome Cache Entry: 215

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	2922
Entropy (8bit):	5.401474327950891
Encrypted:	false
SSDEEP:	48:kHbLzTTfmzWGO5bBRGOox1GOGU9dNbFGOh/gr51jGO+o26nTBGOUj5MueOSy9DO7:IzHepEBYbxkhYDb0SbSMxUDyPFveH
MD5:	17E1E0EC9F4ED2C0DB792BD24339DC5E
SHA1:	C4369C60752618A9A6EFEA9C6CA1DC97594A5EBC
SHA-256:	70FE31112B021E5BCE8F43B73EAB4E46113E92DD5C1D192864305A3365C0CEA1
SHA-512:	009DF3E40B9F38CE9DFB3E3AD432B7B66CFC9D5EEAD3E4EE2B9E1BDCBB0A5F11D7E17F9506EF19FB5A186E7DABE558EA97FD04898BF3F42A59B63A0B14FFD33C
Malicious:	false
URL:	https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Preview:	<html><head><title></title></head><body>.<img src="https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID" style="display:none;"/>.<img src="https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a&gdpr=0&gdpr_consent=&us_privacy=" style="display:none;"/>.<iframe src="https://c1.adform.net/serving/cookie/match?party=1301&gdpr=0&gdpr_consent=" style="display:none;"></iframe>.<img src="https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D" style="display:none;"/>.<img src="https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=" style="display:none;"/>.<iframe src="https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9jMmQyYjkzMy1mYzViLTRiMTUtYTgyZi1mNjk2NjBiY2FjN2E=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv" style="display:none;"><

Chrome Cache Entry: 216

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	281
Entropy (8bit):	5.233913935506896
Encrypted:	false
SSDEEP:	6:hn8FQiowadCc4svmzsLEwK4LzLcIjEdxvAqJmW/upLV4HX4QL:hnMQbwuO4L994xYqJmWeV4IQL
MD5:	66D1BB3159B83CB2BE9ED066165E4C38
SHA1:	FF0D58E13E55067882F7BFFED31A1D8970FD6401
SHA-256:	3FDF2EE487005F6505D00CC9D7A3757A1942D56BCAEA69929CBD5BA110494390
SHA-512:	F55E4F9C1CEA37771D93B79F5B50295C0D25B93E7E41DBCECAD0795A96673793723A2A08DCFE5023972C5EF047FBB5FC11F4F3AB88F1018C14990590DF187B31
Malicious:	false
URL:	https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">. Copyright the Rubicon Project 2020 -->.<html>.<head>. <title>User-Sync</title>.</head>.<body>. <script type="text/javascript" src="usync.js"></script>.</body>.</html>.

Chrome Cache Entry: 217

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.5257351171929923
Encrypted:	false
SSDEEP:	3:CUEIHh/:i4/
MD5:	13E1C7A2184E36D7AE519E99B1AA226F
SHA1:	355CCAD4EAC39838E1CC76FD0B670FD2EA1E5AA3
SHA-256:	48A33CA9F42B91902D57AD8AC52E1CE32B92C8C10C732F2DBB6FE960EBFD9438
SHA-512:	B1A6CFA7B21DBB0B281D241AF609F3BA7F3A63E5668095BBA912BF7CFD7F0320BAF7C3B0BFABD0F8609448F39902BAEB145BA7A2D8177FE22A6FCEA03DD29BE1
Malicious:	false
URL:	https://pr-bh.ybp.yahoo.com/sync/pubmatic/5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F?gdpr=0&gdpr_consent=
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 218

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.788035787250117
Encrypted:	false
SSDEEP:	24:uYZaOrH7g1q2QAsMF6Az/0JBZrgXsEEpa9NJM9auR7:pprH01hscV/yBZMaa9v4HR7
MD5:	B72D387806EFDED87CA5235A747204AA
SHA1:	9E3520E6997E6EBF7B5EB5EF4196B002BB865CB2
SHA-256:	62B78FBEAAC879A591FB7563CE48AEF32F7E8C4C38CCE05BC8D9EEDC8BED7697
SHA-512:	B74CF0A002ABA1E70E7194A40441C9B30DA003E8FFF55A92193007D6BB47E755E21103355FB6B627D5A6BBF8C619ED3A46DFBC4C59CF58FD5BFE083B5E2CED8F
Malicious:	false
Preview:	RIFFd...WEBPVP8LX.../o......m..?......A..v..@...............,.l.....`.d..I.$..D(.h.....@VV.=...%[..n...rB._p..m..Z...p..rc.....mp.K...uV..Y.T.z.V..Q...o_...3..U...G....<K....~to..e...f.~gqI5?.d.X...\|.%W.U>uX.ik}.4.Wx..(.....Hd..u..SY,Q7..+?..JS.4..<..C...3.0..oBB.3C.W._....~.^Q.Z....f(.".@......!....i.C5.q....0TG.m."...J..[.2TKI4..P.1. ...S!...f^..Ya. .....P.z8.D.....@...j!..gy..W.. \3..........Te$..w...D..!J.c.a...L.h..rt}~]....o.9...H.X..I....Q:z.....wX.n,.C....P....2..O.....9....f....Z.....a?....e...:..h.....$b.y..^.<.P..0.d.!..Z...f>...o.\|..v.-f>......ChO...].2..89.W.0.B..'...6}......D.k?....<..)p.....<.<....'.bK....j..'...CA.....3....!.&09.......L.P.'<.'..l.eh.0.8.`..%..-g..E".5.P..G........m.B..d.u.C..!..\|0..w.....P4.e....M3.[...Q..#..f(........$...8...7......:2.EJQb...A....Tr#.uQz...9.'K.^...+.....#..r..o..Od..!.'..Vv.x...0..rT....Y.{e...%.K.q..K3V..h+.s...!.q.H..!.Su.T...ip..u.Rn...:Q,}..\X.....v+..V...:`,2t...@.Ig...Ja..!.

Chrome Cache Entry: 219

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65439)
Category:	downloaded
Size (bytes):	288259
Entropy (8bit):	5.289818306224287
Encrypted:	false
SSDEEP:	6144:eXDwSQSKu4DbPQ0ZE9BNyRtVdZ3YhjFBx:eXDPQSKu4DbPTEXNWtVqjFD
MD5:	BAB82E5D8801F394C1EF53A45DC29542
SHA1:	9815BBF108083A53D855AD8B0E5B9AD78168CBDE
SHA-256:	99C6EB6C3F17D69837D604201AC0453A5677EEF91484AEE37E72DFF818DDADBC
SHA-512:	2FBD65887F31BF992DCE4D427CA9C36EF807A3511FC8E0C8256C7B3D811733DC97DFC2B93DC8BCF4F1442E2C258CB120AC71DF45A4F999DC37B1F0286978C8C8
Malicious:	false
URL:	https://c.amazon-adsystem.com/aax2/apstag.js
Preview:	/! @amzn/apswebapstaglibrary - web-client-bundle - v23.1211.1645 - 2023-12-11 16:45:49 /.!function(){"use strict";var t=function(e,n){return t=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&(t[n]=e[n])},t(e,n)};var e,n,o,r,i=function(){return i=Object.assign\|\|function(t){for(var e,n=1,o=arguments.length;n<o;n++)for(var r in e=arguments[n])Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r]);return t},i.apply(this,arguments)};function a(t,e,n,o){var r,i=arguments.length,a=i<3?e:null===o?o=Object.getOwnPropertyDescriptor(e,n):o;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)a=Reflect.decorate(t,e,n,o);else for(var u=t.length-1;u>=0;u--)(r=t[u])&&(a=(i<3?r(a):i>3?r(e,n,a):r(e,n))\|\|a);return i>3&&a&&Object.defineProperty(e,n,a),a}function u(t,e,n,o){return new(n\|\|(n=Promise))((function(r,i){function a(t){try{c(o.next(t))}catch(t){i(t)}}function u(t){try{c(o.th

Chrome Cache Entry: 220

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2202), with no line terminators
Category:	downloaded
Size (bytes):	2202
Entropy (8bit):	5.840940269720164
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08c/7szSZ6ib6:wsbSUtJfxrqLWWWdV6j1I/t2
MD5:	2E5B4E4B423209C0954CC527D5414EE0
SHA1:	F38308A7777AEB5C11EB2518D548017313D20451
SHA-256:	0C1BA51F4A8B6E5CC835B54070925C91ADEEDC4D864FB5B4489F0D9E201A134C
SHA-512:	71D0D2B3F0A75C55E33A99A663E8030052BF35423170D25BC20A363E1C36A51F03F08AFC1F7B92D14211A2E84EEB6ED27A32D228D83BD42098CF749D4A9F2048
Malicious:	false
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/631321069/?random=1702977738859&cv=11&fst=1702977738859&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma=0&tcfd=10000&u_w=1280&u_h=1024&url=https%3A%2F%2Fcaffeine.softonic.com.br%2F&hn=www.googleadservices.com&frm=0&tiba=Caffeine%20-%20Download&us_privacy=1---&auid=133230612.1702977737&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 221

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1132
Entropy (8bit):	7.788035787250117
Encrypted:	false
SSDEEP:	24:uYZaOrH7g1q2QAsMF6Az/0JBZrgXsEEpa9NJM9auR7:pprH01hscV/yBZMaa9v4HR7
MD5:	B72D387806EFDED87CA5235A747204AA
SHA1:	9E3520E6997E6EBF7B5EB5EF4196B002BB865CB2
SHA-256:	62B78FBEAAC879A591FB7563CE48AEF32F7E8C4C38CCE05BC8D9EEDC8BED7697
SHA-512:	B74CF0A002ABA1E70E7194A40441C9B30DA003E8FFF55A92193007D6BB47E755E21103355FB6B627D5A6BBF8C619ED3A46DFBC4C59CF58FD5BFE083B5E2CED8F
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/5a774982-1176-4f31-8739-d907a62a3b75/455719081/hp-deskjet-f4580-printer-drivers-logo.png
Preview:	RIFFd...WEBPVP8LX.../o......m..?......A..v..@...............,.l.....`.d..I.$..D(.h.....@VV.=...%[..n...rB._p..m..Z...p..rc.....mp.K...uV..Y.T.z.V..Q...o_...3..U...G....<K....~to..e...f.~gqI5?.d.X...\|.%W.U>uX.ik}.4.Wx..(.....Hd..u..SY,Q7..+?..JS.4..<..C...3.0..oBB.3C.W._....~.^Q.Z....f(.".@......!....i.C5.q....0TG.m."...J..[.2TKI4..P.1. ...S!...f^..Ya. .....P.z8.D.....@...j!..gy..W.. \3..........Te$..w...D..!J.c.a...L.h..rt}~]....o.9...H.X..I....Q:z.....wX.n,.C....P....2..O.....9....f....Z.....a?....e...:..h.....$b.y..^.<.P..0.d.!..Z...f>...o.\|..v.-f>......ChO...].2..89.W.0.B..'...6}......D.k?....<..)p.....<.<....'.bK....j..'...CA.....3....!.&09.......L.P.'<.'..l.eh.0.8.`..%..-g..E".5.P..G........m.B..d.u.C..!..\|0..w.....P4.e....M3.[...Q..#..f(........$...8...7......:2.EJQb...A....Tr#.uQz...9.'K.^...+.....#..r..o..Od..!.'..Vv.x...0..rT....Y.{e...%.K.q..K3V..h+.s...!.q.H..!.Su.T...ip..u.Rn...:Q,}..\X.....v+..V...:`,2t...@.Ig...Ja..!.

Chrome Cache Entry: 222

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 224x224, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	3562
Entropy (8bit):	7.938235657956623
Encrypted:	false
SSDEEP:	96:bpIQ38OhokakyA8/bfJ0Kk6zOeTWQPZHbTXcF5:bD2kDJ8/mb63W+Xq5
MD5:	2F23AC95F0D046DEAA2084CCE84CE9A4
SHA1:	90CE83FBADC6A2388C620726E7ABCBE744C3AABE
SHA-256:	DC53ADB2F4A270C9BA9BA83F4657BD1E8E8C896EC078DA19FCEE32584E000F52
SHA-512:	054F03072D96A87AFE434D070216CAE0EB041B5F8BC417CAA7A06B778B4693FFD9E44B4239CBA3023AFAAADE5BDBE145B1C324DBB5ACA32BBD408FE2AE7C92DF
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-m/p/b936befe-96bf-11e6-8b76-00163ed833e7/527084236/slimdrivers-icon.png
Preview:	RIFF....WEBPVP8 .....D.......>I .D".!..V.(......]s......\|..WJ...A..........G.?...g...?3.............~.>.~..A...9.3......`?....[.\...y.7.....?..b.......z.p>..i.a?........G.N....~.t.g..=..K.....8..K..\|...H....]...3..s.uWb..!......yW....w...B.6Cd.".v.6.93$..I..J..J.f/.p....h<....$.G{S......I.6.+.R.......'...RY+Gi.}.}..%2..F.....WJj4.E..f\...wf7'KMt..\|.1<.V.C.%.:..`.~{........O.YmPY.."..8...5...K....~...X....\......"...[m;..1..\nR.i}...........ET........G..lk.4.&T.p._l.......J!Mq[.#..M`l.?eT..O.}Bn.l.cQ.......f........u5....1..W..".....`.Z."lSqE..j..........uG.3....oD.IXb..i..+. >..JC_...c\|...e)...(..T..^8..T4\..............U.Z.....m.4.o...VI>~.1.~..)....X..[.+U.}o\|W....;..5S...q.g....ySd.1S..Z.GNd~})W"A.W....5..W.......#7t..ia...P....]...g.v.q&..8..S8 ..f..gH.).&...h...\|Z#1...LJ.... ..8...9%=.M......e-X.a@......7D.1......L.....cV..#..v-.h..(.o..$.B..:......6.o...}..NS.h...\|o...}=.R:0v.fE(Q.y.(....w*)7..1M.K<.d.<...c.>...Gl`&".3.i..J..eE\|...10y..M.#^A.

Chrome Cache Entry: 223

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (15907), with no line terminators
Category:	downloaded
Size (bytes):	15907
Entropy (8bit):	5.514273213911923
Encrypted:	false
SSDEEP:	384:DnAJ01yJnUyOd1VxkZjhwq9+5yu85w+TINmNPvncM:jAJ00JnLOH4ZjhwDi2+0s9R
MD5:	AE79DB664406C9254F4F32DAF70C93AC
SHA1:	FAE0AE1FCEB99F996F315545F1C75EB04939B20C
SHA-256:	8E53E50181B7A9E2CAA94173C37FCD9DE8FA75750764A2AD8AD02FAC3306D652
SHA-512:	FBD5EC409CE57592EFF6BDFB2DF69C2414A79D84CB9B1BE5B6C5110985A0FF4D192B7D31160D9F14F3E3DBA21628129ECF9BC925597F968AC1CF6DF849346AF6
Malicious:	false
URL:	https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159047&gdpr=0&gdpr_consent=&us_privacy=1---
Preview:	<html><body><script type="text/javascript">(function(){var aa=window,p=navigator,aj=aa.top\|\|aa,ak=aa.location.search.substr(1),A=encodeURIComponent,W=decodeURIComponent,aA=aa.parseInt,P=aa.PubMatic\|\|(aa.PubMatic={}),K=0,ad=0,b=0,ap="pubmatic.com",V="ads."+ap,am=1,Q="https://",a=(aa.__cmp?1:0),ao=function(aF){return typeof aF==="function"},av=console.log.bind(console,"PubMatic:"),au=function(aJ,aI){var aG=0,aF=aJ.length,aH=false;for(;aG<aF;aG++){if(aJ[aG]===aI){aH=true;break}}return aH},n=function(aF,aI){var aH=aa.document.createElement("script");aH.type="text/javascript";aH.src=aF;aH.async=true;if(ao(aI)){aH.onload=aH.onreadystatechange=aI}var aG=aa.document.getElementsByTagName("script")[0];aG&&aG.parentNode&&ao(aG.parentNode.appendChild)&&aG.parentNode.appendChild(aH)},ar=function(aH){var aG=aa.document.createElement("iframe");aG.src=aH;aG.style.height="0px";aG.style.width="0px";aG.style.display="none";aG.height=0;aG.width=0;aG.border="0px";aG.hspace="0";aG.vspace="0";aG.marginWidth=

Chrome Cache Entry: 224

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (35280)
Category:	downloaded
Size (bytes):	91532
Entropy (8bit):	5.5876990393122545
Encrypted:	false
SSDEEP:	1536:sqDOoRwKPt0eAWttn5jYkuFuTHuFcSCTma:moRt3nNY5wm6
MD5:	B712FB0342A09E7104FA6F502019E981
SHA1:	CF4F21D11754AAE64040C549EC5F70779AF1DD48
SHA-256:	2E54AAD0C8D77D6C352DA9D1FC3D82D75135017A81D61E4C7F1288DA066DC9F8
SHA-512:	B625ADBB188D2CC0FFA9A442450C6B397DEB680065A9E86DB1B11FBD65EC498F1AA63C52E295D3CE7E110F5B62660A416FBF4C71692CF485A5ABEF6656EB691A
Malicious:	false
URL:	https://securepubads.g.doubleclick.net/tag/js/gpt.js
Preview:	(function(sttc){var window=this;if(window.googletag&&googletag.evalScripts){googletag.evalScripts();}if(window.googletag&&googletag._loaded_)return;var p,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},da=ca(this),ea="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),t={},fa={},u=function(a,b,c){if(!c\|\|null!=a){c=fa[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]}},w=function(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var e=d[0],f;!a&&e in t?f=t:f=da;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))brea

Chrome Cache Entry: 225

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2349), with no line terminators
Category:	downloaded
Size (bytes):	2349
Entropy (8bit):	5.645056903569702
Encrypted:	false
SSDEEP:	48:CYOma53t53dVfTdjN2mAeSspGBliMJOB0edCKAHVTyq:CYja5dJd3N2xkysdCbAq
MD5:	B6032689779FE89F0C67BD09D6CB9394
SHA1:	CDBB8F419BCBD99AD096D11653207065D0B18DA9
SHA-256:	C5A7D4553EC99B5DCCD15F2A76CEBF9B2A23E33AC0F3F611AC121519BED7EA56
SHA-512:	EBC4F46AB92FD353CC496A7FF4FC40A08B5D4EFA5FBBF95B57612A9DF045CB9B28A05C88C145BEF760C9B3B36E2DFFB6D356EA15FFE3F13D4CF14F9220B82CC3
Malicious:	false
URL:	https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=35419668&p=159047&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Preview:	PubMatic.loadAsyncImagePixel('https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://idsync.rlcdn.com/712188.gif?partner_uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F/gdpr=0/gdpr_consent=');PubMatic.loadAsyncImagePixel('https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncIframePixel('https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=');PubMatic.loadAsyncIframePixel('https://cm.adgrx.

Chrome Cache Entry: 226

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	194
Entropy (8bit):	5.144203472842556
Encrypted:	false
SSDEEP:	6:hn8FQiowadCc4svmzw9xUpCX96v6OqPbRm9:hnMQbwuOaxyCkv4A9
MD5:	5EDEA4CDE2C1A9C8E8150DEAF71CE73D
SHA1:	725019DAAF24DED79DCAAC96C897CC4727CC8B35
SHA-256:	05978957C6C8B028F2785DC77271C286BFAC76E30B7BCD7E835C2927FBE897CF
SHA-512:	E55349AB79FEF70C5DF45009E9EA2E4CA57678305A25B3279CFFAD472192654FE86E30B9471313243FB081D7B2C2958E8F888F87C648AAE5FF00E289C69B615E
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/i/dc_pre=CIrI0bmWm4MDFaa60QQdFz4Btw;src=12325200;type=invmedia;cat=softo003;ord=6058147887192;auiddc=133230612.1702977737;ps=1;pcor=1728039348;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"></body></html>

Chrome Cache Entry: 227

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (38726)
Category:	dropped
Size (bytes):	166963
Entropy (8bit):	5.735366912593167
Encrypted:	false
SSDEEP:	1536:UtcFGgKmqYJNxtWAzkqzQ/6iwGAFaAzkqzxWT51tcDNRQYzT0J47X8nIAzkqzPxv:UUWA7QGsA7M51VYA7VA7i
MD5:	C49D0508A8606F37D966C8C0B4323785
SHA1:	1A8659DF1118835CBD5DBD82094FFD2DCBF47515
SHA-256:	30D3400394E85B6FCC88D2DA93752DA02B0193AD704234A115DACCD9D49CD0E8
SHA-512:	80CC8B42BACFEF274CB7766FE386FA83608BE56369FF615D087D2074025D5F01D1F9F47A21E6E0024B98C22BA457C8E660C6E6580FA5D5CE96E027CCA0F63485
Malicious:	false
Preview:	{"/5302/desktop/desktop-Web-pt/Apps/Programpage/ATF_MPU_First":["html",1,0,null,1,250,300,0,0,null,null,null,1,[["ID=2c596b0f4fb54946:T=1702977749:RT=1702977749:S=ALNI_MYFyav28iOYlvDUSTg98vdpuW7xmA",1736673749,"/","softonic.com.br",1],["UID=00000dab026485b6:T=1702977749:RT=1702977749:S=ALNI_MY56MQQAuA40wqz-bc_UJghg51LAw",1736673749,"/","softonic.com.br",2]],[138364319192],[5793499325],[5069808144],[2909286920],null,null,null,null,null,null,null,1,null,null,null,null,null,null,"AOrYGsnsSIXPsylh1sh0jEVPrm0Us-acNt70Sis451q_mvstuFcWIeDuekrJjgwdxHPg61J5lP80repYeX7kjYF8JwOVUqo013OwCFJuUNs","CKOKz76Wm4MDFQsvigMdC3sKiQ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2",null,null,null,null,null,null,null,null,["https://securepubads.g.doubleclick.net/td/sjs","https://securepubads.g.doubleclick.net/td/sts",["https://f.creativecdn.com","https://googleads.g.doubleclick.net","https://td.doubleclick.net"],"{\"maxFloorCpmUsdMicros\":\"4096554\"}",[[null,[[[11841],[1010005,10100

Chrome Cache Entry: 228

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65434)
Category:	downloaded
Size (bytes):	330781
Entropy (8bit):	5.439670991372532
Encrypted:	false
SSDEEP:	6144:SE7/9tpE/si7egDa4FGmeAphwexTbyNdyIKflSZ6WCvtv8ii9NmzFOgcAH+Td9xl:Swe8XEo
MD5:	2F461D5311CEEF9163365E8BED73C6F7
SHA1:	EA34F69B691CF041D8597E387CFFBD7A4E5F7FA4
SHA-256:	D6D83E171CF10B83E742AAC67C59736669A473617EAA644E8CC9142F79948E7D
SHA-512:	7AD51DD3E63ED19830FDE09F5F8735FA5A639E3151E632349E13D7892B3FFC2CE1E6F9B7A753ADF831CEB0A96C6D98FB67E7AA35C302FFB5AFA346A612AAF7F2
Malicious:	false
URL:	https://sdk.privacy-center.org/sdk/987a229737a51fb2573d2ec0820c56d8f62ee315/modern/sdk.987a229737a51fb2573d2ec0820c56d8f62ee315.js
Preview:	/! For license information please see sdk.987a229737a51fb2573d2ec0820c56d8f62ee315.js.LICENSE.txt /.!function(){var e,t,s,i,n={86119:function(e,t,s){var i=function(){function e(e,t){for(var s=0;s<t.length;s++){var i=t[s];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(e,i.key,i)}}return function(t,s,i){return s&&e(t.prototype,s),i&&e(t,i),t}}();var n=s(97501),r=function(){function e(t){!function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}(this,e),t=t\|\|{},this.issuer=t.issuer\|\|null,this.user_id=t.user_id\|\|null,this.user_id_type=t.user_id_type\|\|null,this.user_id_hash_method=t.user_id_hash_method\|\|null,this.consents=t.consents\|\|[],this.version=1}return i(e,[{key:"toObject",value:function(){return{issuer:this.issuer,user_id:this.user_id,user_id_type:this.user_id_type,user_id_hash_method:this.user_id_hash_method,consents:this.consents,version:this.version}}},{key:"toJSON",value:function(){return JSO

Chrome Cache Entry: 229

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	910
Entropy (8bit):	7.7306871757974855
Encrypted:	false
SSDEEP:	24:+VNcPCUSYmJfjR+GWc7OAZuFTZ3sSd5Z7mIFRLh9Sq:QIPmJfV+rGdZ8Z3Pd5ZiIFkq
MD5:	5C256B0F30E5BDA17F7367B7A0034724
SHA1:	7815FC54816161BBAB19CAC1B025D99B0279A290
SHA-256:	0DFDD88F0F92086884EA4214BC6B6F54119D75B3D72000E4CB83EA48166282EA
SHA-512:	E0273CCF6A1BC6A9BC8423A8B35EAE26178D9CE5FC571667D001720D4DC42492FF5FBBC5DE3FD9D59E8B7D470E4744D97B191E11ACF5740328696DCF0FCD421E
Malicious:	false
URL:	"https://images.sftcdn.net/image/upload/dpr_auto,f_auto,fl_sanitize,q_auto/download_intent/templates/corel-corporation/winzip-compression/winzip-feature-B"
Preview:	RIFF....WEBPVP8Lz.../......(..B!fU[.=m.k... .1<.7u.......4..E6J...>.......1......J.Rn.r..l...x.s...29.G.'..$.....m.q...8..{..._I..E1.{nD.' ...<._[.s[.~ih..E.s.<^o..E......=.....c.v.}<.A..A...I...G..m.6....0....G-.s....%....Nw_...u.....t....=j;)v=.M..W@..n.......v.....>XLyw..Z.iw.......@ .._...N.$.....x.I..$...7...Lr`. ..X.n..d..Gk...6... ...I..L.XLb.fj..bR.A&-3..m.....X1..D......fi..!...Z....Y..s.....j%.,.5K.F...ig^%..$.U.>..DW.u.b.!A..(.cL0.Z.-.S.UN.=......~.w('..Z....`H.#n....gT..J}..4.i..E..."Q..HS...Wi,.T.".JS...I."5....9Q...(l).-.).hj...Q...d}...Do.!A...q..K.Wl.....rEIts0.\[ag#.......y..O........_rB;..5.`...z..G..3.0./C.h..(..=j..L.6......#...a2.....j@...$.I....&9 ....Z.....$..S..K......n.n.n.n?t;....<.7]../L[.&S.\$ ...9..c\.y-[...r(Z.$.9..c-.%.ymN.. ........t......5.._.....s.s\...?.S[............].qv.s.V..........{.hH.-..+....s...}.....'..!..N.

Chrome Cache Entry: 230

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	281
Entropy (8bit):	5.233913935506896
Encrypted:	false
SSDEEP:	6:hn8FQiowadCc4svmzsLEwK4LzLcIjEdxvAqJmW/upLV4HX4QL:hnMQbwuO4L994xYqJmWeV4IQL
MD5:	66D1BB3159B83CB2BE9ED066165E4C38
SHA1:	FF0D58E13E55067882F7BFFED31A1D8970FD6401
SHA-256:	3FDF2EE487005F6505D00CC9D7A3757A1942D56BCAEA69929CBD5BA110494390
SHA-512:	F55E4F9C1CEA37771D93B79F5B50295C0D25B93E7E41DBCECAD0795A96673793723A2A08DCFE5023972C5EF047FBB5FC11F4F3AB88F1018C14990590DF187B31
Malicious:	false
URL:	https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">. Copyright the Rubicon Project 2020 -->.<html>.<head>. <title>User-Sync</title>.</head>.<body>. <script type="text/javascript" src="usync.js"></script>.</body>.</html>.

Chrome Cache Entry: 231

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
URL:	https://us-u.openx.net/w/1.0/sd?id=540245193&val=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 232

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 224x224, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	3562
Entropy (8bit):	7.938235657956623
Encrypted:	false
SSDEEP:	96:bpIQ38OhokakyA8/bfJ0Kk6zOeTWQPZHbTXcF5:bD2kDJ8/mb63W+Xq5
MD5:	2F23AC95F0D046DEAA2084CCE84CE9A4
SHA1:	90CE83FBADC6A2388C620726E7ABCBE744C3AABE
SHA-256:	DC53ADB2F4A270C9BA9BA83F4657BD1E8E8C896EC078DA19FCEE32584E000F52
SHA-512:	054F03072D96A87AFE434D070216CAE0EB041B5F8BC417CAA7A06B778B4693FFD9E44B4239CBA3023AFAAADE5BDBE145B1C324DBB5ACA32BBD408FE2AE7C92DF
Malicious:	false
Preview:	RIFF....WEBPVP8 .....D.......>I .D".!..V.(......]s......\|..WJ...A..........G.?...g...?3.............~.>.~..A...9.3......`?....[.\...y.7.....?..b.......z.p>..i.a?........G.N....~.t.g..=..K.....8..K..\|...H....]...3..s.uWb..!......yW....w...B.6Cd.".v.6.93$..I..J..J.f/.p....h<....$.G{S......I.6.+.R.......'...RY+Gi.}.}..%2..F.....WJj4.E..f\...wf7'KMt..\|.1<.V.C.%.:..`.~{........O.YmPY.."..8...5...K....~...X....\......"...[m;..1..\nR.i}...........ET........G..lk.4.&T.p._l.......J!Mq[.#..M`l.?eT..O.}Bn.l.cQ.......f........u5....1..W..".....`.Z."lSqE..j..........uG.3....oD.IXb..i..+. >..JC_...c\|...e)...(..T..^8..T4\..............U.Z.....m.4.o...VI>~.1.~..)....X..[.+U.}o\|W....;..5S...q.g....ySd.1S..Z.GNd~})W"A.W....5..W.......#7t..ia...P....]...g.v.q&..8..S8 ..f..gH.).&...h...\|Z#1...LJ.... ..8...9%=.M......e-X.a@......7D.1......L.....cV..#..v-.h..(.o..$.B..:......6.o...}..NS.h...\|o...}=.R:0v.fE(Q.y.(....w*)7..1M.K<.d.<...c.>...Gl`&".3.i..J..eE\|...10y..M.#^A.

Chrome Cache Entry: 233

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	1722
Entropy (8bit):	5.485359593178804
Encrypted:	false
SSDEEP:	24:hzspEYu0L+LFLxOL9LHLsLjqOg26w/uH/4XxTTsukwYuakqpkiks5kOeVsQYlpVp:GpT0xxkprqqlwO4FNkLv/zoMxGk/B
MD5:	21A5D03394308B6448E7A7017D18AB53
SHA1:	76E881F23CE4F73FEC72038A635F73BF95DEC9AD
SHA-256:	FBEE47C6069E35705CADE50B0738B54F7026D1DFF52B8631C6FDD4874DF46B15
SHA-512:	2E3C7E98109DA394DFC091532A81F5691B69256B0A1B6D956807E2BF57E8800A29381CE5803BCE467CB0125B3D9AD2A25DFE449D439E30D22FAB0D34C2450D2E
Malicious:	false
URL:	https://sync.richaudience.com/dcf3528a0b8aa83634892d50e91c306e/?ord=3082303562&rd=1
Preview:	<!DOCTYPE html>...<html lang="en">...<head>...<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />...<script>...function loadSyncPixel(pixelUrl){....var avImgSync = document.createElement('img');....avImgSync.width = "1";....avImgSync.height = "1";....avImgSync.style.width = "0px";....avImgSync.style.height = "0px";....avImgSync.style.cssFloat = "left";....avImgSync.src = pixelUrl;....document.body.appendChild(avImgSync);....}......function loadSyncScript(pixelUrl){....var raSrcSync = document.createElement("script");....raSrcSync.src = pixelUrl;....raSrcSync.type = "text/javascript";....document.body.appendChild(raSrcSync);.....}......function loadSyncIframe(pixelUrl){....var raIfSync = document.createElement("iframe");....raIfSync.src = pixelUrl;....raIfSync.setAttribute('frameborder','0');....raIfSync.setAttribute('scrolling','no');....raIfSync.setAttribute('width','0');....raIfSync.setAttribute('height','0');....document.body.appendChild(raIfSync);.....}....</scrip

Chrome Cache Entry: 234

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
URL:	https://us-u.openx.net/w/1.0/sd?id=537072971&val=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0&gdpr_consent=
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 235

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.5257351171929923
Encrypted:	false
SSDEEP:	3:CUEIHh/:i4/
MD5:	13E1C7A2184E36D7AE519E99B1AA226F
SHA1:	355CCAD4EAC39838E1CC76FD0B670FD2EA1E5AA3
SHA-256:	48A33CA9F42B91902D57AD8AC52E1CE32B92C8C10C732F2DBB6FE960EBFD9438
SHA-512:	B1A6CFA7B21DBB0B281D241AF609F3BA7F3A63E5668095BBA912BF7CFD7F0320BAF7C3B0BFABD0F8609448F39902BAEB145BA7A2D8177FE22A6FCEA03DD29BE1
Malicious:	false
URL:	https://pr-bh.ybp.yahoo.com/sync/openx/dfcf67f2-dbc2-a0a2-5b42-ef933b9d999c?gdpr=0
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 236

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	7446
Entropy (8bit):	7.972012955617699
Encrypted:	false
SSDEEP:	192:yDC0fL/B8Qg+G5KlrTfDS9V0UR7yJQlH+PzieY2:yu0fLWQFl8V0MkwH+PzieY2
MD5:	FBE3FE94E119C916D6A20763A855B345
SHA1:	64F579A82935FB144922965CA6C8A214F986FF05
SHA-256:	FAAB9FA8FE63A4E773AF2719CC42676DC564C869F9B5BE7F32D78B53ED4F85E1
SHA-512:	C10593D6FCDF0823C0B21176AF5E155C588164EC83BD798466DD004DE4FC8EE18873101F1ACD4B1332B6161622128E97D345C4A9ACA7EDCFB1914C7C458E0F79
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-m/p/3b5462be-96d0-11e6-83ed-00163ec9f5fa/2190082916/driver-booster-free-Driver%20Booster%208_icon_size256.png
Preview:	RIFF....WEBPVP8L..../..7.7...$E..E.=3...`.F.....d.{M7......=23............I.N.J.\.J5j#'.Z.x."m.#..h....."3F..<tD[8............v.s.v...Q........!"&.)..6.Qi..%..H.$.-.`.......>'..t.".........".L...$.o...m.m.]lZ.I......?Fb...dmG...m+u.....d....;....+dY.....+TUY.rsl?:.-.z.h.!.....Ms......y...7Bhu>.O.M...~.~$.<..n..4....d...~.....R)%.... ...3\|.LP6E.....)....RI.3 ..q...Qij...c..`.?J....i.....P.8A.......l...O.T...J..Eli..' I..}.S....=.. ...4...i...Ne..w.6..G.<.y.&...;G....5.2..R.'......v.<..a......w...V.B.....=@cB{{<_.iY1,$....._.,..L...\|.`..i....5........Yp4......\.......:Ho.......2 .o..~..y...,....T..^Ro4.7...e.y.0%Y.x.VA..5dO.R6...R.n.....h.oY.....!..C..[..UJ.}...~....ya.i.....PV..u...~...O.g...Qh..T..i.......q..1o..oQ.....o..,.H...p..eV.\|..J.:.s.c..............(..A..C.m.9]K....fK.SC!...HW8.9~.[......w.....S..O...;.....<...V}....#-.;.....eT..]l..RK.l.d....\.E.@!B..........._.=u.]aT.Nl.Ue..%...{..N..-..f]._.Tg..$.....,...X.{J..".:..'I...o

Chrome Cache Entry: 237

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1222), with no line terminators
Category:	downloaded
Size (bytes):	1222
Entropy (8bit):	5.836457772522061
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCLTLv138EgFB5vtTGJTlWt0gEi16bP5vsLqo40RWUnYN:VKEctKonR3evtTA8O01iGLrwUnG
MD5:	8AE0A8FEBED9287E58A63BE0B060044F
SHA1:	39484DFC34EA16EA56A102F224BAF870592E9BF1
SHA-256:	C0A8F2CD747B6B9CD15D4007388817291906A6B8B1C70B2BC39A64E603809B77
SHA-512:	981378F732B04EB47C993CEBA9657AC6610C249AE5AC5F6022B3A7320CFBB1A989A8CF795D650D354332390898C5F5E35499D5C049F4E75F20408B508C2F6C70
Malicious:	false
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-CDkofqMo6hSAPRh2TZj9HOLusb5hze4z6vkh6YWv

Chrome Cache Entry: 238

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.844592772516276
Encrypted:	false
SSDEEP:	24:t54jfCsf+Q3WBQZ7VvUD0SwNKUYcT/9rAKDYJn0Xr/zo5R/:tI9fJ6QhiDPFzMk3yjz4R/
MD5:	A191415D61AD3A4CE8B6B0208BEAB39E
SHA1:	FCD6E672C87B58FD8A076674F2061352BAF887C7
SHA-256:	B89376A902752249A2B27740903328CC2252A05315CF6068BE161B1CE5E83107
SHA-512:	9830AA6E4EF44DABC04D8519341670CC0268D584ECAC4AB8FC90F1433C68D4578070B38B58F11AA0ACD2FA97F9A346401511C6ADB6A009931513108D45DFABBB
Malicious:	false
Preview:	RIFFF...WEBPVP8 :........p.p.>a,.F$"..&.;x...M...{]AJ.........y.............qg...W...v.PG.^E+w'n...i...\.-..v.-...~..X.v.Jl.#....dH.-.Zg.9.l..o.qWm...~...M...t(...X3Z..I....H..4.Y...s...R.].Z.K...v..D......./m...+Ws.k..\|...4..H......l.....\S>D.....9..RG_/..S.M:.".yx6R..!.y..a.=..'.x.[.....0..M....w.X.I..a..Z.b..G..d'l;..]....<.(....#....x.x......=..#R......E.....J.CY......tz....d.Z...=FI.1.8.X.Rt..\|.z0#..........o...<.......3Z.^.p..&$.$.?.!..J..m.[:..].K..u..c.K..TH@..;.@.u]...R...@py.Ny\|5.pR..G.G..<.......{.W..~..;U.\|..g.5~.W......MY..e.........J.;.w.....Y.+Y..z........v..6j.H..2....0.B....}{.\|.....f...Xpm....A..y.q.U........(.k...m.C..4o......:.J.iN.`..@#.l....<..8..G....,[Ax.,0.59Xz.)C.F~..2q..(X./.l.VM.i.9Xp....q..r..J7.C..-....\...v......D3.......4.v....ve1S..P0X?H..Y/....v...7..'\|..62.K.WWL....v..\|..C....\|.#...aS...:Y.@...b.Bk.f.8%..~....&.jwV6`o......s..R........\|L".8.Z.-]%..[.7IZ.......ki..:.t#..0...c.?.I..\|..l.F=6...."<

Chrome Cache Entry: 239

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	3298
Entropy (8bit):	7.4760162890197295
Encrypted:	false
SSDEEP:	48:UgDYRlijQ3Oc8uHTMlS7zKNBjVpuhpKbgjza+ERBkQtyt4Yv1Xv30ghuo:SGyOeAoXKNMhpKbh+sm8yZ/30gMo
MD5:	6B44CF3B39970F837AC6BB12DC84035F
SHA1:	3AA85D9A5B7725F7B1CECE20F201FE459492061B
SHA-256:	422894DD62CE80D523D3FE27A8895ED1610B8253B79583D184A242903B8C29CF
SHA-512:	F607BA68670880A461FF140AFD713D2DA7F64BF0D8E4352CE39E32301038717ECD18845F2E89B8EC81339395BC7441F12ED92A848E814B04FA54C9D53FCAD5D7
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/e5f5f1f9-1d3d-4a58-a305-8ed27c302c30/opgucny23azohuuyew1k/air-live-drive-airlivedrive_120.png
Preview:	RIFF....WEBPVP8X.... ...o..o..ICCP0......0ADBE....mntrRGB XYZ ............acspAPPL....none...........................-ADBE................................................cprt.......2desc...0...kwtpt........bkpt........rTRC........gTRC........bTRC........rXYZ........gXYZ........bXYZ........text....Copyright 1999 Adobe Systems Incorporated...desc........Adobe RGB (1998)................................................................................XYZ .......Q........XYZ ................curv.........3..curv.........3..curv.........3..XYZ ..........O.....XYZ ......4....,....XYZ ......&1.../....VP8L..../o........l...l.eY.....4..4..,J.I.,..F...8j....pD.'.._...4...?!.}j.4.t..6....\.,.........3.O.....g..i...{-.@.$Q......o....E.T...tx........qh.\...>......%...J.....C..X.R.....{..............>....>...\..... .h.2!P".tr.2.>M..2.O%.Q~..l...$U_.js.K............a>..J@...kN.@.1....)..3........RL... ....m.....-.@.h<.Z....~.P...~R.P..gC@..3g_H!...S.@z...Z........ 6..^....".)'.$\|S.\|+..

Chrome Cache Entry: 240

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	3298
Entropy (8bit):	7.4760162890197295
Encrypted:	false
SSDEEP:	48:UgDYRlijQ3Oc8uHTMlS7zKNBjVpuhpKbgjza+ERBkQtyt4Yv1Xv30ghuo:SGyOeAoXKNMhpKbh+sm8yZ/30gMo
MD5:	6B44CF3B39970F837AC6BB12DC84035F
SHA1:	3AA85D9A5B7725F7B1CECE20F201FE459492061B
SHA-256:	422894DD62CE80D523D3FE27A8895ED1610B8253B79583D184A242903B8C29CF
SHA-512:	F607BA68670880A461FF140AFD713D2DA7F64BF0D8E4352CE39E32301038717ECD18845F2E89B8EC81339395BC7441F12ED92A848E814B04FA54C9D53FCAD5D7
Malicious:	false
Preview:	RIFF....WEBPVP8X.... ...o..o..ICCP0......0ADBE....mntrRGB XYZ ............acspAPPL....none...........................-ADBE................................................cprt.......2desc...0...kwtpt........bkpt........rTRC........gTRC........bTRC........rXYZ........gXYZ........bXYZ........text....Copyright 1999 Adobe Systems Incorporated...desc........Adobe RGB (1998)................................................................................XYZ .......Q........XYZ ................curv.........3..curv.........3..curv.........3..XYZ ..........O.....XYZ ......4....,....XYZ ......&1.../....VP8L..../o........l...l.eY.....4..4..,J.I.,..F...8j....pD.'.._...4...?!.}j.4.t..6....\.,.........3.O.....g..i...{-.@.$Q......o....E.T...tx........qh.\...>......%...J.....C..X.R.....{..............>....>...\..... .h.2!P".tr.2.>M..2.O%.Q~..l...$U_.js.K............a>..J@...kN.@.1....)..3........RL... ....m.....-.@.h<.Z....~.P...~R.P..gC@..3g_H!...S.@z...Z........ 6..^....".)'.$\|S.\|+..

Chrome Cache Entry: 241

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (15907), with no line terminators
Category:	downloaded
Size (bytes):	15907
Entropy (8bit):	5.514273213911923
Encrypted:	false
SSDEEP:	384:DnAJ01yJnUyOd1VxkZjhwq9+5yu85w+TINmNPvncM:jAJ00JnLOH4ZjhwDi2+0s9R
MD5:	AE79DB664406C9254F4F32DAF70C93AC
SHA1:	FAE0AE1FCEB99F996F315545F1C75EB04939B20C
SHA-256:	8E53E50181B7A9E2CAA94173C37FCD9DE8FA75750764A2AD8AD02FAC3306D652
SHA-512:	FBD5EC409CE57592EFF6BDFB2DF69C2414A79D84CB9B1BE5B6C5110985A0FF4D192B7D31160D9F14F3E3DBA21628129ECF9BC925597F968AC1CF6DF849346AF6
Malicious:	false
URL:	https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Preview:	<html><body><script type="text/javascript">(function(){var aa=window,p=navigator,aj=aa.top\|\|aa,ak=aa.location.search.substr(1),A=encodeURIComponent,W=decodeURIComponent,aA=aa.parseInt,P=aa.PubMatic\|\|(aa.PubMatic={}),K=0,ad=0,b=0,ap="pubmatic.com",V="ads."+ap,am=1,Q="https://",a=(aa.__cmp?1:0),ao=function(aF){return typeof aF==="function"},av=console.log.bind(console,"PubMatic:"),au=function(aJ,aI){var aG=0,aF=aJ.length,aH=false;for(;aG<aF;aG++){if(aJ[aG]===aI){aH=true;break}}return aH},n=function(aF,aI){var aH=aa.document.createElement("script");aH.type="text/javascript";aH.src=aF;aH.async=true;if(ao(aI)){aH.onload=aH.onreadystatechange=aI}var aG=aa.document.getElementsByTagName("script")[0];aG&&aG.parentNode&&ao(aG.parentNode.appendChild)&&aG.parentNode.appendChild(aH)},ar=function(aH){var aG=aa.document.createElement("iframe");aG.src=aH;aG.style.height="0px";aG.style.width="0px";aG.style.display="none";aG.height=0;aG.width=0;aG.border="0px";aG.hspace="0";aG.vspace="0";aG.marginWidth=

Chrome Cache Entry: 242

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	1596
Entropy (8bit):	7.889824203219796
Encrypted:	false
SSDEEP:	24:EZK+U6/cskh89t1Xpk3+3/rZRhPlh4QL9mKEqJ8ZxqKjs416JGCkXzrezTv/OyP0:GEsjs3+PZPL4a99u7RQ416ICkXuzUyut
MD5:	586D0A208548FEA97903102C16246848
SHA1:	061CE8BA7DBECCCB248D4541A39D7DB52F5D0F70
SHA-256:	04DB713A500BA4C8B85CF37C2D6872C12729AE058019630B5166D006EE2C29B9
SHA-512:	1130BBC3FD60D4E557A237D3AA39AF0FADCB0CAB66AC9F7BF35A1D311F5AA5DEDF2FC5C54B21B6D541B034F50E17AAECCBE2ED9FEB37D643A6F2816B60A022D6
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/b3562592-96bf-11e6-ba7b-00163ec9f5fa/3833258526/winrar-3833258526.png
Preview:	RIFF4...WEBPVP8 (...p!...*p.p.>.N.L.#.",sl....l;\|.. ...W.......>.v<.:6.....b.O.U.%.7.Y_..J..fi.......S....=.....W.-.E2.5....8..t..S..Z...Jj..Y..@....}f;.+}#.vI.]).........!.]..(X..lu($w.-....{. .X..zp........&.G\.....&.n.\.g$.2......T..)&...:}.R .8.y.Y.!U.\|...l..m..%.>.E...g...H7.......7...d..s.i...R.,...%.....)Fw.N.dz..L.9.3..\x.].h.....fu.....\..vM...<..jM&.i...F......4..../..n4.\|...&.$<.&...O.h.,a....S~...../..T:l.t....B.../..o...P.....U8s......`...4..M..I......G..'.^....C..4.A......2...A..e.kN......t.eG.f..%.0..i.LP......pe?.vJ2.?[g.....$f......+..Xd.p.C.jR....j7`5H.t_.!..Z.K.v7.X.;...J@..K..u.^1>.Y.\|..JY.#..h....^......M..tW&....6...F..y.-x.Mz..S..%c.....dB8.. .+i^...f".....v.../....o...&I..&...;Eh#.0jKA/.?.....K...4..;.b.cLk.....=P"}+$........6.2D. ...m....BZb.^2.rYzs.U.Z.[.p..P^.u..K.r..boTtC...'X..`s..q.>.z.P...I.o.1...9+Tr+.`6.mh..S.B....S./...\.Me.-..-"2..#........J...C3)Y.h/.Gd..Yi.5fL....F]...b....../...X?...q.P"ycT..j

Chrome Cache Entry: 244

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (15907), with no line terminators
Category:	downloaded
Size (bytes):	15907
Entropy (8bit):	5.514273213911923
Encrypted:	false
SSDEEP:	384:DnAJ01yJnUyOd1VxkZjhwq9+5yu85w+TINmNPvncM:jAJ00JnLOH4ZjhwDi2+0s9R
MD5:	AE79DB664406C9254F4F32DAF70C93AC
SHA1:	FAE0AE1FCEB99F996F315545F1C75EB04939B20C
SHA-256:	8E53E50181B7A9E2CAA94173C37FCD9DE8FA75750764A2AD8AD02FAC3306D652
SHA-512:	FBD5EC409CE57592EFF6BDFB2DF69C2414A79D84CB9B1BE5B6C5110985A0FF4D192B7D31160D9F14F3E3DBA21628129ECF9BC925597F968AC1CF6DF849346AF6
Malicious:	false
URL:	https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Preview:	<html><body><script type="text/javascript">(function(){var aa=window,p=navigator,aj=aa.top\|\|aa,ak=aa.location.search.substr(1),A=encodeURIComponent,W=decodeURIComponent,aA=aa.parseInt,P=aa.PubMatic\|\|(aa.PubMatic={}),K=0,ad=0,b=0,ap="pubmatic.com",V="ads."+ap,am=1,Q="https://",a=(aa.__cmp?1:0),ao=function(aF){return typeof aF==="function"},av=console.log.bind(console,"PubMatic:"),au=function(aJ,aI){var aG=0,aF=aJ.length,aH=false;for(;aG<aF;aG++){if(aJ[aG]===aI){aH=true;break}}return aH},n=function(aF,aI){var aH=aa.document.createElement("script");aH.type="text/javascript";aH.src=aF;aH.async=true;if(ao(aI)){aH.onload=aH.onreadystatechange=aI}var aG=aa.document.getElementsByTagName("script")[0];aG&&aG.parentNode&&ao(aG.parentNode.appendChild)&&aG.parentNode.appendChild(aH)},ar=function(aH){var aG=aa.document.createElement("iframe");aG.src=aH;aG.style.height="0px";aG.style.width="0px";aG.style.display="none";aG.height=0;aG.width=0;aG.border="0px";aG.hspace="0";aG.vspace="0";aG.marginWidth=

Chrome Cache Entry: 245

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 16708, version 1.0
Category:	downloaded
Size (bytes):	16708
Entropy (8bit):	7.9879281149132275
Encrypted:	false
SSDEEP:	384:Nd1nZ+hLc8g3/2AY8VL6UBP38Y1dDq6w9ZD:bJZpv3h1Z3x+9ZD
MD5:	68C477C4C76BAAB3A8D1EF6A55AA986F
SHA1:	4AF50379E13514558DD53D123DB8EA101EC5E24C
SHA-256:	0364D368ABF457D4E70DBC7A7A360F3486EAEA2837B194915B23D4398BEE91AC
SHA-512:	92B34FE3B7F82F10CF6DE8027AC08F4A5B8764FB4E0B31C93DA6E3D5BD08E0BC83B79FD70B8207A1066B689583E0B6976FA3C885B0C067EA343E6F2031D55D25
Malicious:	false
URL:	https://sc.sftcdn.net/fonts/585ea-68c47.woff2
Preview:	wOF2......AD..........@..........................v.......`?STATH........P..{..4..6.$..d. .... .......`v;0....&..z.8..s&.E.i^.....2..\|......P(.1.V..,{i.K.$..@L.....SV.....&.w.5...P...9.*.a..qt&~..(n.4]",.Mb..............c.Qz.W.X8....g8_[.....&Z..n.,.......I......OryxZ....b. \|+.....X.><....}//......v....;.`...Jw...7.AB.N..7.0.....3.EqS.-u...5...n..jI...W.eie.....e......Ph.+.......LL-..mI.]vy?...;oJ..k.o.C3w.(?.\|d.PE.x .2N....!Q(.7{......J...#H..(....E.+]...;.#..!".Bx.H...e...3......."G..2....^.].tVR.N...8...r..`4...w.d.{.....%.}@.po.UL.^(....X).1...BR.......7p..hq...k.@.+.v.J...a.........R..t.(........a.....}[...q.=..]7.....,.0.P.fA..6p..o..N..i/..oo..]wU....p.I..]..$.b..f.@Z[3.G.1.l.K.y.w.QlPh..%..-.Cgi..l....4k.{v")....v.WT...,..........F.a.#.Z..O..HV@rH.....y.........;.{].\R[_U^.Rw<.7.fsw.&..G.T.\...>r..JsC.f<Bb.....<....}s.%N.T.eim..~..l.h....G..F.....2<..>\|^.1.Rv........U..$0CL..."34..\.......L.I.I.!H..A.........bW...........P.6.....!5

Chrome Cache Entry: 246

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (650), with no line terminators
Category:	downloaded
Size (bytes):	650
Entropy (8bit):	5.614626485642771
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHa0g+jkSRaXlSkUS/n7C7zvT68rTiUMGT2IWSBW5Bd/:hMiRO9nosXlSoGXLn8G9xMn
MD5:	FA4AC94B9B1DBB5B89D4C73725DB809D
SHA1:	4166B3502F5581AA668BD0DAF2C7851D3A74B74D
SHA-256:	3F2351402FCBFBC25DF28208D81A48C1D5475B2ED6AFEDEE57E77330864217FC
SHA-512:	8C9E044094172890B5F57D2A150F2517F83FBB1188CB250792DBE20B30D52EC5B478CACDA1C155482DEE9FDD181FF46FB4CC044E9FC8D9BE6E8170724E4108A6
Malicious:	false
URL:	https://8876029.fls.doubleclick.net/activityi;dc_pre=CMuD1rmWm4MDFXrMKAUd-d0Afg;src=8876029;type=invmedia;cat=progr0;ord=2316977282064;auiddc=133230612.1702977737;u2=%2Fprogram_page;u3=Caffeine;ps=1;pcor=858286563;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CMuD1rmWm4MDFXrMKAUd-d0Afg;src=8876029;type=invmedia;cat=progr0;ord=2316977282064;auiddc=*;u2=%2Fprogram_page;u3=Caffeine;ps=1;pcor=858286563;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F"/></body></html>

Chrome Cache Entry: 247

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 248

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	4.337447160490376
Encrypted:	false
SSDEEP:	24:tdiutsCPSpLqTXtg1RPl5wQtT6zYbzzwIhGCfyqdG0OuU5WeRe:4CPSpqXtgnjwQhyYbzlfyl5WeU
MD5:	EBAECF4F1B8F157D30814C35DE75A06E
SHA1:	4AA2E335E997AC1611815D9114E65323A1DEF85E
SHA-256:	EF7768C313EA66869D68A301994C5A6B1FCF05058AE17606C82381D675B1B3B7
SHA-512:	9B11BC86ADB1EE7F9C80A75BD079B132B125AB24AC56116C926F0F754E19AEE9338F38C846E09425839152AB339F990DA14EA825EC928CB78AD0E8D60AB4C3DA
Malicious:	false
Preview:	<svg width="96" height="96" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="#EEE" d="M0 0h96v96H0z"/><path d="m76.933 68.267-4-3.934V33.2H61.267L56.4 27.4H44.133L40.4 31.8 37.6 29l4.667-5.6h16l4.866 5.8h9.8c1.023 0 1.945.411 2.767 1.233.822.823 1.233 1.745 1.233 2.767v35.067Zm-15.6-15.534L47.867 39.267a13.733 13.733 0 0 1 5.633.233c1.844.467 3.456 1.389 4.833 2.767 1.378 1.377 2.311 2.989 2.8 4.833.49 1.844.556 3.722.2 5.633ZM32.067 29.2l4 4H27.6v34.2h36.933L20 22.867 22.867 20l53.8 53.8-2.867 2.867-5.267-5.267H27.6c-1.067 0-2-.4-2.8-1.2-.8-.8-1.2-1.733-1.2-2.8V33.2c0-1.067.4-2 1.2-2.8.8-.8 1.733-1.2 2.8-1.2h4.467ZM42.4 42.333l2.867 2.867c-.756.711-1.323 1.5-1.7 2.367-.378.866-.567 1.81-.567 2.833 0 2 .711 3.711 2.133 5.133 1.423 1.423 3.134 2.134 5.134 2.134.956 0 1.884-.2 2.783-.6.9-.4 1.706-.956 2.417-1.667l2.866 2.867a10.788 10.788 0 0 1-3.698 2.533 11.334 11.334 0 0 1-4.368.867c-3.13 0-5.79-1.096-7.98-3.287C40.094 56.19 39 53.53 39 50.4c0-1.514.289-2.97.867-4.368a10.788

Chrome Cache Entry: 249

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	7.972012955617699
Encrypted:	false
SSDEEP:	192:yDC0fL/B8Qg+G5KlrTfDS9V0UR7yJQlH+PzieY2:yu0fLWQFl8V0MkwH+PzieY2
MD5:	FBE3FE94E119C916D6A20763A855B345
SHA1:	64F579A82935FB144922965CA6C8A214F986FF05
SHA-256:	FAAB9FA8FE63A4E773AF2719CC42676DC564C869F9B5BE7F32D78B53ED4F85E1
SHA-512:	C10593D6FCDF0823C0B21176AF5E155C588164EC83BD798466DD004DE4FC8EE18873101F1ACD4B1332B6161622128E97D345C4A9ACA7EDCFB1914C7C458E0F79
Malicious:	false
Preview:	RIFF....WEBPVP8L..../..7.7...$E..E.=3...`.F.....d.{M7......=23............I.N.J.\.J5j#'.Z.x."m.#..h....."3F..<tD[8............v.s.v...Q........!"&.)..6.Qi..%..H.$.-.`.......>'..t.".........".L...$.o...m.m.]lZ.I......?Fb...dmG...m+u.....d....;....+dY.....+TUY.rsl?:.-.z.h.!.....Ms......y...7Bhu>.O.M...~.~$.<..n..4....d...~.....R)%.... ...3\|.LP6E.....)....RI.3 ..q...Qij...c..`.?J....i.....P.8A.......l...O.T...J..Eli..' I..}.S....=.. ...4...i...Ne..w.6..G.<.y.&...;G....5.2..R.'......v.<..a......w...V.B.....=@cB{{<_.iY1,$....._.,..L...\|.`..i....5........Yp4......\.......:Ho.......2 .o..~..y...,....T..^Ro4.7...e.y.0%Y.x.VA..5dO.R6...R.n.....h.oY.....!..C..[..UJ.}...~....ya.i.....PV..u...~...O.g...Qh..T..i.......q..1o..oQ.....o..,.H...p..eV.\|..J.:.s.c..............(..A..C.m.9]K....fK.SC!...HW8.9~.[......w.....S..O...;.....<...V}....#-.;.....eT..]l..RK.l.d....\.E.@!B..........._.=u.]aT.Nl.Ue..%...{..N..-..f]._.Tg..$.....,...X.{J..".:..'I...o

Chrome Cache Entry: 250

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (53563)
Category:	downloaded
Size (bytes):	53564
Entropy (8bit):	5.397430524785695
Encrypted:	false
SSDEEP:	768:bemBuCcWQm1YgnrZK0eHkwImvBPQyWqCB/k/mvvNz0mMGaNFX5o6nSUknaTjOqS:zur/hmdRwIqYXAXPnSUkna+J
MD5:	E1A46D18DD95B1CD175FD22E02DBF859
SHA1:	3DB51E951C20362387589FEFA6E76EA2065AA8B8
SHA-256:	8EB64D6ECBC4763441B9EFC86C5A529F204810A1121669CBF03290C010BF71BB
SHA-512:	A19F556D15C8B13B2C833AD397CC06DCE2661D2C9647CEFA57F8E2D53570A023B602FD2EC5E006E011A8798044C8C0A922BCB8FFDB6C39B1A96892EB3772A960
Malicious:	false
URL:	https://btloader.com/tag?o=5633429348548608&domain=softonic.com&upapi=true
Preview:	!function(){"use strict";var e=function(){return e=Object.assign\|\|function(e){for(var t,n=1,s=arguments.length;n<s;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},e.apply(this,arguments)};function t(e,t,n,s){return new(n\|\|(n=Promise))((function(r,i){function o(e){try{c(s.next(e))}catch(e){i(e)}}function a(e){try{c(s.throw(e))}catch(e){i(e)}}function c(e){var t;e.done?r(e.value):(t=e.value,t instanceof n?t:new n((function(e){e(t)}))).then(o,a)}c((s=s.apply(e,t\|\|[])).next())}))}function n(e,t){var n,s,r,i,o={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]};return i={next:a(0),throw:a(1),return:a(2)},"function"==typeof Symbol&&(i[Symbol.iterator]=function(){return this}),i;function a(i){return function(a){return function(i){if(n)throw new TypeError("Generator is already executing.");for(;o;)try{if(n=1,s&&(r=2&i[0]?s.return:i[0]?s.throw\|\|((r=s.return)&&r.call(s),0):s.next)&&!(r=r.call(s,i[1])).done)return r;switch(s=

Chrome Cache Entry: 251

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
URL:	https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&expiration=1705569749&gdpr=0&gdpr_consent=
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 252

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	1286
Entropy (8bit):	7.825549453655853
Encrypted:	false
SSDEEP:	24:bLaI1WRaTSgYFDnfUNbFufTtydhlLrEKwkvOvBL+ZpJsctdeocGfp+:PZwRaSDfsIYA7BByZEqM
MD5:	E26B39A76ED63EE236E82070D36E7A0D
SHA1:	E32D3F33DA13D2DA8332FB6DF199AC545402487A
SHA-256:	2D9EFC3895A23B7F678620ED7D3A840C85AAF8B548F5F9D2D68865355E597DB4
SHA-512:	746B2C0BA776A7975CB95CE505C6B4DD97D87FE8EB710C3F38C9217E46718BEC17EE7E3321E3629A20FEA974C3A92BF670ABCB7020499DB50298C735F7F53580
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/f46a4db4-96d4-11e6-b215-00163ec9f5fa/3261177456/caffeine-logo.png
Preview:	RIFF....WEBPVP8 ....P....p.p.>]&.E#.!..n.8...h.....M..y...:......._...+ht3...-.\....J..M.k..M.U..y..5..a....~<uE\v..y%......V.L.T..9FV...~..B..HP.j..........sK.V..B$..R.....z......;.9[fhve.1....H.-.S6d..,...@Z....U...../........S.S....`G....T{j........d!..?H..;...7...+..C.\|P..Lrn..3i....\|7#2'..so..9.-O..I...U8.."?k.-h.i2.].,..D<wJ....@...!.?..O....f.....f(.w.n.>.5.....r(...i...Oad.F..Ui..S...# ...f.8B.....%..O..x$.@..T64,\....G..uN2..k.....w.Dc..I.O&#!..xV.!..9a.J.g.+..1Cv......o..".w!..ai.!........M.N..;@.XyK.+Kct"?u..oQx....^.....q{.u..9>..z..o....]...y.@U.....]...}.H......[..F......<.........N./...?3M....m.{....)O.j.3)....3...j......Z....A...n..#;wI...$.C.!.....F.y=>...>.}...F..GrMZr_.o.1........u..T:..Q.6!F...3...B..M$kp.....X.rk.pI..X!{O...F(.a....N.....>.MpHIc%..s.....>Q'...~+K..xAp.H.5..vy...m...GJ..m^...}.F...`..3Iv..LW..I [,...xH.`~..v...b..1............l1..(.q....N.e.S..p.bf...i.}....A=.92].......Gp......t....[.6......

Chrome Cache Entry: 253

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu1kr4VuX7QwIDak3uK3MuyKYA0UBk3JwVi1HqoMv_u_ScNQ5BmrXvHSzTbew3exbW25JmGjufR71OH9vWHxRSInYWCcM39Bhka-gozG4ta6sD49sMsSE4m_dYxWxz-rxpW0dDDVnJNYDdUbwybDBWzfAPE_Uc&sig=Cg0ArKJSzBXzn5THP2HTEAE&id=lidar2&mcvt=1001&p=424,939,1024,1239&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20231213&bin=7&avms=nio&bs=1263,907&mc=0.81&vu=1&app=0&itpl=3&adk=4226504758&rs=4&la=0&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&vs=4&r=v&rst=1702977743763&rpt=2178&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0"
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 254

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
URL:	https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=030284df-1cd5-54fc-52df3208
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 255

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=12325200;type=invmedia;cat=softo003;ord=6058147887192;auiddc=133230612.1702977737;ps=1;pcor=1728039348;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F?
Preview:	<html></html>

Chrome Cache Entry: 256

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvqlj43qfqBk8fDK-5KuPLkqxvAXtg_H0upSVKYfH5-S3ATLTUMxRDw1alSPvb2J3v9XR0ikTi3EaPrfK4JIYSBiYcYHRrJdvE6Ob_Ogi9HnpmoeUf4mHMTQax1PUrsWfEuoyecJHQ1wabmBSRt9RSeupEO&sig=Cg0ArKJSzMbMOkm9thvFEAE&id=lidar2&mcvt=1016&p=0,0,48,1263&mtos=1016,1016,1016,1016,1016&tos=1016,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=7&adk=3804165121&rs=4&la=0&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&vs=4&r=v&rst=1702977743977&rpt=3042&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0"
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 257

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (15907), with no line terminators
Category:	downloaded
Size (bytes):	15907
Entropy (8bit):	5.514273213911923
Encrypted:	false
SSDEEP:	384:DnAJ01yJnUyOd1VxkZjhwq9+5yu85w+TINmNPvncM:jAJ00JnLOH4ZjhwDi2+0s9R
MD5:	AE79DB664406C9254F4F32DAF70C93AC
SHA1:	FAE0AE1FCEB99F996F315545F1C75EB04939B20C
SHA-256:	8E53E50181B7A9E2CAA94173C37FCD9DE8FA75750764A2AD8AD02FAC3306D652
SHA-512:	FBD5EC409CE57592EFF6BDFB2DF69C2414A79D84CB9B1BE5B6C5110985A0FF4D192B7D31160D9F14F3E3DBA21628129ECF9BC925597F968AC1CF6DF849346AF6
Malicious:	false
URL:	https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Preview:	<html><body><script type="text/javascript">(function(){var aa=window,p=navigator,aj=aa.top\|\|aa,ak=aa.location.search.substr(1),A=encodeURIComponent,W=decodeURIComponent,aA=aa.parseInt,P=aa.PubMatic\|\|(aa.PubMatic={}),K=0,ad=0,b=0,ap="pubmatic.com",V="ads."+ap,am=1,Q="https://",a=(aa.__cmp?1:0),ao=function(aF){return typeof aF==="function"},av=console.log.bind(console,"PubMatic:"),au=function(aJ,aI){var aG=0,aF=aJ.length,aH=false;for(;aG<aF;aG++){if(aJ[aG]===aI){aH=true;break}}return aH},n=function(aF,aI){var aH=aa.document.createElement("script");aH.type="text/javascript";aH.src=aF;aH.async=true;if(ao(aI)){aH.onload=aH.onreadystatechange=aI}var aG=aa.document.getElementsByTagName("script")[0];aG&&aG.parentNode&&ao(aG.parentNode.appendChild)&&aG.parentNode.appendChild(aH)},ar=function(aH){var aG=aa.document.createElement("iframe");aG.src=aH;aG.style.height="0px";aG.style.width="0px";aG.style.display="none";aG.height=0;aG.width=0;aG.border="0px";aG.hspace="0";aG.vspace="0";aG.marginWidth=

Chrome Cache Entry: 258

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.788035787250117
Encrypted:	false
SSDEEP:	24:uYZaOrH7g1q2QAsMF6Az/0JBZrgXsEEpa9NJM9auR7:pprH01hscV/yBZMaa9v4HR7
MD5:	B72D387806EFDED87CA5235A747204AA
SHA1:	9E3520E6997E6EBF7B5EB5EF4196B002BB865CB2
SHA-256:	62B78FBEAAC879A591FB7563CE48AEF32F7E8C4C38CCE05BC8D9EEDC8BED7697
SHA-512:	B74CF0A002ABA1E70E7194A40441C9B30DA003E8FFF55A92193007D6BB47E755E21103355FB6B627D5A6BBF8C619ED3A46DFBC4C59CF58FD5BFE083B5E2CED8F
Malicious:	false
Preview:	RIFFd...WEBPVP8LX.../o......m..?......A..v..@...............,.l.....`.d..I.$..D(.h.....@VV.=...%[..n...rB._p..m..Z...p..rc.....mp.K...uV..Y.T.z.V..Q...o_...3..U...G....<K....~to..e...f.~gqI5?.d.X...\|.%W.U>uX.ik}.4.Wx..(.....Hd..u..SY,Q7..+?..JS.4..<..C...3.0..oBB.3C.W._....~.^Q.Z....f(.".@......!....i.C5.q....0TG.m."...J..[.2TKI4..P.1. ...S!...f^..Ya. .....P.z8.D.....@...j!..gy..W.. \3..........Te$..w...D..!J.c.a...L.h..rt}~]....o.9...H.X..I....Q:z.....wX.n,.C....P....2..O.....9....f....Z.....a?....e...:..h.....$b.y..^.<.P..0.d.!..Z...f>...o.\|..v.-f>......ChO...].2..89.W.0.B..'...6}......D.k?....<..)p.....<.<....'.bK....j..'...CA.....3....!.&09.......L.P.'<.'..l.eh.0.8.`..%..-g..E".5.P..G........m.B..d.u.C..!..\|0..w.....P4.e....M3.[...Q..#..f(........$...8...7......:2.EJQb...A....Tr#.uQz...9.'K.^...+.....#..r..o..Od..!.'..Vv.x...0..rT....Y.{e...%.K.q..K3V..h+.s...!.q.H..!.Su.T...ip..u.Rn...:Q,}..\X.....v+..V...:`,2t...@.Ig...Ja..!.

Chrome Cache Entry: 259

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	2116
Entropy (8bit):	7.913754837353188
Encrypted:	false
SSDEEP:	48:MWuDv8yI6fzTB+RvbxYr7lt7av2n+TExEI3cHZuTJPNy/u:MWGlPfzTQOqvgP3IZEJPNWu
MD5:	0F2F47A40E435E6D0B2832DE1C8871B6
SHA1:	6CE7EE71672607391D54243F9E5F21BDB514A51D
SHA-256:	70F7B1A43EAB885021756F6F4C4359D946D0C3EB843A2F8FCC9BC1A0FA77E17F
SHA-512:	799F4E3E5729E87677ABBE3B70A635A9F5B089501EA1A1EFB7AC2AD76558ACE9C92F8E4E0CCF63C14E39926229A0417F4A6559840A05DF3BB597A2AE28EA633A
Malicious:	false
Preview:	RIFF<...WEBPVP8 0...P'...p.p.>U$.E..!.._l8.D..dK.?I.b.............O....l.8.....w.....S.....G...o._.>........!~.{.ye~.\|%~....M..Z...N.ff>.~.....`..M.<A........ES.._..G.........lr..>.....y...,................)4.3D.}..(.A9m4.%SR...r..7........'.<.7.P.G.n0......!T.>v`rt.v...t...2<,..8.g3.....i.P...p<...V<....hX$Y.....a.....kC.${........F...%...J.......+..@....%.nu..R...OM...6.z.....D1x...R.....,%W1+~..=;.....tn.G..X.)...m.%...]..^[[*..."..[..<.b.w.g.o'....Ej.k......jMEt..,.....E.....]..j.VLz./...12.&.<....i.Z..o\|.e>o...)..r...v&..FG....)...2;.Yf.'...zr.....Fd.y'....\|&O@.G.<...w...H.x...NC...1......u.t....D.m...6...3..<..?.w.+e...~E..U:..s.Xn..?...G.p=q._. .rA]..o.{...5;.7....JAuK....=...+{....U..]...lH.u...{O........B........c.NG <a..{CD....g....P...B.;8...Y.a.....-y...c.b.!m.F...J..Y........^.U...D.."..%...t...)........q.........@(X.s...u...EO..lT..{...+n(7HwN....w.tW0.A.5...j..L...h.U.F....x..]...U.N.:..F..$..@[z...._T....f.4..

Chrome Cache Entry: 260

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.4104172527605203
Encrypted:	false
SSDEEP:	3:x3FrE:dFrE
MD5:	0AC8DBE31DD35419AAE219847ED029CF
SHA1:	C2BA43631D389A1ED40D64F7CE0E457C1C1AD185
SHA-256:	2E5B50C64FCC5F4E0AD3E6CDF3D28655A271DE28F234B26F365EBF6B1A4A0F48
SHA-512:	3A9AB6AB378A6357A489252D1402587BE58CF6648400BA173AADACB9050533140216EF223736F065315C2E84A99BF67F85864DEAC53A71E235AB7A6B1F03D907
Malicious:	false
Preview:	missing (v)ersion

Chrome Cache Entry: 261

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (384), with no line terminators
Category:	downloaded
Size (bytes):	384
Entropy (8bit):	5.436844522891102
Encrypted:	false
SSDEEP:	6:xWzPkk6gLxrbh0rjLdV2B94P0CLGKwM7M+d6Lxrbh3eKWHJ2B94P0CLGKwMAen:xWVbOpuRIdv7HgbVeYRIdv7n
MD5:	DEE06975828FF8D8C50595BE02284C81
SHA1:	11974372255879B2B726354855F0AADD24278D52
SHA-256:	D22E737BD01776D2D684710611E0D54E879FE32783D7A6CD35BDDF149A8D9D3A
SHA-512:	2F5A69946362C0D5895D3ADED1322A5FBA55EF3224191514831CA1C8A872AD022CD80C29969B2695D6BA58EDD1BC50C13FED9BBFA542AEC2B48DB46320D7F741
Malicious:	false
URL:	https://partner.googleadservices.com/gampad/cookie.js?domain=caffeine.softonic.com.br&client=softonic&product=SAS&callback=__sasCookie
Preview:	__sasCookie({"_cookies_":[{"_value_":"ID=2b87b3594aa5b69f:T=1702977752:RT=1702977752:S=ALNI_MYhCSU9yj7LmS749ALDv3ArjJBgnQ","_expires_":1736673752,"_path_":"/","_domain_":"softonic.com.br","_version_":1},{"_value_":"UID=00000dab023c5846:T=1702977752:RT=1702977752:S=ALNI_MYcuNxZt4XZ_tIw48o6wahnbMQ_5A","_expires_":1736673752,"_path_":"/","_domain_":"softonic.com.br","_version_":2}]});

Chrome Cache Entry: 262

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	7.882322181090171
Encrypted:	false
SSDEEP:	24:jcAxz6ORsBOca+6+ScBO9cUrMPLPt1skJZTISH/z920Pt8NIakPaDMBrN+2ur:jPFmBxa+6jchUAB1saTf0NIK1Lr
MD5:	02CE189838137D302A58D4B8F165A145
SHA1:	C2AB765DA25E2394055F7B671FC26ABC4FEE27F3
SHA-256:	5F07EE57C01F067266F750D9DFD2C2413039E7D80DA152B2C052155F41C40AD9
SHA-512:	DC836CD04D1A9586A1E13F2D431E7CA1BE68C3DB0C6D3BE42E623B924936C0F0611F088EC8C10FA8FCBAF56A3BD403F86A7A71DF1B6523EF1F1EBCC37862D99F
Malicious:	false
Preview:	RIFF....WEBPVP8Lu.../o......m$.A......mP.1..m.......$a.9]...?w.w.t..g....St.S0.30..FU.ia.$...@..Z..(...L.KBIh.c.v.v....;...M.........9a._...#..A.....".H.&.#?...J....ga!.a.\?.x.....'...+>.......5.J....6..R..<J.B..y~D....P.....0S....(.y._.m!..f..fq."..[?~.>VV.bMk....C....gljS.O.F..T!.T.....L.#.]V..:O..Ev.Gc.`Z..=+..:tn.E.3R%tT..q../L.I.$hT.._G......@b...B...n;.......uY. =.s.Ga..PF..S..I]......7..E.....e. Q..Dq.Y!iD.e%.V.&.Rey....r..".YhZ3.hZX..T.Ec..I".T?.....].'A.....iXo....i.....oa....d.4..n.&hX..`..u..>.3s....sJ..XVu....md.L.#SQp.YT^5.y.....?(d.u...<VE.....k..R......1e..G.1..N...UV...k%4@-wgZw....U.G^...ye..M...b5.V.......L=.?......C+.)....pf...\|.?......#.......3.n.V....~h...0....Hm..,..X.....l..O...e.u.9..^_.6.\..8ga.6p6.....e.....3^.MM9?....4R6[../.)U../.w..ih.$8..7.]'.}...$..y....S+.t.\s?.D.!].N{....2..q_.p.;p...6.~J8..D.s?..8.3n....K ..O..b.n...<LL?....:8.u.Cw.5<.*.=....n.Z... .<...(o'.. ....+9...........8o..N....9.A.....+......<]^.H..@.L...

Chrome Cache Entry: 263

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	2408
Entropy (8bit):	7.9151568759921584
Encrypted:	false
SSDEEP:	48:M0DoN7lmYxlJQL0H20H6LQaulp+A8V4QaUNb5UMVCr7/0sX6LJ:HU9oYxlqxPG+pNN5U//0sXgJ
MD5:	10D55A156EF0FB04B5772299F5E008B3
SHA1:	3A8F8E569EEC81F2854A80D0DD1B604A7E001331
SHA-256:	3B55B8D88B0912A2095D3EEA52617791EC20A1A968F7C136D18F45EF9E0706F6
SHA-512:	610FB718A353C2B2930B9216503570E138FFE77DF26475C78BE34FAA08B0711C50E29425D3C4C5A9B87A4A986E87B02EEFD22C2013BDCF3334F490C1B00AEE24
Malicious:	false
Preview:	RIFF`...WEBPVP8LT.../o...w.mU..\..4...he.......#.V.....bM.....w....v.H?.f.....r.i.d....`.C;........9..<...[....)x+._..W.....+.6-{..^.}..u..:..eX1.3..MO.......m3..@.q..`D..]......I.......@...P.1.18.@ .8....(...@08..>.}.`....L....-;.m..S...Z.nds%... ..B...@.F.....E+...A.._L..c]+........_../^....m.....zC5H...s:.\....B........\6........$Y..X.uk5....^]!.CF..E.yi\G...[...ea.......ADx1X.c.=..H\........../g.M...a..o....y...l.I.g.?a..tr..+...b\.9..j...A.e.)s.........#>\|UTT.....0.. ..!^T...4..j.E.R.:.........$hqx8N.... ..x.-.@..A=Y..m.ZH..a.wh...a3..(.A;>FNOR.'gf-K.7.gRl......:...xb!.w...S!2.2....8rr.+..r$.;.I.i.v.U....w{sg...Zb...).@v.2...).uW..$$....=m..v.ikw..R..7....#.=+.[.$"..V...NK.J.D.g2.....N............$q..F.".R..i....Z......3Ak'z...J.J..=...[."J.V.(. I.U...:2.:...z..W......zo.......\|.w..\m...B.T...X.K. ....K...J.....9...qV&...........H.. @.M.d..5...T..'..$.....7"... .[.mW. .;...#..I.L..P...!c=..PM}L......p.P.&Y..G.8C......

Chrome Cache Entry: 264

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (10258)
Category:	downloaded
Size (bytes):	25993
Entropy (8bit):	5.197659011983423
Encrypted:	false
SSDEEP:	384:gCmZicQZ475qnk21+iMWvwa3LKy3fnFXT2C/c+S0pXBgElpplD0m84Uaaq5TV6s8:gCmP5qnk8vnFTk+pBg0G/Jue
MD5:	04CFDE13500A55B5365BDC75F52FC6EA
SHA1:	5C8AB36D8713FC0D4B33465613C6F5D1C15D77EE
SHA-256:	A46CF167F42B264D883D683DE404DD245DF9047F77FD93A7C7599986B4BFB94F
SHA-512:	5F891C23410E218F648324B00E2B4AF17E304F48C7F582D63259E630CAD46B3AF87D743A5268D6A57AE579B7671366D9EC7EECCFB3A1EF95702B8066D9F4E855
Malicious:	false
URL:	https://sc.sftcdn.net/scripts/chunk0-e19829.mjs
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[0],{147:function(t,e,n){"use strict";var i,o="object"==typeof Reflect?Reflect:null,r=o&&"function"==typeof o.apply?o.apply:function(t,e,n){return Function.prototype.apply.call(t,e,n)};i=o&&"function"==typeof o.ownKeys?o.ownKeys:Object.getOwnPropertySymbols?function(t){return Object.getOwnPropertyNames(t).concat(Object.getOwnPropertySymbols(t))}:function(t){return Object.getOwnPropertyNames(t)};var s=Number.isNaN\|\|function(t){return t!=t};function a(){a.init.call(this)}t.exports=a,t.exports.once=function(t,e){return new Promise((function(n,i){function o(n){t.removeListener(e,r),i(n)}function r(){"function"==typeof t.removeListener&&t.removeListener("error",o),n([].slice.call(arguments))}g(t,e,r,{once:!0}),"error"!==e&&function(t,e,n){"function"==typeof t.on&&g(t,"error",e,n)}(t,o,{once:!0})}))},a.EventEmitter=a,a.prototype._events=void 0,a.prototype._eventsCount=0,a.prototype._maxListeners=void 0;var l=10;function u(t){if("function"!=

Chrome Cache Entry: 265

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	5494
Entropy (8bit):	7.52409900411809
Encrypted:	false
SSDEEP:	96:vbN26MT0D5MdtbZPAVwzVdOu9wQDDPT5e7wKuxG3aRht0LN7T:v2YNMtKwvOj+PT5e7w+KRyN/
MD5:	7E57FA2E940C7EEF3E6D241066B592AB
SHA1:	3A92B2268C8EA6011FD4C1C65A30740A6797762D
SHA-256:	0916FC3D1CA0339E2BAA78B1A105E78C99F823D26A8F149A8AFD123E040238E3
SHA-512:	7EE5E65A51E68AF7BF5FA72416D9BD304F4E2EC14EF92494B370B95DE4B3F41C33EFD6FAF20E967E88A35B35E19B4FF94D6D6D2AB9C4416F84314902F73BF992
Malicious:	false
URL:	"https://images.sftcdn.net/image/upload/dpr_auto,f_auto,fl_sanitize,q_auto/download_intent/templates/corel-corporation/winzip-compression/winzip-feature-C"
Preview:	RIFFn...WEBPVP8X.... ......n..ICCPH......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1........

Chrome Cache Entry: 266

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21224)
Category:	downloaded
Size (bytes):	24203
Entropy (8bit):	5.349731623672621
Encrypted:	false
SSDEEP:	384:PLX1wtH+NTv0vDckjUhzU0ZppJeiUGg2TD7eC43YU/Us3ZYNbHG3W5AJdME9oPaV:jKtPQOaG3WFaoPaIK/zn
MD5:	F1DFC75C82E12DFE846D5593978E422A
SHA1:	12E580A708B09C9A8F4CA7CCBE9DD7DF32EDEE60
SHA-256:	08204982C484FAF6890C60557A4E642971F17625DDDDC0559DC0E3CA728AC9E0
SHA-512:	623412E6D454104251215E38A0F365F879EC70F77306769F5FA40E144C0EAB43237D1FE13B92031AD5848071A6A8910F01576F079E1A0904F4D8DD8959D922A5
Malicious:	false
URL:	https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),da=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}},ea=function(a){return a.raw=a},fa="function"==typeof Object.assign?Object.assign:function(a,b){for(var c=1;c<arguments.length;c++){var d=arguments[c];if(d)for(var e in d)Object.prototype.hasOwnProperty.call(d,e)&&(a[e]=d[e])}return a};da("Object.assign",f

Chrome Cache Entry: 267

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2404), with no line terminators
Category:	downloaded
Size (bytes):	2404
Entropy (8bit):	5.730233660426276
Encrypted:	false
SSDEEP:	48:C2BqQSzndKC2Bq/O2Bqhybj/5CSXAqS5wbGnydNnUq:C2Bq7zn0C2BqG2Bqhybj5PXxS5winyD9
MD5:	A0A16052D2DD7A8BF487546E33BE7D06
SHA1:	43206CA79CB5B8116F274C3EA3493A3823B02D74
SHA-256:	D40C590D51C83178FCD60A4BA3746B24C47C3FDB7BAB98D3E7D6ABCE0210B342
SHA-512:	CCAB826D174ED26C68917DCC3E20B5022E0C47C86A7C3630246C0B5C914F58A657EF41A67AE5303EE7E65E6CA974F87746DC35528301CF1F613E53531E76BDA6
Malicious:	false
URL:	https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=50010433&p=159047&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Preview:	PubMatic.loadAsyncImagePixel('https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=XcNYOf34TOinXAXATuqrfw%3D%3D&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F');PubMatic.loadAsyncImagePixel('https://us01.z.antigena.com/l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx 5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&rnd=RND');PubMatic.loadAsyncImagePixel('https://eb2.3lift.com/xuid?mid=7976&xuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&dongle=u6nf&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NURDMzU4MzktRkRGOC00Q0U4LUE3NUMtMDVDMDRFRUFBQjdG&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://cm.g.doubleclick.net/pixel?google_nid=pu

Chrome Cache Entry: 268

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	1858
Entropy (8bit):	7.906778253699032
Encrypted:	false
SSDEEP:	48:VIEZ+cz1ZKlMzg5dt9wYKOKTb2TPxBAAjedE29XMsG64a4hT1hkZq/l:V9M1qv+5BDjgdnG64dhTz7t
MD5:	0A97A63BA2C8EF736FEE45E5018185EC
SHA1:	495483AC27B0E446BEAF4E626E50BF13AA3B9358
SHA-256:	2F2ED5305B211A8B34DE5A8E454653D88429A727E72F9E3507F83185813D6122
SHA-512:	B29E313F5883A04983C1AC4E2C4A5C733CEFA93E944AA77F4934348D5953DF04AC9CB069092D064083A3409F271C9C56023339A2A6B2C14B9E214720725F3B4E
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/cb1bd824-9b5c-11e6-8412-00163ed833e7/977774147/dont-sleep-logo.png
Preview:	RIFF:...WEBPVP8 ....0!...p.p.>a,.G$"!.%.[...flg^h....O..K.Jf.....^.^a.."...5.{.{.+.1...m.a....Z.{..M...^...,w...}\..,u..EW/nN...!A..?....... .I.V.u..q.......F.<._......Z...X....m9&..C...6.^.F.$$........Z...."oh..b...W8...R$...#..F..x.\..5p.......Qji.w.E.q~9z...J7....v.3..:..@...2..o..._o....H...../.{......z....'U..@.^`g.R....'...YU...3.......7S\|.......$.e........D,.. t,..e.oX..........QR.E-].P{........[.h...:......'.3.;\|N.h.... .q. R.X..,<...c..4.y^.k....(b....n.v.f3........@...[...../W.8.`X+0..n...C...<.".80.$..S.xFj......].2.zy'...xc..R.9a..r@......E..1.T..C.e...../.].&.,......'.@3...`;q...a[.$:y...5.._..l.....^.M...[.YNv.N..}..W....^........=..-...1...[.vR^#..w......R.!.cA?...>..\..0sh:.Z..ZZ...9[....a.7.r....g....DZ=.;.f..Rl..u^UuZ..H..~I......0<.0...&h&......-......../.M\..P.Jc=.n.}..\|.%kX7uf.QS...T.< .qF2IO....M..@.:.D...v....,......>..8'<9.!.../...0..,4.4..l+.x...8]..&..E..B.f..)..1.3'.#.t..+....]7...=+....Yl.d2.2..l[....4ug.

Chrome Cache Entry: 269

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (5657)
Category:	downloaded
Size (bytes):	6162
Entropy (8bit):	5.599076700545423
Encrypted:	false
SSDEEP:	192:Sb04pPhtmpvftu/PvJ/CMMKJ8UotoqzpfLEj:s0i5fPJ6FEPkIj
MD5:	6AAAF8E11A32FD37FB419E3A4CE9696C
SHA1:	1FD88F2EE4DE5422E0C344DEBEFE3F2B5ABB2592
SHA-256:	468959E93F9B4E6F07C6A8F8D0E93D8FCB37D76A8615A93EC153F5842247BA99
SHA-512:	748B27BDB7C7FA082D7BE6C69F56DC33302105784391320A5CF960531C594097BC406FD3F4690E4CF74F4016F4D56804A4296E9BD885562EB66699E1318F7000
Malicious:	false
URL:	https://1686c5c93569299f12ff90d5926d8f70.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Preview:	<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8">. <title>SafeFrame Container</title>. <script>.(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f=this\|\|self,h=function(a){return a};var n=function(a,b){this.h=a===l&&b\|\|"";this.g=m},p=function(a){return a instanceof n&&a.constructor===n&&a.g===m?a.h:"type_error:Const"},m={},l={};var r=void 0;/.. SPDX-License-Identifier: Apache-2.0./.var t,aa=function(){if(void 0===t){var a=null,b=f.trustedTypes;if(b&&b.createPolicy){try{a=b.createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=function(a){var b=aa();a=b?b.createScriptURL(a):a;return new ca(a)};var ea={},u=function(a,b){this.g=b===ea?a:""};u.prototype.toString=function(){return this.g.toString()};var ha=function(){var a=v,b={messa

Chrome Cache Entry: 270

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (631)
Category:	dropped
Size (bytes):	650
Entropy (8bit):	5.3701102702330745
Encrypted:	false
SSDEEP:	12:U7Dlf8IBbRT7GajtMmbvbUE95Y2Pt60RB4FxTNfCYKO+kFl+pfVfCYKbEegvlMn:WDlf8vaJdbT7tt6xKO+kFlSnKbEeg9Mn
MD5:	918AFFA247A7DCBDBBD1DE45A91EB1D6
SHA1:	37354D44ED3A087F949D876887694D588FCDC180
SHA-256:	E5130F51CABEA24FAF26C2B2BE8513356326863546ABC9E7097C7C3B2127C585
SHA-512:	0FA0075947F4F1D9529FBE30685D147CEBBE9D100C4CFC273C53E2FDB85767814BA62CBCB8844B70B39627B8C85D3C133E03377E78F0A5CD3C27366B08177516
Malicious:	false
Preview:	/* aax response */.apstag.bids({"slots":[{"targeting":["amzniid","amznp","amznsz","amznbid","amznactt"],"amzniid":"JL9TjACL3nGPn1-O3GGZF8gAAAGMgWIshAEAAAxpAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICAIG7AU","size":"728x90","meta":["slotID","mediaType","size"],"amznactt":"OPEN","amznsz":"728x90","slotID":"top-leaderboard-1__ad","amznp":"puuhvk","mediaType":"d","amznbid":"j24g00"}],"host":"https://aax-us-east.amazon-adsystem.com","cfe":true,"ev":true,"cfn":"bao-csm/direct/csm_othersv5.js","status":"ok","cb":"0","cmp":"https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-onetag_pm-db5_rbd_rx_ox-db5_smrt_sovrn_3lift"})

Chrome Cache Entry: 271

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	1358
Entropy (8bit):	7.844592772516276
Encrypted:	false
SSDEEP:	24:t54jfCsf+Q3WBQZ7VvUD0SwNKUYcT/9rAKDYJn0Xr/zo5R/:tI9fJ6QhiDPFzMk3yjz4R/
MD5:	A191415D61AD3A4CE8B6B0208BEAB39E
SHA1:	FCD6E672C87B58FD8A076674F2061352BAF887C7
SHA-256:	B89376A902752249A2B27740903328CC2252A05315CF6068BE161B1CE5E83107
SHA-512:	9830AA6E4EF44DABC04D8519341670CC0268D584ECAC4AB8FC90F1433C68D4578070B38B58F11AA0ACD2FA97F9A346401511C6ADB6A009931513108D45DFABBB
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/2dd40586-9a63-11e6-b212-00163ec9f5fa/1465545482/adobe-captivate-logo.png
Preview:	RIFFF...WEBPVP8 :........p.p.>a,.F$"..&.;x...M...{]AJ.........y.............qg...W...v.PG.^E+w'n...i...\.-..v.-...~..X.v.Jl.#....dH.-.Zg.9.l..o.qWm...~...M...t(...X3Z..I....H..4.Y...s...R.].Z.K...v..D......./m...+Ws.k..\|...4..H......l.....\S>D.....9..RG_/..S.M:.".yx6R..!.y..a.=..'.x.[.....0..M....w.X.I..a..Z.b..G..d'l;..]....<.(....#....x.x......=..#R......E.....J.CY......tz....d.Z...=FI.1.8.X.Rt..\|.z0#..........o...<.......3Z.^.p..&$.$.?.!..J..m.[:..].K..u..c.K..TH@..;.@.u]...R...@py.Ny\|5.pR..G.G..<.......{.W..~..;U.\|..g.5~.W......MY..e.........J.;.w.....Y.+Y..z........v..6j.H..2....0.B....}{.\|.....f...Xpm....A..y.q.U........(.k...m.C..4o......:.J.iN.`..@#.l....<..8..G....,[Ax.,0.59Xz.)C.F~..2q..(X./.l.VM.i.9Xp....q..r..J7.C..-....\...v......D3.......4.v....ve1S..P0X?H..Y/....v...7..'\|..62.K.WWL....v..\|..C....\|.#...aS...:Y.@...b.Bk.f.8%..~....&.jwV6`o......s..R........\|L".8.Z.-]%..[.7IZ.......ki..:.t#..0...c.?.I..\|..l.F=6...."<

Chrome Cache Entry: 272

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1788
Entropy (8bit):	7.856115361880249
Encrypted:	false
SSDEEP:	48:db9hf28yX+9fT1XQ+h81Id/aLi8NIvxIxZW1sWxR:db9h+8yX+d1A+G1Ka3VQ1sWD
MD5:	791B7C3E8D9D3F86A247D3974C9C1C7F
SHA1:	4D04CCB147CB3D80F59CA23D78E4C8BF1E1BC766
SHA-256:	9DC96F637340D0BC96294705A083CC8951958CE0E6E64E9F0E3D19E4437CCD26
SHA-512:	E004D54956A9E4B34F2E7661723B44C5C685D6F29F68947803E882A66006943A1939F47304C267F65E0739233423A49FE4326C524E40FCBC0179DBF124A9D9BB
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/965565ac-96d3-11e6-9f43-00163ed833e7/2888512785/auto-mouse-click-logo.png
Preview:	RIFF....WEBPVP8L..../o......d'....@...z9..k.a$IJpM..#....]86.d+..?.QD..\...ew.... ..O.j.W..._...Q+!Y.oh...V-...B..B.`_.^Ry9..\j6R?.ep...\|..p....!.u.cW....+.J......{n=R._.N.......)=.r.}..u[....L.@PpL..t.Tr.....J._.}?.....;.....S...<~.....e.'..jf.;f.Wy&".d.....@ ......4.\|3.}I...-.DD.,.... ^,[_j..H......?/;Na5.......r{Bw...e.}%...@.=D ...@... .@.Y.6IC..F.c.s%.iW...D..@...@.....y..R.>. ...S....\|.....2./=ED0Ai....n.....A?}.4.vg..S.=.A.}......J......;b...^.`7~..S....].x..N..p.H..o..k..3..#...]P.!.z1..9...H]..O,.......^...~.....7...T..EU.Mp{...Ft.WS<.rq..4..a.'.o.x).c[.....@^..sW..%2.........+...a.1..k.. ~`W......n.j...^.4.m....JC....A..c.z.!....5.y=..... .-OB.....&...e.....u....W..`...s.XN......s.....OGy.MV....^...1.ls:........!b.+...0.o.S.#.FsF.3c.a....>G..t...`H.....'~WiS.~W.$dD...m3?l..s......t..E("...2Q.m.z7.......WZu.......}..M%.\|.~..t[4J.q..q.?N.$.DUc..6_pIUZ3R.JeW....L.....UiO..$A+.. .$...].y6Y..P.U.3.R.K.q.S$.'..WQQ..r .\|.U7..;.8X..5f........

Chrome Cache Entry: 273

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1047
Entropy (8bit):	4.337447160490376
Encrypted:	false
SSDEEP:	24:tdiutsCPSpLqTXtg1RPl5wQtT6zYbzzwIhGCfyqdG0OuU5WeRe:4CPSpqXtgnjwQhyYbzlfyl5WeU
MD5:	EBAECF4F1B8F157D30814C35DE75A06E
SHA1:	4AA2E335E997AC1611815D9114E65323A1DEF85E
SHA-256:	EF7768C313EA66869D68A301994C5A6B1FCF05058AE17606C82381D675B1B3B7
SHA-512:	9B11BC86ADB1EE7F9C80A75BD079B132B125AB24AC56116C926F0F754E19AEE9338F38C846E09425839152AB339F990DA14EA825EC928CB78AD0E8D60AB4C3DA
Malicious:	false
URL:	https://sc.sftcdn.net/images/8f649-ebaec.svg
Preview:	<svg width="96" height="96" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="#EEE" d="M0 0h96v96H0z"/><path d="m76.933 68.267-4-3.934V33.2H61.267L56.4 27.4H44.133L40.4 31.8 37.6 29l4.667-5.6h16l4.866 5.8h9.8c1.023 0 1.945.411 2.767 1.233.822.823 1.233 1.745 1.233 2.767v35.067Zm-15.6-15.534L47.867 39.267a13.733 13.733 0 0 1 5.633.233c1.844.467 3.456 1.389 4.833 2.767 1.378 1.377 2.311 2.989 2.8 4.833.49 1.844.556 3.722.2 5.633ZM32.067 29.2l4 4H27.6v34.2h36.933L20 22.867 22.867 20l53.8 53.8-2.867 2.867-5.267-5.267H27.6c-1.067 0-2-.4-2.8-1.2-.8-.8-1.2-1.733-1.2-2.8V33.2c0-1.067.4-2 1.2-2.8.8-.8 1.733-1.2 2.8-1.2h4.467ZM42.4 42.333l2.867 2.867c-.756.711-1.323 1.5-1.7 2.367-.378.866-.567 1.81-.567 2.833 0 2 .711 3.711 2.133 5.133 1.423 1.423 3.134 2.134 5.134 2.134.956 0 1.884-.2 2.783-.6.9-.4 1.706-.956 2.417-1.667l2.866 2.867a10.788 10.788 0 0 1-3.698 2.533 11.334 11.334 0 0 1-4.368.867c-3.13 0-5.79-1.096-7.98-3.287C40.094 56.19 39 53.53 39 50.4c0-1.514.289-2.97.867-4.368a10.788

Chrome Cache Entry: 274

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 24.1 (Macintosh), datetime=2023:09:28 08:55:59], progressive, precision 8, 970x250, components 3
Category:	downloaded
Size (bytes):	55783
Entropy (8bit):	7.688415177995569
Encrypted:	false
SSDEEP:	768:nm7fVJ7AYy4fI9J8cQou1C+S+lihfykb/F1LqUBaBo5TPL9PHa6WL2cAuPdTcN:n8VJMMfI8c8BMhfR2SJTPL9PJW1M
MD5:	2E450436C615BD552D2F70245C66259F
SHA1:	1063533E8C7DA37302A7998F26020CBF32D22D7A
SHA-256:	905D3E553E4422C5222B8C1280AE28AA047AABB4C71FD4CF8B8517C45E87E9BF
SHA-512:	C9DB525C1A5A3D848ABA5306A4B5FEB50F0DC284A09E4C55EC2ABE9A1A2BE30A428EC5BD14101B05E465142597059F002F4CE23885677305706199C30A7562EC
Malicious:	false
URL:	https://tpc.googlesyndication.com/simgad/1757919985712676004
Preview:	......Exif..MM..............................b...........j.(...........1.....!...r.2...........i....................'.......'.Adobe Photoshop 24.1 (Macintosh).2023:09:28 08:55:59......................................................................"............(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................)...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....0.m..pe4...>.......X~..`?.at...hs.C.-..?.......{..O./..>...2............^..}OOb...[.^/E..,....[q....9...b..w;......D........1D.2.1.1. `x...~n.....

Chrome Cache Entry: 275

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3385)
Category:	downloaded
Size (bytes):	208279
Entropy (8bit):	5.398431757224146
Encrypted:	false
SSDEEP:	3072:cY28k3G/4uD/KIUrm1r/rsr6LnsmmEC5NvIM+vYexeRpBC:52ZluDKOD66ommEoIM+vYexeRpA
MD5:	687F36959D3133324C89C89FA708B3DA
SHA1:	D95EECEF21AC59FF2D9359D452394EBFDBCD8181
SHA-256:	566012676F5D43ACFEA4DC0BC5D9BB2C0805D8775FCDD081B1C895310956829A
SHA-512:	CD732600D7F757FD7D031C035DB9445B2564936A79C1D8AD7B481FC295989C7D2C10BFC0C0CEC53656C99CE5479A76D5F231DDF2322C9AE2496611FC287B4F5A
Malicious:	false
URL:	https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Preview:	(function(){var n,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");},da=.ca(this),p=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.p("Symbol",function(a){if(a)return a;var b=function(f,g){this.Ng=f;ba(this,"description",{configurable:!0,writable:!0,value:g})};b.prototype.toString=function(){return this.Ng};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function(f){if(this instanceof e

Chrome Cache Entry: 276

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1470
Entropy (8bit):	7.861518596724721
Encrypted:	false
SSDEEP:	24:6CUN4wNf/BQ+/3UdzqYjupC549FLagx7yiz6YeavZw+fQMSc62T/EWIf7vro6:67N4e/v3U4EuC49g07y0naUQMztO7v5
MD5:	8C8105D90F61511F810219891F0B2881
SHA1:	813018B9492E1D6B93DC7AA3936862C9C01A0A02
SHA-256:	F281E94F09AEEA790E7D5AE9D2173E02864CCC184B36FA28CD25C899D6C3F00A
SHA-512:	457039BC4A3659DA418948DA12372ABF20082FD5AD320B8894B8D4AB1C1716B33EE9D057A6A4E0414228D19102E7858E29039817ABACA5DA987417E4A48066D3
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/334aaf61-1f6a-4201-bccf-a3ded19280d9/770400967/auto-clicker-by-shocker-2019-01-17_16-23-33.png
Preview:	RIFF....WEBPVP8L..../o.......$5v..$..6...........v...?..=..c.D..0...W...T(."M...k..J.r..0..oks.......s.......Bd.8r.......9.J..G...m-A+.s.i............r.c.'...^......... ..+%...I..K.....KG..1..P....8..@2.@:..... ."Sz.a.\|&8..g.d.9..\3....~.U..HV..=l.r.1b..r?.b.N.{N..G..v\|.G..X.!...U=.+.N..<'NU....C....P....lc....&..O..tC.q$..j......p..&.Nt.....t...2F."j.%.xl.rW..B.i....q.gg.k..7L..D=.FW.=y..7.0}x..#V..r}.I......=.."......v>..7.d.r....v.....n...X=#..zT..W.A.L5.3.#....NfLj..\t..l...#.i.X......r...=..6f.p...Y...y.\|.-.=...k.'...$M...Uo.@$#......\.EF.s..=.'...."...9CTVSm.Y...JG..j".J..r..b.1..(.(.M..(...)......=.gk...7n.\|Y.zl.$..e..o....g>..S.....j.-I.`JXu.;.W..+...-Ca.;..Fl.2.8....qd....p{..g{.....%..a....o.&.b..bsQ..Q9..d....P....z!..N..Wy)..*....cD.....PW...-.5...r._I.&"BzDUu......C:Y..T.H...$.<...Z..i..'t".\|x.%b..6.(.N.@>..Ml.....}Iu..i[.m.Ta.Uh...a.V^f.D.Q..f....r...,j..E..Rl.,.Jk.v.._.A......{..&.Y\d$.dc4.(.}.....O.?.2...`.

Chrome Cache Entry: 277

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1946
Entropy (8bit):	7.887815997628608
Encrypted:	false
SSDEEP:	48:W28I7l+0xQF03YOWcgVe2VTCWk0DpwSMBDljR8:WalP2BOqVuW9taRN6
MD5:	7FF4C502E037790CE6227B19619675FC
SHA1:	223B1AF8349AE015AB5B40536A601916C0FD4553
SHA-256:	458D676E6190E7616E60AA553AAF35E2D182717B3CE8F8BE762445D651B9B922
SHA-512:	A60DFB366CDA49DBEF9014AC8566F5EDD1F3409652D690051677DBCD1356458770A3B005D5684C431CE8DFD9099553C0966FC943A0D454DA2A82F21C42C1A3FD
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/150cc766-96d2-11e6-b2df-00163ec9f5fa/3495463056/rambooster-imgingest-8894989838885938086.png
Preview:	RIFF....WEBPVP8L..../o.....8.mU9..mO..Kx.....<....M.....-P..IU4....x.1.mU.y...C.1..!.;.>..........G.@..@......@......3.!rQ...8.lD...(...8]....=..Q\I.Kiy+#2Iq..U..:..,?..-.4.........A..)b...r.,.@.q.B....=&M.`vTv.[kl..!a..Nv.4.?.#a....A..Q..(.a.S.M.H.;B..P..Rz..y.$c..../S...R.)...o.8[.^tY..u...Ew?.....'...wt...3..C...%.E..?M..=...3.WV....5c...."^`..<$....&aK../.l/i}+.\|..w..?d...$..y,....v.y#..g......j..(..R.La4..........sW....~....I....<.,..}C.?.#...H.L...\.@U..aD.T..#.^...G.K......1../.............n..s....)..m-m...C..C.......es....t.-...fN..E.o..r...CV.g..\.K(KDZRS.Nc....H%..:&.v.^z. .....8G.yz..N...)...H...0.{.\U..F.H%.M4...>.z...?... ^7....}...M....h..l.!..(.....). .'. ...E.....Q.,.I\|..y.... ...j.V;)I...A$.].......zaf.M..i....(].\7..2z..C..S....d...i.<-...Xh..d..N..^.@...~..4"O3...y1.p.m./..t....3.nP.......A.t@.:0....^..E....\...%D.&......(M.*i..... M:..b..".$6..wa.FLO;M...5g.j...`.vIS.$sp#.h..@........q.r.....I..W.p..G.

Chrome Cache Entry: 278

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CMuD1rmWm4MDFXrMKAUd-d0Afg;src=8876029;type=invmedia;cat=progr0;ord=2316977282064;auiddc=*;u2=%2Fprogram_page;u3=Caffeine;ps=1;pcor=858286563;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 279

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4784
Entropy (8bit):	3.9721485663017044
Encrypted:	false
SSDEEP:	96:Bouxwz5h53V4k+cdKDDza8ybSO0fgwH7UCZALg0AVEwh5V6sFdhW:dqhlV4EdKj7t/ZGZwh5gsFdM
MD5:	0D0266082D3445D092A0AB632D09A23E
SHA1:	D871F8C8A06E5B4DF9C5E75F9728A27E980591E0
SHA-256:	2088F5AA1EBFAB0D8DE47886B0418C34F5B36D5B19286B9C87616547DFA3562D
SHA-512:	E5F8CE6808AAAE984B60426B3F359BEC4883A74920AAB094299720EADC3AA9F04EAB1BB24E450E71F5A797543495FC168D5C0B96775DFFF16E0426A93062F0EE
Malicious:	false
URL:	https://sc.sftcdn.net/images/fa090-0d026.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg version="1.1" viewBox="0 0 505 141" xmlns="http://www.w3.org/2000/svg">. <desc>Softonic</desc>. <path d="M170.758 62.53c-7.004-2.842-10.066-4.508-10.066-8.548 0-1.752.426-2.816 1.47-3.677 1.816-1.513 5.38-2.344 10.043-2.344 2.647 0 5.574.264 8.462.766.213.042.474.069.733.069a4.12 4.12 0 0 0 4.033-3.288c.012-.059.022-.12.027-.182.212-2.289-1.35-4.328-3.493-4.583-2.341-.404-5.928-.878-9.822-.878-6.753 0-11.876 1.417-15.231 4.211-2.914 2.33-4.468 5.762-4.468 9.906 0 9.87 8.72 13.446 15.088 16.058l.195.08c7.565 3.145 11.846 5.226 11.846 11.403 0 2.77-.874 4.693-2.748 6.057-2.006 1.437-5.206 2.202-9.242 2.202-3.474 0-7.293-.572-10.751-1.608a4.304 4.304 0 0 0-1.242-.182c-1.844 0-3.427 1.133-3.939 2.82a4.023 4.023 0 0 0 .34 3.126 4.129 4.129 0 0 0 2.458 1.99c2.464.755 7.474 2.032 13.143 2.032 5.801 0 10.567-1.306 14.169-3.88 3.892-2.885 5.935-7.22 5.935-12.556-.001-11.948-9.791-16.021-16.94-18.994ZM233.725 42.438c-4.818-2.69-10.257-2.69-12.87-2.69

Chrome Cache Entry: 280

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	9494
Entropy (8bit):	7.979161884418148
Encrypted:	false
SSDEEP:	192:XRmsZ+x4qRk0ulleGiwuo3SshrDJ1EeySp5rUV01N2aTPXfJna6:Bma+x+VPXiwuo3SsRDJ1EeVfZwoJt
MD5:	EF445239DA92732C3F542C3CAD5A329A
SHA1:	B402A35BCE9FB1916DF2240DB4A40411B70A35E4
SHA-256:	27275FD6E453849F8E9FFC75B40FA8AAFF73ED5A9F92B9BE2EEB660AE05916D2
SHA-512:	DD26E6F121F7FF870A9624AF09982C8006A8F3C0DF1A262250BEF2A7E1BF279EF5BCE3325477D0056A3B1EFA2F7F60432E34CF2639444972DEFB6D219F4ACECE
Malicious:	false
URL:	"https://images.sftcdn.net/images/t_app-cover-s,f_auto/p/f46a4db4-96d4-11e6-b215-00163ec9f5fa/459745949/caffeine-screenshot.png"
Preview:	RIFF.%..WEBPVP8L.%../S.5...9.m..Z.\.........Y.{..G.m..:.~ww......a.........}.@.m7../...i..ZG5M{....Y.....+........0".#@..("..U......F.. . .....J....A..".....$...F..(@.........zF..QD...uFD5&.q.`8...7..:(.d `..H..@.....s.A.....9%yRL.uN...FfKP.uV.Z.......b....~E; ...B.7....&..........;Z....+...v@..Dkr....S....9..J.]....(....R.3...Y.'X.?[6]._T~...........N3....s...I...7tS.P....k.c!l~.H`.B;.:......&....-.t....w...+-.e.%....8..u.....k-X.t..JT..bd.frnr^.]....&?...UM. .i....5_o.f70N2..mMV..o..+.GU_W.....k..T.R....k...}.....9...\|.y.4..5.2.C..).1l.....UQ.Y.v5.uM...............v.`=...m.0I.......@j).M..WA.RmPR..=m#.3...L.w..2.,..L.r.goc._.c.r.,..D...#.q.nr.$W...~..m.S........fGY.n....h..1..p.V.i.S..ef.C..s.qt)...I."...m.I...wO.s..h...Q...?O.{..4r<..Fhtp..~.;..U..D......3....l.9.b.%.....X.M.U.}J....?-..T.<].#.V......S...w.._..m....k.;.>...K.....H..E.Ru......I.f..s.5.Q.z".e>.vN...?...~.-..q....q.U>".%..4.%j. jYP...B.x!......~uP).&LW?..T.].8.,.j.w....

Chrome Cache Entry: 281

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1132
Entropy (8bit):	7.788035787250117
Encrypted:	false
SSDEEP:	24:uYZaOrH7g1q2QAsMF6Az/0JBZrgXsEEpa9NJM9auR7:pprH01hscV/yBZMaa9v4HR7
MD5:	B72D387806EFDED87CA5235A747204AA
SHA1:	9E3520E6997E6EBF7B5EB5EF4196B002BB865CB2
SHA-256:	62B78FBEAAC879A591FB7563CE48AEF32F7E8C4C38CCE05BC8D9EEDC8BED7697
SHA-512:	B74CF0A002ABA1E70E7194A40441C9B30DA003E8FFF55A92193007D6BB47E755E21103355FB6B627D5A6BBF8C619ED3A46DFBC4C59CF58FD5BFE083B5E2CED8F
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/3d8efac1-f5f7-4697-9234-7a5653b4c724/455719081/hp-t5630-thin-client-drivers-logo.png
Preview:	RIFFd...WEBPVP8LX.../o......m..?......A..v..@...............,.l.....`.d..I.$..D(.h.....@VV.=...%[..n...rB._p..m..Z...p..rc.....mp.K...uV..Y.T.z.V..Q...o_...3..U...G....<K....~to..e...f.~gqI5?.d.X...\|.%W.U>uX.ik}.4.Wx..(.....Hd..u..SY,Q7..+?..JS.4..<..C...3.0..oBB.3C.W._....~.^Q.Z....f(.".@......!....i.C5.q....0TG.m."...J..[.2TKI4..P.1. ...S!...f^..Ya. .....P.z8.D.....@...j!..gy..W.. \3..........Te$..w...D..!J.c.a...L.h..rt}~]....o.9...H.X..I....Q:z.....wX.n,.C....P....2..O.....9....f....Z.....a?....e...:..h.....$b.y..^.<.P..0.d.!..Z...f>...o.\|..v.-f>......ChO...].2..89.W.0.B..'...6}......D.k?....<..)p.....<.<....'.bK....j..'...CA.....3....!.&09.......L.P.'<.'..l.eh.0.8.`..%..-g..E".5.P..G........m.B..d.u.C..!..\|0..w.....P4.e....M3.[...Q..#..f(........$...8...7......:2.EJQb...A....Tr#.uQz...9.'K.^...+.....#..r..o..Od..!.'..Vv.x...0..rT....Y.{e...%.K.q..K3V..h+.s...!.q.H..!.Su.T...ip..u.Rn...:Q,}..\X.....v+..V...:`,2t...@.Ig...Ja..!.

Chrome Cache Entry: 282

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	10936
Entropy (8bit):	7.975712792356347
Encrypted:	false
SSDEEP:	192:ZbrTa21117sgkICCkSLhTDkakB8TnRClSkP4sDUwHKyA4oHCQR6zfZoJ39H:ZPTa21eINZLhTDpkKRESkP7JsCQOO
MD5:	07D66256353F78FE4FB42E83EDC10CF7
SHA1:	97424B9650E7D397674A78E381DDF40BE00B64BA
SHA-256:	7DE5D8DB58D634F603230D0A02ADC32D4FB4668D2161150461CF7CF947B91750
SHA-512:	4F6AA2188A613F0DD1C5E9372E8EEEEFC4591BCBCC40E7B444230B0FF227009795D20EAEF3D61B603B9BA136B015E060A504EA085E71A8982C384F8B000135D4
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-m/p/c54fc26c-96bf-11e6-8c1a-00163ec9f5fa/3166854956/realtek-hd-audio-drivers-xp-logo.png
Preview:	RIFF...WEBPVP8L.../..7...9.$ERT.23...[.E..S.T.(.;.m......H..Gr...r#...g.......}w.2....0..J.:.....?J...X.0X..,0....rB...1.B... ..f.C..e.P @.R.....,.1.........C. }B.8...@...9.....4T..@..4..M#..Lgd.?g...g/.d67D..I9S..fm.1.jX...3..z6D5T...O..[..o9.rj/. ...;..8..jT.6j......Z5.......zy6n'B.iTx.Z_?.....aG....en...V...z..&.^.u.?..@Q...X.8....Ex....r.......YA.;..Z.U..xz.=^.~.e..i..........T.N..n..m....M..2..N..J...9.G:6i$......v.a..;..^,!...h...:..8..B........d.j4.\.....F.....w.....g(..ldf........ E0br..!.D...M.+9...{E....Z..F..~z<"./..$.mrv..%...(.o...?......wAw9..Y........8<]WtDY.....!..,.Q.....;b.I...;..>...........\|......d......h...O.cO...,....y].........g.1..(...2..[..h.Q....\s.~...W.F.W.C.<7..Ez...`\|.@.....U6.....x..v...]........?Y...L..Ny..N].j..4....".....M...8..!..@...7$...o..._....=a.b,...S.EuVx\|6P.[q.?..D....%e.\|pe.c..\..P........^c..K/.o..XM':Fdd..31&..H.11.....}..Y..j\|T.....\|xqyu...p3<E..gg..J.K...2s.,.....j...6."_Y..]z<.._.4].z.0

Chrome Cache Entry: 283

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10209), with no line terminators
Category:	downloaded
Size (bytes):	10209
Entropy (8bit):	5.175974769560627
Encrypted:	false
SSDEEP:	192:AfUacTSC1+Yy2+C30aS3J1CL0NWZdFdQCAzFT:5+Yy2xS3c0s3dQJ
MD5:	A89DC09948BD6F311B82C1A888058E1F
SHA1:	135E9195C4BD64995F872D0D48F41CFF3BB50DDB
SHA-256:	E110A6D62E59F3066604D8124754F1A5589A6C0EABAFD02D980099B84BDDECA2
SHA-512:	C2AC8554885E901CFCB1CBF4074182CA1DC8E9640E6EF5AFDBDD3215CDBC5114AC126E19DB4A68632218C2B71CE535649860AF6F9E182B1B17D67C39A8FE60CB
Malicious:	false
URL:	https://sc.sftcdn.net/scripts/chunk7-cf6bbd.mjs
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[7],{129:function(t,e,r){"use strict";r.r(e),r.d(e,"boot",(function(){return w}));var a=r(142),o={start(t){var{displayType:e}=t;if(document.querySelectorAll(".js-button-loading")){var r="desktop"===e?"top-leaderboard-1":"top-mpu-1";Object(a.c)({downloadButtonsSelector:".js-button-loading",revampAdsEnabled:!0,slotId:r}).start()}}},s=r(143),n=r(2),i={start(){var{hasDirectOrExternalDownload:t}=n.c;t&&Object(s.a)().start()}},l={start(){Object(a.f)().start()}},c={start(){Boolean(document.querySelector(".js-modal-security-status"))&&Object(a.k)(".js-modal-security-status").start()}},d=r(20),u=r.n(d),{displayType:h}=n.c,p={start(){Boolean(document.querySelector(".js-button-social"))&&"desktop"===h&&new u.a(document).on("click",".js-button-social",(t,e)=>{t.preventDefault(),window.open(e.href,e.title,"height=500,width=600")})}},_=r(144),S=r(25),g=r(148),m=r(146),f={start(){Boolean(document.querySelector(".js-modal-user-rating"))&&new g.a({mod

Chrome Cache Entry: 284

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	2116
Entropy (8bit):	7.911979637767656
Encrypted:	false
SSDEEP:	48:M7lQglFnzN8rFUCPqi67v2RKMRhrzCc4IbB8HI8X8I:MhjlFJuCiPK6Icb6bH
MD5:	8507E6E841B838DB669FD465275DA20B
SHA1:	972E3714D4E543877F3019E602226768A8427CCF
SHA-256:	921C98029D132A4A23CAA6995174E0BA48EF62BE1D9817FA58D34240FE2D1724
SHA-512:	9A07C8231387DDB8C19A0410288F4F61008DB49C80079CDFC368F02BDC1EAC5FB6487008DD5691B62B6CA817FAD5A9884F0679F6B0C028FEBA988F751FB1B007
Malicious:	false
Preview:	RIFF<...WEBPVP8 0....&...p.p.>U&.E..!....8.D..<x.(bE6..h<.n.~.u.z.t...~..D/?....r.w.y../........?......O<.......=@.k.'.O...v.z......?.}.?7...\...w.......9...C...O....e..vk:.B....Y..r....b.T .......e..f.W.}/...F.0..c1.II;.W..f...NrQ../;.[.yG.......r..I.........3...Q.\b..,....2z..P'N..v.A.......u.....m.t...s...f.......`..[..b."3..Y0.d....F-4...>.pC=2.$<..c..ar.Q..........g..N....n-.q...e..$.}]..._.m.M..Z..c.^......E...FK....X.F.q..$Z[.7..(...-..w"..w..;4"C..-..%1D.....>=^.O.w./.8";.9S..(g..3....>..3>..s.[......F.P..;.f.......M.......u.L...h.`2...O.@....+;......J...!.......`.;.H.-"$....s..d.....qx.../...78...3ZL.O...t.i..>..B./.D.....Y....\|c.......]9.=..I.U.l.be...<l....y.-.....r...v\..t.c.\|...o..rX~...{~f..y..\|.iq=.2.VT5...1.....z.9.o.U.jdg..].^....6.~....3?.Cp..N..i....[.?%.....f7.9.AfX...>G.h.....d:....0.Az.A.+.+?P..n.}>l..!.j...a<u...0qDw..4q...`...A..`.5....Sx.gM.Q.0...j..F..I..@.......5TG..`}mj..~...\...W...^%.}PU...=.S).5...h/(.Zm......

Chrome Cache Entry: 285

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	1286
Entropy (8bit):	7.825549453655853
Encrypted:	false
SSDEEP:	24:bLaI1WRaTSgYFDnfUNbFufTtydhlLrEKwkvOvBL+ZpJsctdeocGfp+:PZwRaSDfsIYA7BByZEqM
MD5:	E26B39A76ED63EE236E82070D36E7A0D
SHA1:	E32D3F33DA13D2DA8332FB6DF199AC545402487A
SHA-256:	2D9EFC3895A23B7F678620ED7D3A840C85AAF8B548F5F9D2D68865355E597DB4
SHA-512:	746B2C0BA776A7975CB95CE505C6B4DD97D87FE8EB710C3F38C9217E46718BEC17EE7E3321E3629A20FEA974C3A92BF670ABCB7020499DB50298C735F7F53580
Malicious:	false
Preview:	RIFF....WEBPVP8 ....P....p.p.>]&.E#.!..n.8...h.....M..y...:......._...+ht3...-.\....J..M.k..M.U..y..5..a....~<uE\v..y%......V.L.T..9FV...~..B..HP.j..........sK.V..B$..R.....z......;.9[fhve.1....H.-.S6d..,...@Z....U...../........S.S....`G....T{j........d!..?H..;...7...+..C.\|P..Lrn..3i....\|7#2'..so..9.-O..I...U8.."?k.-h.i2.].,..D<wJ....@...!.?..O....f.....f(.w.n.>.5.....r(...i...Oad.F..Ui..S...# ...f.8B.....%..O..x$.@..T64,\....G..uN2..k.....w.Dc..I.O&#!..xV.!..9a.J.g.+..1Cv......o..".w!..ai.!........M.N..;@.XyK.+Kct"?u..oQx....^.....q{.u..9>..z..o....]...y.@U.....]...}.H......[..F......<.........N./...?3M....m.{....)O.j.3)....3...j......Z....A...n..#;wI...$.C.!.....F.y=>...>.}...F..GrMZr_.o.1........u..T:..Q.6!F...3...B..M$kp.....X.rk.pI..X!{O...F(.a....N.....>.MpHIc%..s.....>Q'...~+K..xAp.H.5..vy...m...GJ..m^...}.F...`..3Iv..LW..I [,...xH.`~..v...b..1............l1..(.q....N.e.S..p.bf...i.}....A=.92].......Gp......t....[.6......

Chrome Cache Entry: 287

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24501)
Category:	downloaded
Size (bytes):	46438
Entropy (8bit):	5.399669114699974
Encrypted:	false
SSDEEP:	768:9fK/z/+l/s/sHs1Rfo0h2FwXLuUYKriG+LEcbnXcf+Y2qisXtQp:9fuL+l1s00/TrqLEcbXcmuXtu
MD5:	E84A9EADA0927E610A29935F6806D3F7
SHA1:	D19ADD1A086D487F735081313571D8B69C60A713
SHA-256:	A072859B1EB0DD71B17DFFC8A1259A7B1BF7C475774213CFBB125429B375B297
SHA-512:	10BEE03A47B075A45B99070AE06D98C8DA4C03973D757B5381B36C28EFCFE3A6A0B04C63B46F0481A1761A69F3B80734DA1C70EE781BE2487F95A529F4EFA48E
Malicious:	false
URL:	https://eus.rubiconproject.com/usync.js
Preview:	var comments = 'User-Sync: generated: 2023-12-18 15:56:11 PST';.var rtb_sync = {"consent_rate":100,"reset_rate":40,"ttl":14,"sample":100,"max_pixels":16,"pixel_sets":{"rtb":{"sample":100,"pixels":{"1185":{"ttl":7,"img":"https:\/\/ad.turn.com\/r\/cs?pid=6","secure":{"img":"https:\/\/ad.turn.com\/r\/cs?pid=6"},"priority":7,"partner":"amobee"},"1902":{"priority":17,"ttl":2,"img":"https:\/\/cms.quantserve.com\/pixel\/p-e4m3Yko6bFYVc.gif?idmatch=0","secure":{"img":"https:\/\/cms.quantserve.com\/pixel\/p-e4m3Yko6bFYVc.gif?idmatch=0"},"partner":"quantcast"},"1986":{"priority":7,"ttl":1,"img":"https:\/\/ib.adnxs.com\/getuidnb?http%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4894%26nid%3D1986%26put%3D$UID%26expires%3D30","secure":{"img":"https:\/\/secure.adnxs.com\/getuidnb?https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4894%26nid%3D1986%26put%3D$UID%26expires%3D30"},"partner":"xandr"},"2046":{"priority":13,"ttl":7,"img":"https:\/\/token.rubiconproject.com\/token?pid=2046&pt=n&a=1"

Chrome Cache Entry: 289

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	1858
Entropy (8bit):	7.906778253699032
Encrypted:	false
SSDEEP:	48:VIEZ+cz1ZKlMzg5dt9wYKOKTb2TPxBAAjedE29XMsG64a4hT1hkZq/l:V9M1qv+5BDjgdnG64dhTz7t
MD5:	0A97A63BA2C8EF736FEE45E5018185EC
SHA1:	495483AC27B0E446BEAF4E626E50BF13AA3B9358
SHA-256:	2F2ED5305B211A8B34DE5A8E454653D88429A727E72F9E3507F83185813D6122
SHA-512:	B29E313F5883A04983C1AC4E2C4A5C733CEFA93E944AA77F4934348D5953DF04AC9CB069092D064083A3409F271C9C56023339A2A6B2C14B9E214720725F3B4E
Malicious:	false
Preview:	RIFF:...WEBPVP8 ....0!...p.p.>a,.G$"!.%.[...flg^h....O..K.Jf.....^.^a.."...5.{.{.+.1...m.a....Z.{..M...^...,w...}\..,u..EW/nN...!A..?....... .I.V.u..q.......F.<._......Z...X....m9&..C...6.^.F.$$........Z...."oh..b...W8...R$...#..F..x.\..5p.......Qji.w.E.q~9z...J7....v.3..:..@...2..o..._o....H...../.{......z....'U..@.^`g.R....'...YU...3.......7S\|.......$.e........D,.. t,..e.oX..........QR.E-].P{........[.h...:......'.3.;\|N.h.... .q. R.X..,<...c..4.y^.k....(b....n.v.f3........@...[...../W.8.`X+0..n...C...<.".80.$..S.xFj......].2.zy'...xc..R.9a..r@......E..1.T..C.e...../.].&.,......'.@3...`;q...a[.$:y...5.._..l.....^.M...[.YNv.N..}..W....^........=..-...1...[.vR^#..w......R.!.cA?...>..\..0sh:.Z..ZZ...9[....a.7.r....g....DZ=.;.f..Rl..u^UuZ..H..~I......0<.0...&h&......-......../.M\..P.Jc=.n.}..\|.%kX7uf.QS...T.< .qF2IO....M..@.:.D...v....,......>..8'<9.!.../...0..,4.4..l+.x...8]..&..E..B.f..)..1.3'.#.t..+....]7...=+....Yl.d2.2..l[....4ug.

Chrome Cache Entry: 290

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (31445)
Category:	downloaded
Size (bytes):	102861
Entropy (8bit):	5.47882858741267
Encrypted:	false
SSDEEP:	1536:2NHBKMPZpV8m1b2PZvQvS/rEye+uttaSWgY5Rjlb5nDUrFrPhO103L5M/+:qAU2PRQK/Yy/ut9WJ5RjRdUrFVtK2
MD5:	9E56CB5ECB723C8DC4CA44E166053466
SHA1:	1456821FF493C15BD0447FDD78D3A8039123E53F
SHA-256:	F33F6A0454B8702F25DA3736B82EBC84F16B41D75D4F8034886D954F89B8FB93
SHA-512:	5D813ED4382FCA15BA4328D8353CD3F0156941C2E0C455D8A8D468DE754CC750D314FB457EC3F070BB2F27FDA257AC34FF75F52E19FE7E09E4A02E75A1A5F1AE
Malicious:	false
URL:	https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Preview:	<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8" />. <title>Topics Frame</title>. <meta. http-equiv="origin-trial". content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0=". />. <script>. ./.. Copyright 2022 Google LLC. SPDX-License-Identifier: Apache-2.0./.var m,aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find

Chrome Cache Entry: 291

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	10936
Entropy (8bit):	7.975712792356347
Encrypted:	false
SSDEEP:	192:ZbrTa21117sgkICCkSLhTDkakB8TnRClSkP4sDUwHKyA4oHCQR6zfZoJ39H:ZPTa21eINZLhTDpkKRESkP7JsCQOO
MD5:	07D66256353F78FE4FB42E83EDC10CF7
SHA1:	97424B9650E7D397674A78E381DDF40BE00B64BA
SHA-256:	7DE5D8DB58D634F603230D0A02ADC32D4FB4668D2161150461CF7CF947B91750
SHA-512:	4F6AA2188A613F0DD1C5E9372E8EEEEFC4591BCBCC40E7B444230B0FF227009795D20EAEF3D61B603B9BA136B015E060A504EA085E71A8982C384F8B000135D4
Malicious:	false
Preview:	RIFF...WEBPVP8L.../..7...9.$ERT.23...[.E..S.T.(.;.m......H..Gr...r#...g.......}w.2....0..J.:.....?J...X.0X..,0....rB...1.B... ..f.C..e.P @.R.....,.1.........C. }B.8...@...9.....4T..@..4..M#..Lgd.?g...g/.d67D..I9S..fm.1.jX...3..z6D5T...O..[..o9.rj/. ...;..8..jT.6j......Z5.......zy6n'B.iTx.Z_?.....aG....en...V...z..&.^.u.?..@Q...X.8....Ex....r.......YA.;..Z.U..xz.=^.~.e..i..........T.N..n..m....M..2..N..J...9.G:6i$......v.a..;..^,!...h...:..8..B........d.j4.\.....F.....w.....g(..ldf........ E0br..!.D...M.+9...{E....Z..F..~z<"./..$.mrv..%...(.o...?......wAw9..Y........8<]WtDY.....!..,.Q.....;b.I...;..>...........\|......d......h...O.cO...,....y].........g.1..(...2..[..h.Q....\s.~...W.F.W.C.<7..Ez...`\|.@.....U6.....x..v...]........?Y...L..Ny..N].j..4....".....M...8..!..@...7$...o..._....=a.b,...S.EuVx\|6P.[q.?..D....%e.\|pe.c..\..P........^c..K/.o..XM':Fdd..31&..H.11.....}..Y..j\|T.....\|xqyu...p3<E..gg..J.K...2s.,.....j...6."_Y..]z<.._.4].z.0

Chrome Cache Entry: 292

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	6593
Entropy (8bit):	3.9823832439312157
Encrypted:	false
SSDEEP:	96:JBcMTMYPn/bH+StLz0rWb2uSeLGOTgwOu/vAbxA/WKSmtWoWzIGrJZg9BX84vn9j:Jff/z0tOsbxdKSVMeJGbX84vt
MD5:	8A5EC86F9E44863FD94329CEBAECB4D1
SHA1:	8FA7FFE302640A4FD585151C6DE1EFE322CFE8F2
SHA-256:	D8DAC4DFB15299ED2B7C3B13A3EE6AD080342EE87638F44190DEA188EA674120
SHA-512:	92CE2CA3B996B75F27CFAADF679794A150D5DE34661A327ED1E357205C8CA3367C9CE21D23CB8D9575A8C820CD4038672127BCAB35EC121C7A2B9EA42CAB4B82
Malicious:	false
URL:	https://storage.googleapis.com/storage-proxy-assets/revamp-di-sft/corporate-logo-nb.svg
Preview:	<svg width="113" height="32" viewBox="0 0 113 32" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M38.0473 14.0885C36.4867 13.4436 35.8045 13.0659 35.8045 12.1487C35.8045 11.7512 35.8994 11.5095 36.1319 11.3146C36.5365 10.9709 37.3307 10.7823 38.3697 10.7823C38.9595 10.7823 39.6116 10.8425 40.2551 10.9561C40.3025 10.9659 40.3607 10.9717 40.4184 10.9717C40.8535 10.9717 41.2314 10.6581 41.3171 10.226C41.3198 10.2123 41.3219 10.1983 41.3232 10.1846C41.3703 9.66493 41.0223 9.20225 40.5447 9.14422C40.0231 9.05295 39.2239 8.94507 38.3564 8.94507C36.8516 8.94507 35.7101 9.26662 34.9626 9.90101C34.3133 10.4294 33.9671 11.2086 33.9671 12.1487C33.9671 14.3885 35.9101 15.2001 37.3289 15.7928L37.3724 15.8113C39.058 16.5254 40.0118 16.9973 40.0118 18.399C40.0118 19.0271 39.8171 19.4639 39.3996 19.7736C38.9527 20.0999 38.2395 20.2734 37.3402 20.2734C36.5662 20.2734 35.7154 20.1436 34.9448 19.9081C34.8541 19.8807 34.7616 19.8672 34.668 19.8672C34.2573 19.8672 33.9045 20.1241 33.7904 20.5071C

Chrome Cache Entry: 293

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1811), with no line terminators
Category:	downloaded
Size (bytes):	1811
Entropy (8bit):	5.340217063448736
Encrypted:	false
SSDEEP:	24:kRoBfiLqSYckSyJlVduSYmKOPgEFYSY0GLSYAb1NSYCRwKIZZmoL5SYRpKSYoQST:koBfiEckS41kmRFwDq9CXwPHRWnmvpTt
MD5:	6B89CB1D08D775F4EC87CBFC76B5B162
SHA1:	69FBEE0C52B8CDCB46903FDC499DE0534B1FEC31
SHA-256:	A326DF8DF19A4DB8BC6FC6D571CB45A11633650AB9DBE2D9FCF79C5DDFECBB85
SHA-512:	B4FBCCB692F69D60427D0E71988FEB6FDC5D4ABAF4909671F55212AAAFDC4914A105DF4C8323E314C868EAB25717EE9C1AC1138DD754B5C4AAA91E44BDADD3CA
Malicious:	false
URL:	https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Preview:	<html><head><title></title></head><body><img src="https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZYFg05BR8MuggUMSNtG2uQAABfYAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZYFg05BR8MuggUMSNtG2uQAA%261526&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZYFg05BR8MuggUMSNtG2uQAABfYAAAIB&gpp=&gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://match.adsrvr.org/track/cmf/casale" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48" style="display:none" width="0" height="0" a

Chrome Cache Entry: 294

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65386)
Category:	downloaded
Size (bytes):	441821
Entropy (8bit):	5.499428895441287
Encrypted:	false
SSDEEP:	6144:AEEySk7DGM3/JmGCbMo0lJNEZq8VKfzGeTjBjmW3SJ307:AseMVGZnIfDBjbkU
MD5:	215B1CE47FF4A077F99C8184CFA83D00
SHA1:	1CE5DAAA88B96D37B996D95B396CADEC2E89B521
SHA-256:	108CDB682E1D256BA58174D96775EC12FE2E9515FFA2CA7EDFFF49343A4D97EA
SHA-512:	01A0EF0D70B45DE9963806D6337759740D05DEA41D77A8FBE8837440469AC58993CEF00722082391B10CF06846EDC9FD5F45F65C2FD66BF1858EE46AC07CCDD3
Malicious:	false
URL:	https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Preview:	(function(_){/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 ./ ./ . . SPDX-License-Identifier: Apache-2.0 .*/ .var ca,ea,ha,ja,na,pa,sa,va,ua,wa,xa,za,Ba,Ca,Ea,Ga,Ka,La,Ma,Na,Qa,Xa,fb,ib,kb,mb,qb,tb,xb,zb,Db,Gb,Ib,Kb,Lb,Qb,Sb,Rb,Ub,Vb,Mb,Wb,Xb,$b,ac,fc,gc,hc,ic,jc,kc,oc,pc,sc,tc,uc,wc,xc,Cc,Ec,Bc,Gc,Ic,Kc,Mc,Nc,Oc,Pc,Qc,Rc,Tc,Yc,ad,bd,cd,Wc,dd,Vc,Uc,ed,fd,gd,hd,id,jd,kd,nd,md,pd,qd,sd,wd,xd,zd,Ad,Bd,Dd,Cd,Jd,Ld,Kd,Nd,Md,Od,Qd,yd,Vd,Wd,$d,be,de,ee,he,ie,je,ke,ne,oe,ae,pe,qe,se,te,ue,ye,ze,Ae,we,Ge,xe,He,Me,Oe,Qe,Se,Te,Ue,af,bf,cf,jf,kf,mf,nf,of,pf,qf,sf,uf,vf,yf,zf,Af,Df,Ff,Hf,Jf,Lf,Nf,Qf,Rf,Sf,Tf,Vf,Wf,Yf,Zf,ag,cg,dg,eg,fg,ig,kg,og,mg,sg,tg,ug,qg,rg,vg,wg,xg,Ag,Bg,Gg,Hg,Og,Pg,Sg,Wg,$g,ch,eh,gh,hh,ih,jh,kh,lh,nh,qh,rh,xh,Eh,Hh,Kh,L,Lh,Rh,Ph,hi,ji,li,mi,ni,si,vi,Ei,Hi,Ji,Ii,Qi,Ri,Si,Ti,Ki,Ui,Li,Wi,Xi,Zi,$i,bj,aj,dj,ij,gj,jj,sj,vj,nj,oj,wj,zj,xj,Cj,Dj,Ej,Hj,Ij,Nj,Oj,Zj,fk,dk,ek,kk,ok,qk,rk,sk,uk,yk,Hk,Bk,vk,Qk,Ok,Pk,Sk,Uk,Xk,P,Zk,$k,al,cl,el,fl,nl,ol

Chrome Cache Entry: 295

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (789)
Category:	downloaded
Size (bytes):	988
Entropy (8bit):	5.5772380438353855
Encrypted:	false
SSDEEP:	24:2e2C6hHfhiVIntMiWfwpZvKzN9oGh9OSi6BvToQGBf:2e2C6lIUMi3cnomFi6BvTdGBf
MD5:	E0EC580867118F8FB4D59714F11FF421
SHA1:	9A6A264D19047676ED20EEF9FA9C67BBA707E313
SHA-256:	A903B3EFB9D11826F4B3C6D9DA8D96533BF061D830D38E987E4DB42F2C3D9D6E
SHA-512:	A2DD0AC2882ACAF1CF15AA9C9C11DD9989E9DA05BF39F43A8E31A30C5F4655421F8BF702EDEC7117D0A98C489816116A6E7E52F094FB5610FC07979CE7C099F3
Malicious:	false
URL:	https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Preview:	<html>.<head><title>Pixels</title></head>.<body>.<script>if("browsingTopics"in document&&document.featurePolicy.allowsFeature("browsing-topics"))document.browsingTopics()</script>..<img src="https://ce.lijit.com/merge?pid=76&3pid=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87&gdpr=0&gdpr_consent="><img src="https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D"><img src="https://pr-bh.ybp.yahoo.com/sync/openx/dfcf67f2-dbc2-a0a2-5b42-ef933b9d999c?gdpr=0"><img src="https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=13de7dcb-57c4-8911-aa9b-7bf1acf99f35"><img src="https://match.adsrvr.org/track/cmf/openx?oxid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0"><img src="https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Njc2N2QyN2MtODIxOS02YzRmLTdmNzUtYTNkZjBlMjg5YWI1"><img src="https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc">..</body>.</html>.

Chrome Cache Entry: 296

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	10266
Entropy (8bit):	7.9518592616678525
Encrypted:	false
SSDEEP:	192:J7gmVs93mK6yZW90GIO3viDrw9SmHEC5iVscBqnVk0IWNeQ3Vi:J7gmVsRmKe06iDrGhziVaVk0Nnli
MD5:	C567F65948078EBF902A2488816BB956
SHA1:	DFC095C8A53DCE714D1D99D916A47473BA754CF9
SHA-256:	B6EBD2244153BB9F85EAB74CB2097C99965EC579ADC640C607FD7A15B60B3E19
SHA-512:	6310D2DAAD33C4740779F2B2F8BB03563DC9E762BEF2325CB5987DA584DAA0F3D7108B8AC2761FDAF3887E7AFECFEA33D106A75C0826AF086F4548F87588B092
Malicious:	false
URL:	"https://images.sftcdn.net/image/upload/dpr_auto,f_auto,fl_sanitize,q_auto/download_intent/templates/corel-corporation/winzip-compression/winzip-logo"
Preview:	RIFF.(..WEBPVP8L.(../...G0_c2.j.Ij......!&.G.......a.6..d...r..@DL..VT...ML......%..e).P..f..Ao.Y...;....\`N.j.s.....s[..I..p....8\| .........C.e..VW....}._H{.....m...m} h:..M...1m3.i.BL...3,.......ni....~.PYD.'...S#...D...R..9...M.wB.^.kN....Z....x.o.}.H.t...O@............./._............../..../._...._...y..D.oJ.....^.r.x......o...._...3.....'.U4.._..........j.U.]........C.f..z.......E.......Z..E...../......`.i....\T.w._..~..u,.A4.3.@mA....Z...v..%....'..mN..t..<...5.:..\(......_..>...>.G..9f.....u4P+..p.....F...^^[w.H[.2".1:U}...P..o.].k.k...K.....Y<T..W.CtP.B.x.V.&..mtYm]..HgqP9.W5..B.0..f=..:.....9.....RC.!FUS...D..\.....c......ZD..f..4..U../.Z#..f..[.{1.P..j..9.e....XT.!&.B....U.}....RK[K.D.X.4#.Bl.j...N#..Q...?.1.....-.H.7.......+.B......H.A....%g!9.L=R..U.!6.H#..F..]...C...E.+........." ... .&=..i..BA[.t.4Nf....N..E..N.B...}Oy...~]-...K.P..)...H.JIx.t....Q\|......W....!@..V...`.P.wL..~........f....R6.pH.JY8.t...I...{......l/..`RV.tH.JX

Chrome Cache Entry: 297

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (15907), with no line terminators
Category:	downloaded
Size (bytes):	15907
Entropy (8bit):	5.514273213911923
Encrypted:	false
SSDEEP:	384:DnAJ01yJnUyOd1VxkZjhwq9+5yu85w+TINmNPvncM:jAJ00JnLOH4ZjhwDi2+0s9R
MD5:	AE79DB664406C9254F4F32DAF70C93AC
SHA1:	FAE0AE1FCEB99F996F315545F1C75EB04939B20C
SHA-256:	8E53E50181B7A9E2CAA94173C37FCD9DE8FA75750764A2AD8AD02FAC3306D652
SHA-512:	FBD5EC409CE57592EFF6BDFB2DF69C2414A79D84CB9B1BE5B6C5110985A0FF4D192B7D31160D9F14F3E3DBA21628129ECF9BC925597F968AC1CF6DF849346AF6
Malicious:	false
URL:	https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Preview:	<html><body><script type="text/javascript">(function(){var aa=window,p=navigator,aj=aa.top\|\|aa,ak=aa.location.search.substr(1),A=encodeURIComponent,W=decodeURIComponent,aA=aa.parseInt,P=aa.PubMatic\|\|(aa.PubMatic={}),K=0,ad=0,b=0,ap="pubmatic.com",V="ads."+ap,am=1,Q="https://",a=(aa.__cmp?1:0),ao=function(aF){return typeof aF==="function"},av=console.log.bind(console,"PubMatic:"),au=function(aJ,aI){var aG=0,aF=aJ.length,aH=false;for(;aG<aF;aG++){if(aJ[aG]===aI){aH=true;break}}return aH},n=function(aF,aI){var aH=aa.document.createElement("script");aH.type="text/javascript";aH.src=aF;aH.async=true;if(ao(aI)){aH.onload=aH.onreadystatechange=aI}var aG=aa.document.getElementsByTagName("script")[0];aG&&aG.parentNode&&ao(aG.parentNode.appendChild)&&aG.parentNode.appendChild(aH)},ar=function(aH){var aG=aa.document.createElement("iframe");aG.src=aH;aG.style.height="0px";aG.style.width="0px";aG.style.display="none";aG.height=0;aG.width=0;aG.border="0px";aG.hspace="0";aG.vspace="0";aG.marginWidth=

Chrome Cache Entry: 298

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
URL:	https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELPt7UfyJF1YSMpdjYoT4B8&google_cver=1
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 299

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2102
Entropy (8bit):	5.402899290972912
Encrypted:	false
SSDEEP:	48:1OLNFlOLNTFZKOLNZOLNJyOLN3AOLNgRVc+omOLN+1N0oD:1OLNFlOLNTFZKOLNZOLNJyOLNwOLN8Vt
MD5:	2983A5388652BF32BC4CFDF28E084EE1
SHA1:	77CCC32C298E6D7028A0161EA4595E59A2331ABC
SHA-256:	289D25D68F730E581E0A16B8BEE8F63A061717973F8AC8C29CCF2BA8FED15ADF
SHA-512:	FEAF2DCB9A234DB0CE1B82CDE30D3F0DD757A086D31AB222D06331857F06AF84D79B38C0F94857C7076CA9F1E028D0AD625BE2960FA791A07AB4BD1286D63DAD
Malicious:	false
URL:	https://fonts.googleapis.com/css?family=Roboto:400&lang=en
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2) format('woff2');. unicode-range: U+0370-03FF

Chrome Cache Entry: 300

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13084), with no line terminators
Category:	downloaded
Size (bytes):	13084
Entropy (8bit):	5.149068102751794
Encrypted:	false
SSDEEP:	384:i0+h9x0PzBRd07KuLA45euWtH8ABr6ExERrF4r/sqoqd:kPxMBRd07KAX5euqH8ABO4mp4gqou
MD5:	8225B5E267DAEB183F53A9BE1C011A62
SHA1:	B7861979D3286236F2ACAAA2F5FE672170B19A49
SHA-256:	DA32D596CBF89F9CE17641D26B42138C70C6CDD9A6B13C00ED38FE78978C1E16
SHA-512:	78028088E4E20239699A79BCB0A4F4D930A0F88FD021652DD2C7C2A234E65E09A843A92D4F678FF7536D436C1A8AA10A45A30859A6C9FC56E148D09258B3C2B7
Malicious:	false
URL:	https://sc.sftcdn.net/scripts/chunk6-1770ad.mjs
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[6],{144:function(t,e,r){"use strict";r.d(e,"a",(function(){return c}));var s=r(82),o=r.n(s),n=r(145),i=r.n(n);function a(){return(a=Object.assign?Object.assign.bind():function(t){for(var e=1;e<arguments.length;e++){var r=arguments[e];for(var s in r)Object.prototype.hasOwnProperty.call(r,s)&&(t[s]=r[s])}return t}).apply(this,arguments)}function c(t,e,r){void 0===r&&(r={});var s=a({method:"post",credentials:"include",mode:"no-cors",headers:{Accept:"application/json","Content-Type":"application/x-www-form-urlencoded; charset=UTF-8"},body:o.a.stringify(e)},r);return fetch(t,s).then(i.a).then(t=>t.json())}},145:function(t,e,r){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.default=function(t){var e=t.status,r=t.statusText;if(e>=200&&e<300)return t;var s=new Error(r);throw s.response=t,s}},149:function(t,e,r){"use strict";r.d(e,"a",(function(){return o}));var s=r(150);class o{constructor(t){var{container:e,eventTracker:r,s

Chrome Cache Entry: 301

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (61320), with no line terminators
Category:	downloaded
Size (bytes):	65728
Entropy (8bit):	5.592017055753851
Encrypted:	false
SSDEEP:	1536:yfU7xREziPQoEQtMthL+zbmkt/+sQJaAFUpd7nfReLHOONomgK35A/CBZUIXPYxK:TOgK3pZUIXwK
MD5:	4DB1803AD97497712C237D3AF5F5B7DA
SHA1:	D93B46ED59ECE45195DB31509204E64B2D77DB10
SHA-256:	735C67D441E983E9A68FAFACDEA7679A8D1D7A0E5567F141CD3312036EBB4F08
SHA-512:	D68166038ABEA5C7B10BAF788723C8B7A2B2D2E3293C8C7A5A072CB6C6A0A442A3E288126268EA19077FBDB2ED5571D13F97A260126F827C082B0CF7F38758DB
Malicious:	false
URL:	https://sdk.privacy-center.org/a8ff32f4-78c7-4428-825d-0badb488b68b/loader.js?target=softonic.com.br
Preview:	!function(){try{window.didomiRemoteConfig={"notices":[{"notice_id":"zATUzwXM","default":true,"platform":"web","targets":[],"config":{"cookies":{"storageSources":{"cookies":false,"localStorage":true}},"app":{"gdprAppliesGlobally":false,"vendors":{"iab":{"enabled":true,"all":false,"include":[929,277,512,531,678,720,89,226,385,162,144,775,780,816,278,945,149,241,335,312,45,185,51,895,1126,183,109,108,13,772,31,10,293,1082,143,128,1136,36,42,61,71,80,82,104,131,132,148,165,203,238,259,264,736,76,853,68,1,12,21,24,28,50,58,62,115,69,97,164,81,126,253,91,434,142,263,173,239,285,311,458,382,534,686,793,815,833,943,1043,883],"exclude":[]},"custom":[{"id":"gravatar","name":"Gravatar","policyUrl":"https://automattic.com/privacy/","purposeIds":[],"legIntPurposeIds":["cookies","create_ads_profile","create_content_profile","improve_products","market_research","measure_ad_performance","measure_content_performance","select_basic_ads","select_personalized_ads","select_personalized_content"],"usesNonCo

Chrome Cache Entry: 303

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	1788
Entropy (8bit):	7.856115361880249
Encrypted:	false
SSDEEP:	48:db9hf28yX+9fT1XQ+h81Id/aLi8NIvxIxZW1sWxR:db9h+8yX+d1A+G1Ka3VQ1sWD
MD5:	791B7C3E8D9D3F86A247D3974C9C1C7F
SHA1:	4D04CCB147CB3D80F59CA23D78E4C8BF1E1BC766
SHA-256:	9DC96F637340D0BC96294705A083CC8951958CE0E6E64E9F0E3D19E4437CCD26
SHA-512:	E004D54956A9E4B34F2E7661723B44C5C685D6F29F68947803E882A66006943A1939F47304C267F65E0739233423A49FE4326C524E40FCBC0179DBF124A9D9BB
Malicious:	false
Preview:	RIFF....WEBPVP8L..../o......d'....@...z9..k.a$IJpM..#....]86.d+..?.QD..\...ew.... ..O.j.W..._...Q+!Y.oh...V-...B..B.`_.^Ry9..\j6R?.ep...\|..p....!.u.cW....+.J......{n=R._.N.......)=.r.}..u[....L.@PpL..t.Tr.....J._.}?.....;.....S...<~.....e.'..jf.;f.Wy&".d.....@ ......4.\|3.}I...-.DD.,.... ^,[_j..H......?/;Na5.......r{Bw...e.}%...@.=D ...@... .@.Y.6IC..F.c.s%.iW...D..@...@.....y..R.>. ...S....\|.....2./=ED0Ai....n.....A?}.4.vg..S.=.A.}......J......;b...^.`7~..S....].x..N..p.H..o..k..3..#...]P.!.z1..9...H]..O,.......^...~.....7...T..EU.Mp{...Ft.WS<.rq..4..a.'.o.x).c[.....@^..sW..%2.........+...a.1..k.. ~`W......n.j...^.4.m....JC....A..c.z.!....5.y=..... .-OB.....&...e.....u....W..`...s.XN......s.....OGy.MV....^...1.ls:........!b.+...0.o.S.#.FsF.3c.a....>G..t...`H.....'~WiS.~W.$dD...m3?l..s......t..E("...2Q.m.z7.......WZu.......}..M%.\|.~..t[4J.q..q.?N.$.DUc..6_pIUZ3R.JeW....L.....UiO..$A+.. .$...].y6Y..P.U.3.R.K.q.S$.'..WQQ..r .\|.U7..;.8X..5f........

Chrome Cache Entry: 304

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Category:	downloaded
Size (bytes):	153156
Entropy (8bit):	5.313184589772049
Encrypted:	false
SSDEEP:	1536:PpbrUzacicmSKzO9R0cFMX/kC7dCqGjHlUHNaVcZRxRBA04VKsuntF0dTGgQ18u5:Wza1ke70eNaVGAvkF2kl
MD5:	2630B3D7AD4A41FAC67742216E506D83
SHA1:	DDA36227690CB7C9EC74DE3667DD595D59FB8EEC
SHA-256:	CD5EB76033D96219A0C4FE45FB0DF10202E1FEBCB4D086FB1305F1B3304A6B1A
SHA-512:	DF4BBC981FDD148A6EC0E97CBCCB16B66C9054EB144A6055EAC76A2B34FEFE071617E6AA00338A7D2C990ED7D521BA1FB95D086C20B4A37BB95C0820C9B9124D
Malicious:	false
URL:	https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Preview:	!function(){"use strict";var t={log:"log",debug:"debug",info:"info",warn:"warn",error:"error"},e=console,n={};Object.keys(t).forEach((function(t){n[t]=e[t]}));var r="Datadog Browser SDK:",i={debug:n.debug.bind(e,r),log:n.log.bind(e,r),info:n.info.bind(e,r),warn:n.warn.bind(e,r),error:n.error.bind(e,r)};function o(t,e){return function(){for(var n=[],r=0;r<arguments.length;r++)n[r]=arguments[r];try{return t.apply(void 0,n)}catch(t){i.error(e,t)}}}var a,s=function(t,e,n){if(n\|\|2===arguments.length)for(var r,i=0,o=e.length;i<o;i++)!r&&i in e\|\|(r\|\|(r=Array.prototype.slice.call(e,0,i)),r[i]=e[i]);return t.concat(r\|\|Array.prototype.slice.call(e))},u=!1;function c(t){u=t}function l(t){return function(){return d(t,this,arguments)}}function d(t,e,n){try{return t.apply(e,n)}catch(t){if(f(t),a)try{a(t)}catch(t){f(t)}}}function f(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];u&&i.error.apply(i,s(["[MONITOR]"],t,!1))}function p(t,e){return-1!==t.indexOf(e)}function v(t){if(Array.from)r

Chrome Cache Entry: 305

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	170
Entropy (8bit):	5.335916817166796
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
MD5:	E7673C60AF825466F83D46DA72CA1635
SHA1:	FC0FCBEE0835709BA2D28798A612BFD687903FB5
SHA-256:	0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
SHA-512:	F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
Malicious:	false
URL:	https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Njc2N2QyN2MtODIxOS02YzRmLTdmNzUtYTNkZjBlMjg5YWI1
Preview:	.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

Chrome Cache Entry: 306

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	2206
Entropy (8bit):	7.910962166938583
Encrypted:	false
SSDEEP:	48:Uw4p8sxF4N9YRQOdzPBz6i7cy5Uto75gtGXKt5rrPMyoPS4g:UT6yNQOdzPt6/y5UwKGX+rPMyoPSf
MD5:	BBEAE8120F769BB5AD848B25FCFF9C1D
SHA1:	93C6E1CCFC76A2446015066CA8AD4CC30E4CE7DA
SHA-256:	17B4C354472EDD3ECD07EBE40FD904E16CEA1EDC594212B937454A46751E5BA7
SHA-512:	027F18C722B8C98E7E2B8BE1F96A663844B019276176635F09BC976A740E3AFCD3EE0093C8C9E742986D5AA4A0993B29B073BF8B68FBA0230A87C7989CB15442
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/113ffcbe-9aa3-11e6-90ae-00163ec9f5fa/1829476904/hard-disk-serial-number-changer-logo.png
Preview:	RIFF....WEBPVP8 ....0(...p.p.>a,.E."..Jv.@....a.k)..^.:;u<.y..).....+.....-...k.WS....e)..n.v..8.....J~.._...>p...U.;.........).I?..+.'.O.......Y............lz....5H..rX..S........S.."..9?".W...P.'..JR...0f$1.,6....\........Z.5...7S.C$.H...J..~...._.0.....d0.v..{..t+2..F.sSz.c.O.....NO...4#.`.....[.X.QQm3.IRl........M].].7.as..)~Z.@.......x.z.l31...)B....=.0...S..T"\v.......$.t....FF.Ja.jH.....g3.....p.!..?c..f....@IH..A5..._D....L.y.2D...r.w!E:..Q...W..(%I$<#.%.......i.-..W....9.[.G...dl.GY^.k$...9...e....bg..:..F.M.`......O..'.0.V0....+..K.`..wA.I..d=j...6..Q<\(.w.x.>}...>LC+.v.x..Q:6.y..#I.\.Kb.n.9K.;?..E.7.V..I>....}..zh.....PJ9r.../...1..81K[.....G.._...&{EqW.14..=..JB3.u\|_..e.._..3.(..`.$.w..\a7.TkHT.5......t...@.8...9I.N... .......n.........x.:d..-.....J_`i.......R..{O.BD..\|.ETW.T..._G...].x.........>\|..t.=...)........(<H.D.I.U%}.t.k..D..C...'.O...\|.....U...w...6..lpY.....)PEv3.ii. .zF....~.+....s?......P9.=2.V...........{.\.\..K<....

Chrome Cache Entry: 307

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	3.5251270918749356
Encrypted:	false
SSDEEP:	3:n9m6QiFL4:nVm
MD5:	B205296F7C49C67BAF5B78E8163061A7
SHA1:	828DED5C881601F44CE02CCB9E8B98D214B5E9AA
SHA-256:	281A6CECFF9B473286243BDC58329C1D8141B979E8985EA968D7D975F3A50E05
SHA-512:	ABBB243E84448F153F337C61919C36F68F2503F14F7301A903ED76B5A321C60C09C5E5D1174E77EBE3199A1F7A900A0668555B729F008547DD26A00937FF7B5B
Malicious:	false
Preview:	partner parameter must not be null

Chrome Cache Entry: 308

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
URL:	https://dis.criteo.com/dis/usersync.aspx?r=70&p=120&cp=adyoulike&cu=1&url=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fis_cookie_sync_uid%3Dtrue%26uid%3D4246a50e6cf42e85f26c381a4b7701fb%26name%3DCRITEO%26visitor%3D%40%40CRITEO_USERID%40%40
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 309

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/631321069?random=1702977738859&cv=11&fst=1702977738859&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma=0&tcfd=10000&u_w=1280&u_h=1024&url=https%3A%2F%2Fcaffeine.softonic.com.br%2F&hn=www.googleadservices.com&frm=0&tiba=Caffeine%20-%20Download&us_privacy=1---&auid=133230612.1702977737&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=event%3Dgtag.config
Preview:	<html></html>

Chrome Cache Entry: 310

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 12700, version 1.0
Category:	downloaded
Size (bytes):	12700
Entropy (8bit):	7.983934839095395
Encrypted:	false
SSDEEP:	192:9pyDYbbMYHexdHevLbDfo1HGQDo2hcNmchLzc83f55bA0hMMApntRt+BbzpsTOkg:9pWYHexWbDu5KcqjbMFovQTg
MD5:	E571167FBCCE8D5081BCE96A09930063
SHA1:	E12420F5E4DA3CCDC75A58CE744E7D5A0C6CF79E
SHA-256:	98BE19BC78B5BC5D419E4FA6EA055EBD4671A963E2CC644AEED4362F15D14C31
SHA-512:	2A7E28D5E1CC8FCB4089F51A012BA801038C1E115102F68405C730F58B490F3C9FC352BA533E0BF062F965B5FB44239B1B8BA914863A72C68AEEB27101C31881
Malicious:	false
URL:	https://sc.sftcdn.net/fonts/5bba3-e5711.woff2
Preview:	wOF2......1.......\| ..1<.........................v..H..4.`?STATD........T.o..@..6.$..\|. ... ....kE.b.8...\.(.I..$....T..+..._....tk..X3.).X].,...t..Y.:....c!..m3..........0H..\|.}. b..;..`Z.Ghr............f...$$...&.q"3......o..}.QF....7.J..>F.e'.lV......?....i.pN..V.-.Ek....E4..m...o..ysc.XH...T.\|:..(`!....o.:\TzUz1Wq..mW.k.....f.y.:.om.2.R..R.r....;.~.8....L8..j..N....u.....:0Iv...[.G ..j.n.gG(.V.....c.."...4.(..vK93.....8.%vh...r..H.+..{.o.&~...i..(.....?S.v?Gk..X....E.........4...bv0D...>.."..@0\0....%H.B.s...2(......s.R.c.(U..U...\TjK.6...$....Qy..q...1.n..k.q.....>..RD... !. A...-.Y..;.....)..t6.@1.... ..B......?.R "X."F."A."M."O=.Q;.S_D.....F#(P..D@..\.c.dBq.........P.6?lk..?..@.".......E"...}...@ ..M...q.q.a..].A..J..8..n.K.\..........4..U ^(...]..]%oD...cca.....B!.....8...P.rXa..~.pG.P4.'..J....M.....w......n...eI.....-.\.e.;).....a8U .]......o\|U..`.7X.02...V!......x.>..5.?......1rX.2..;.q.S..<..v+....D.K.l...B..b...{...?..@....(..].

Chrome Cache Entry: 311

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1419), with no line terminators
Category:	downloaded
Size (bytes):	1419
Entropy (8bit):	5.5941398149506165
Encrypted:	false
SSDEEP:	24:CGrwLQ1jOQ1AQ1dQQMiwMMOI1u71hMUusijpMoGlg:CcVjhTEA/kuRmUusyuvq
MD5:	11AB64C47E09030A943BCC962A8C3C94
SHA1:	D8486BE37B5E8ADA9734BE4179667EBC4646B52C
SHA-256:	6A0439004B14B86E5B92ECC093F64781CC6DD2DABDEADFA38B35E72509170D90
SHA-512:	A7755AC571D1AAF1B5B443B618A0FC3A0C8CF2616E00F890016BB7E05D620B4DF786D052B35AA3A223AF5FDA87C779A6B0515DC5CFBC264BF72AF03E8CA34F87
Malicious:	false
URL:	https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=27079344&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Preview:	PubMatic.loadAsyncImagePixel('https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://us-u.openx.net/w/1.0/sd?id=540245193&val=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://crb.kargo.com/api/v1/dsync/Martin?exid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://sync.bfmio.com/sync?pid=187&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncIframePixel('https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=');PubMatic.loadAsyncIframePixel('https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=

Chrome Cache Entry: 312

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1674
Entropy (8bit):	7.882322181090171
Encrypted:	false
SSDEEP:	24:jcAxz6ORsBOca+6+ScBO9cUrMPLPt1skJZTISH/z920Pt8NIakPaDMBrN+2ur:jPFmBxa+6jchUAB1saTf0NIK1Lr
MD5:	02CE189838137D302A58D4B8F165A145
SHA1:	C2AB765DA25E2394055F7B671FC26ABC4FEE27F3
SHA-256:	5F07EE57C01F067266F750D9DFD2C2413039E7D80DA152B2C052155F41C40AD9
SHA-512:	DC836CD04D1A9586A1E13F2D431E7CA1BE68C3DB0C6D3BE42E623B924936C0F0611F088EC8C10FA8FCBAF56A3BD403F86A7A71DF1B6523EF1F1EBCC37862D99F
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/3fb79aa4-a48d-11e6-94a1-00163ed833e7/1031731262/mouse-jiggler-Download-Mouse-Jiggler.jpg
Preview:	RIFF....WEBPVP8Lu.../o......m$.A......mP.1..m.......$a.9]...?w.w.t..g....St.S0.30..FU.ia.$...@..Z..(...L.KBIh.c.v.v....;...M.........9a._...#..A.....".H.&.#?...J....ga!.a.\?.x.....'...+>.......5.J....6..R..<J.B..y~D....P.....0S....(.y._.m!..f..fq."..[?~.>VV.bMk....C....gljS.O.F..T!.T.....L.#.]V..:O..Ev.Gc.`Z..=+..:tn.E.3R%tT..q../L.I.$hT.._G......@b...B...n;.......uY. =.s.Ga..PF..S..I]......7..E.....e. Q..Dq.Y!iD.e%.V.&.Rey....r..".YhZ3.hZX..T.Ec..I".T?.....].'A.....iXo....i.....oa....d.4..n.&hX..`..u..>.3s....sJ..XVu....md.L.#SQp.YT^5.y.....?(d.u...<VE.....k..R......1e..G.1..N...UV...k%4@-wgZw....U.G^...ye..M...b5.V.......L=.?......C+.)....pf...\|.?......#.......3.n.V....~h...0....Hm..,..X.....l..O...e.u.9..^_.6.\..8ga.6p6.....e.....3^.MM9?....4R6[../.)U../.w..ih.$8..7.]'.}...$..y....S+.t.\s?.D.!].N{....2..q_.p.;p...6.~J8..D.s?..8.3n....K ..O..b.n...<LL?....:8.u.Cw.5<.*.=....n.Z... .<...(o'.. ....+9...........8o..N....9.A.....+......<]^.H..@.L...

Chrome Cache Entry: 313

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (46824), with no line terminators
Category:	downloaded
Size (bytes):	47024
Entropy (8bit):	5.36508635105825
Encrypted:	false
SSDEEP:	768:XErZAZVZBIZwSNU6Zdcg0vYzzl6L1kZIvPchgrLTuCva3OJed+Zh:0rZAZVbIZ/i2dcg6Yz5A1kZIchES3ldw
MD5:	15AB433340219D1C9279BFDBDC76F765
SHA1:	E399F8E7F8F276B040A471B7D63432FB37B72122
SHA-256:	BC5BC60D2D0770BE838BA653BB352014DA237D427AD05F0D72F10DB52046E49C
SHA-512:	431218EFDD6EE546D78337E7DD0BEE35C2AA40589D809D99A1C23D1BC69C3A86BC13984F8FD6A8D19BD1AF58EDEE9F30B0FAA5B302C01E1E1D231CEE8C8D43D7
Malicious:	false
URL:	https://sc.sftcdn.net/scripts/72c3f-15ab4.mjs
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[3],[,function(e,t,n){var r,o,i;o=[],void 0===(i="function"==typeof(r=function(){"use strict";return function(e){var t=JSON.stringify,n={},r=function(){var r=t(arguments);return r in n?n[r]:n[r]=e.apply(this,arguments)};return r.__cache=function(){return n.remove\|\|(n.remove=function(){var e=t(arguments);return delete n[e]}),n}.call(this),r}})?r.apply(t,o):r)\|\|(e.exports=i)},,,,,,function(e,t,n){"use strict";(function(r){function o(e){return(o="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}t.log=function(){var e;return"object"===("undefined"==typeof console?"undefined":o(console))&&console.log&&(e=console).log.apply(e,arguments)},t.formatArgs=function(t){if(t[0]=(this.useColors?"%c":"")+this.namespace+(this.useColors?" %c":" ")+t[0]+(this.useColors?"%c ":" ")+"+"+e.exports.humani

Chrome Cache Entry: 314

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	170
Entropy (8bit):	5.335916817166796
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
MD5:	E7673C60AF825466F83D46DA72CA1635
SHA1:	FC0FCBEE0835709BA2D28798A612BFD687903FB5
SHA-256:	0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
SHA-512:	F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
Malicious:	false
URL:	https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9jMmQyYjkzMy1mYzViLTRiMTUtYTgyZi1mNjk2NjBiY2FjN2E=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv
Preview:	.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

Chrome Cache Entry: 315

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.841083874005227
Encrypted:	false
SSDEEP:	48:JAKCkiKVzFHfQLGhcR4sov12suXMKSswoEwM:lLQLusovcsu8KSswoc
MD5:	BE02947619CDB91398FEAFC78F28F72B
SHA1:	2BAE0F4C37806A564CD162922B2DF1BCAA0222B9
SHA-256:	93E563AEED3FBE7E5273337F8BDD820612AABC05649DDEEE87C2723F1DF292B3
SHA-512:	F821D6B5B56215F97A2F90E669D3E540BFB9F6EB76FAE3C92C6A44120DED7599F1AFDFAA9502C1BA515AC0F0B9A89F1EA8AD5749465DF50AF27BB056E2F0F7C5
Malicious:	false
Preview:	RIFF....WEBPVP8L..../o.....$g.;.0.s.nh(h#I.../..v....<.x...y.....fT...=..r$.$6.h%...Dg......@.I(....Lbs.L..cr.\|..Z7.m[.\|.d..zR...S......O....n.H.dLv.]....'...K~..wa.O_...D............z..SS...........P..%..I.G...qQ.a.....&....I.........i.....Ot...".0&p.....mC.C....m....h.D...:&1d....1...y...D..........GGv#}..J....L._...g.!3^...u_..L.../.%d.q...3.\..j`....}...w......"l....@.32.Mu..G....8/W!V.........T.......+..;x..(..0.J.2+ ........U.x..W..E.......+.V..V./.R{b.........Nx... [y^KJ(..bt..t[...y.....2V/..%.....W..<....TY...;/>l.k1b..W./....m..O....Zkr.....R....+.%..X1.`.!%.............M.6............F..[/......S..hd.._...n...F..S.~...Y...wa..Q.S..C1.R.)&....U...!....9....F...-....9d4%W....YW.y:d...Ar..;.@...;..@.-W..r......#..i..q.....x.E..;.`. ..t s8......x..XT..2.W.l.9....M...I.tG.7..JZ.a.A....J...3...Q9...Of.....t.f..V:UA6s1..&.....".#S){.=+.../..aR0.8...M.....".jz7.^\|....sJ..*r..d2..~...c...~H..-{./:....d.......MV....!.}

Chrome Cache Entry: 316

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	751
Entropy (8bit):	5.303494874538606
Encrypted:	false
SSDEEP:	12:YparveYGk9FuNoqRGdhQ3QC5RGdJnz/iNmKsDig76xRZ8l:YI6YGkHuNoqRQQ3T5Rwnz/i0tV6xR+
MD5:	40D942A86F8BF5E7523986626AE2386D
SHA1:	9BF206F565A04E6217B8F439E3563AEC25FF8EBB
SHA-256:	25FE665F3EB5C0FF9541D4021AD6E663631744CF01F7F50AD76C99D0B2014BDB
SHA-512:	85869628182892880AEACEEBAB785D85CB3200565763A12E26D09DAE4E9411E0049E38B2CDC0B033146D9B25FB2649A6DAE0DC3FB0A7710C8139B34308D488FE
Malicious:	false
Preview:	{"/5302/desktop/desktop-Web-pt/Apps/Programpage/ATF_OOP_Wallpaper":["html",0,0,null,0,0,0,1,0,null,null,null,null,[["ID=b73fd6726c38354f:T=1702977749:RT=1702977749:S=ALNI_MZ2Xjsn4d_Vx9KU3QsPBpI9UcMx_A",1736673749,"/","softonic.com.br",1],["UID=00000dab022b6e9f:T=1702977749:RT=1702977749:S=ALNI_Mb8l5XDwb-ampTL4l70U1UZoP4rDw",1736673749,"/","softonic.com.br",2]],null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CKftyr6Wm4MDFTATigMdtC0M_A",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qPeiZkVScTy8RNccVvBZlaUcRg059fgVULNSYleJBBQyJTGiU5ECIpHuyTm8L5XMdzaelSSmM9w8A1tyvX569Ncdg",null,null,1]}..

Chrome Cache Entry: 317

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 16 colors, 32x32, 16 colors
Category:	downloaded
Size (bytes):	1078
Entropy (8bit):	1.240940859118772
Encrypted:	false
SSDEEP:	3:etFEh9HYflvlNl/AXll1pe/WNN00000000000000000000000000000000000001:QNtY6+lKY6
MD5:	4123CE1E1732F202F60292941FF1487D
SHA1:	9F12B11BDE582DAE37CE8C160537D919C561C464
SHA-256:	D961B08E4321250926DE6F79087594975FE20AD1518DE8F91EB711AF5D1A6EF8
SHA-512:	11B24C2E622C408E4774FAE120B719A21A0B2ACFA53230126C35AD6CA57D33D4DE79CBE11D296CFBDE9613CAA03D66B721BD20CF4EE030CF75F5A1FD8A286DA9
Malicious:	false
URL:	https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250
Preview:	..............(...&... ..........N...(....... ...............................................................................................................................................................................................................................................................................................(... ...@.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 318

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 24.1 (Macintosh), datetime=2023:09:28 09:08:15], progressive, precision 8, 300x600, components 3
Category:	dropped
Size (bytes):	63909
Entropy (8bit):	7.7554777108692665
Encrypted:	false
SSDEEP:	1536:09adJ9adANxeVbNZkkrBm0j0DXpRPyqziTILr:Ds4xeVpWkrJgl/ziTSr
MD5:	C610514E5756020CFB3C727B77B2C83E
SHA1:	4083CC96DB7AF4DEAC95B32329BAA78B7A584F49
SHA-256:	0148F8F91E2EF35D38BA66C9E01F3DEEAB27BFEDCDDC77CD782908C401AC9CA8
SHA-512:	039625607B59612A9EEFA3BD00A07BE62CB531AA201D1413DA190ECC9FF33E35A8C7A4D095615DC3D08856DE1C0FF6C4E080BEE8B7CA53174F78D349A2FC6572
Malicious:	false
Preview:	.....UExif..MM..............................b...........j.(...........1.....!...r.2...........i....................'.......'.Adobe Photoshop 24.1 (Macintosh).2023:09:28 09:08:15...........................,...........X..............................."............(.....................2...................H.......H..........Adobe_CM......Adobe.d...................................................................................................................................................P.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..T.X.X....:..}\|.D.@;a..]s..M...?3.'.%!.d.d.&i.x.e9l.....R...V....<SY............U..j....8.u.....[w:.e....8.....).....M........^Nx..2pi?j\~....$.Ok)$.

Chrome Cache Entry: 319

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1132
Entropy (8bit):	7.788035787250117
Encrypted:	false
SSDEEP:	24:uYZaOrH7g1q2QAsMF6Az/0JBZrgXsEEpa9NJM9auR7:pprH01hscV/yBZMaa9v4HR7
MD5:	B72D387806EFDED87CA5235A747204AA
SHA1:	9E3520E6997E6EBF7B5EB5EF4196B002BB865CB2
SHA-256:	62B78FBEAAC879A591FB7563CE48AEF32F7E8C4C38CCE05BC8D9EEDC8BED7697
SHA-512:	B74CF0A002ABA1E70E7194A40441C9B30DA003E8FFF55A92193007D6BB47E755E21103355FB6B627D5A6BBF8C619ED3A46DFBC4C59CF58FD5BFE083B5E2CED8F
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/25d85da2-3518-4990-8c6b-7dd62176d833/455719081/hp-envy-700-074-desktop-pc-drivers-logo.png
Preview:	RIFFd...WEBPVP8LX.../o......m..?......A..v..@...............,.l.....`.d..I.$..D(.h.....@VV.=...%[..n...rB._p..m..Z...p..rc.....mp.K...uV..Y.T.z.V..Q...o_...3..U...G....<K....~to..e...f.~gqI5?.d.X...\|.%W.U>uX.ik}.4.Wx..(.....Hd..u..SY,Q7..+?..JS.4..<..C...3.0..oBB.3C.W._....~.^Q.Z....f(.".@......!....i.C5.q....0TG.m."...J..[.2TKI4..P.1. ...S!...f^..Ya. .....P.z8.D.....@...j!..gy..W.. \3..........Te$..w...D..!J.c.a...L.h..rt}~]....o.9...H.X..I....Q:z.....wX.n,.C....P....2..O.....9....f....Z.....a?....e...:..h.....$b.y..^.<.P..0.d.!..Z...f>...o.\|..v.-f>......ChO...].2..89.W.0.B..'...6}......D.k?....<..)p.....<.<....'.bK....j..'...CA.....3....!.&09.......L.P.'<.'..l.eh.0.8.`..%..-g..E".5.P..G........m.B..d.u.C..!..\|0..w.....P4.e....M3.[...Q..#..f(........$...8...7......:2.EJQb...A....Tr#.uQz...9.'K.^...+.....#..r..o..Od..!.'..Vv.x...0..rT....Y.{e...%.K.q..K3V..h+.s...!.q.H..!.Su.T...ip..u.Rn...:Q,}..\X.....v+..V...:`,2t...@.Ig...Ja..!.

Chrome Cache Entry: 320

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (15907), with no line terminators
Category:	downloaded
Size (bytes):	15907
Entropy (8bit):	5.514273213911923
Encrypted:	false
SSDEEP:	384:DnAJ01yJnUyOd1VxkZjhwq9+5yu85w+TINmNPvncM:jAJ00JnLOH4ZjhwDi2+0s9R
MD5:	AE79DB664406C9254F4F32DAF70C93AC
SHA1:	FAE0AE1FCEB99F996F315545F1C75EB04939B20C
SHA-256:	8E53E50181B7A9E2CAA94173C37FCD9DE8FA75750764A2AD8AD02FAC3306D652
SHA-512:	FBD5EC409CE57592EFF6BDFB2DF69C2414A79D84CB9B1BE5B6C5110985A0FF4D192B7D31160D9F14F3E3DBA21628129ECF9BC925597F968AC1CF6DF849346AF6
Malicious:	false
URL:	https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156813&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID%26traffic_source%3Dsnippet%26session%3D14A0FC939D6A6483%26sp%3D750078%26pb%3D612004%26c%3D570607%26a%3D281178%26domain%3Dvisitor.omnitagjs.com
Preview:	<html><body><script type="text/javascript">(function(){var aa=window,p=navigator,aj=aa.top\|\|aa,ak=aa.location.search.substr(1),A=encodeURIComponent,W=decodeURIComponent,aA=aa.parseInt,P=aa.PubMatic\|\|(aa.PubMatic={}),K=0,ad=0,b=0,ap="pubmatic.com",V="ads."+ap,am=1,Q="https://",a=(aa.__cmp?1:0),ao=function(aF){return typeof aF==="function"},av=console.log.bind(console,"PubMatic:"),au=function(aJ,aI){var aG=0,aF=aJ.length,aH=false;for(;aG<aF;aG++){if(aJ[aG]===aI){aH=true;break}}return aH},n=function(aF,aI){var aH=aa.document.createElement("script");aH.type="text/javascript";aH.src=aF;aH.async=true;if(ao(aI)){aH.onload=aH.onreadystatechange=aI}var aG=aa.document.getElementsByTagName("script")[0];aG&&aG.parentNode&&ao(aG.parentNode.appendChild)&&aG.parentNode.appendChild(aH)},ar=function(aH){var aG=aa.document.createElement("iframe");aG.src=aH;aG.style.height="0px";aG.style.width="0px";aG.style.display="none";aG.height=0;aG.width=0;aG.border="0px";aG.hspace="0";aG.vspace="0";aG.marginWidth=

Chrome Cache Entry: 321

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 112x112, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	764
Entropy (8bit):	7.740978257498336
Encrypted:	false
SSDEEP:	12:ElPBkX2bsM9yZ/WCo5oJUbpPHRpdToo1U4OdiT2eD/GH9qqEi0VQFsUYCwFqpBkx:E81ZOR5oQBjG/NdiqeC0xiZ8CBpY1tn
MD5:	36C4C07273CE75DF42122BD1405603B9
SHA1:	51241D0C09F74E5F97CBF8DBD140CA2D5156967F
SHA-256:	70FDAEA57ED00D0DC75FE70DE82083A5E6038B161D62365F377A762344481CDB
SHA-512:	6094877E6375D91523E94376167AC95553B5BC42AB760122FDFBE556172B2E4B59BA054EA5FBFB6910C6688694AFA2469FE10DE6C940C78BDA170DE57B8EF0DE
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/dc727d78-f31d-4970-9875-1959d19922a7/vv1mfmkgldtrwzd7kaoe/sysinspire-7z-password-recovery-sysinspire.gif
Preview:	RIFF....WEBPVP8 .........p.p.>.H.J&$.!.......f......r..<._y...<O.T..W.{...u.af.^U'....Ld%..2.d.5....j...']R....m.^.$...PP...l...9v.x........^0t.......7.:.....GQ.....U5XsBB"...,...'.......Bl...@.0...a(..............\u..@.....gZ........../6@.N..y....9...G.v-...$&kf.>$3......0N^....m`...{...].wy.........%.X.8)<..P./i...8..c~Sa..D.!..f.4$.....B..^..P.4...~.<X...j. .y:...jm...e....U0.qi.y#...V...qo.QS.......=.K......g&....{.1...b....P..+....yC.T..8.$.)...7.6D...3b..R:..nC[.V..=..:H..)...%1?.a.ET..:.:..<.L\.,.....b.{.-..].^AOW..............._..*O..M_..r.[5.... Z..{.J.5.5it......}..$.......#..M'................4.&..=...i.....S..m...\.z1\|........9.u.x.E...;..\|D..0....-8o......8.<...s.Z@...g....Q.....4$.8..c.!.x@..

Chrome Cache Entry: 322

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4784
Entropy (8bit):	3.9721485663017044
Encrypted:	false
SSDEEP:	96:Bouxwz5h53V4k+cdKDDza8ybSO0fgwH7UCZALg0AVEwh5V6sFdhW:dqhlV4EdKj7t/ZGZwh5gsFdM
MD5:	0D0266082D3445D092A0AB632D09A23E
SHA1:	D871F8C8A06E5B4DF9C5E75F9728A27E980591E0
SHA-256:	2088F5AA1EBFAB0D8DE47886B0418C34F5B36D5B19286B9C87616547DFA3562D
SHA-512:	E5F8CE6808AAAE984B60426B3F359BEC4883A74920AAB094299720EADC3AA9F04EAB1BB24E450E71F5A797543495FC168D5C0B96775DFFF16E0426A93062F0EE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg version="1.1" viewBox="0 0 505 141" xmlns="http://www.w3.org/2000/svg">. <desc>Softonic</desc>. <path d="M170.758 62.53c-7.004-2.842-10.066-4.508-10.066-8.548 0-1.752.426-2.816 1.47-3.677 1.816-1.513 5.38-2.344 10.043-2.344 2.647 0 5.574.264 8.462.766.213.042.474.069.733.069a4.12 4.12 0 0 0 4.033-3.288c.012-.059.022-.12.027-.182.212-2.289-1.35-4.328-3.493-4.583-2.341-.404-5.928-.878-9.822-.878-6.753 0-11.876 1.417-15.231 4.211-2.914 2.33-4.468 5.762-4.468 9.906 0 9.87 8.72 13.446 15.088 16.058l.195.08c7.565 3.145 11.846 5.226 11.846 11.403 0 2.77-.874 4.693-2.748 6.057-2.006 1.437-5.206 2.202-9.242 2.202-3.474 0-7.293-.572-10.751-1.608a4.304 4.304 0 0 0-1.242-.182c-1.844 0-3.427 1.133-3.939 2.82a4.023 4.023 0 0 0 .34 3.126 4.129 4.129 0 0 0 2.458 1.99c2.464.755 7.474 2.032 13.143 2.032 5.801 0 10.567-1.306 14.169-3.88 3.892-2.885 5.935-7.22 5.935-12.556-.001-11.948-9.791-16.021-16.94-18.994ZM233.725 42.438c-4.818-2.69-10.257-2.69-12.87-2.69

Chrome Cache Entry: 323

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (38784)
Category:	downloaded
Size (bytes):	238945
Entropy (8bit):	5.85658074926924
Encrypted:	false
SSDEEP:	3072:uKV0A74YozKBSdNI2CnKWA7VQt0A74YozKBSdNIpqEB8:J74pzKBSvF7Vi74pzKBSMq48
MD5:	4131FB778CF5687BA35F97E863038C8E
SHA1:	0E2555E01D637B4396B5F2F02DABC8373D3F68D1
SHA-256:	A8146953BA90CA0CDC75D1B3319143AE919ABAE94D0E8E56002EF9B6A8BCDA60
SHA-512:	FEDFAFFB5B94AA93EE76A9A51E3173A4C5392A3C246A25D050AE7F1F48ED57A5D17B5AAD1A355B53C61E67D99E50DD8E3853FC66AC922E2085D4510BCA1404AB
Malicious:	false
URL:	https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3694862415250323&correlator=363531866443330&eid=31079783%2C44807747%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&trt=2&iu_parts=5302%2Cdesktop%2Cdesktop-Web-pt%2CApps%2CProgrampage%2CATF_MPU_First%2CATF_Notificationbar%2CATF_Leaderboard_First&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5%2C%2F0%2F1%2F2%2F3%2F4%2F6%2C%2F0%2F1%2F2%2F3%2F4%2F7&prev_iu_szs=300x600%7C300x250%7C300x180%7C300x150%7C250x250%7C200x200%7C180x150%7C160x600%7C120x600%2C320x50%2C1x1%7C970x250%7C970x90%7C960x90%7C950x90%7C728x90%7C500x90%7C468x90%7C468x60&fluid=0%2Cheight%2C0&ifi=2&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1702977741720&lmt=1702977741&adxs=939%2C0%2C147&adys=424%2C0%2C258&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=2%7C3%7C4&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fcaffeine.softonic.com.br%2F&vis=1&psz=300x0%7C1263x0%7C970x0&msz=300x0%7C1263x0%7C970x0&fws=512%2C4%2C4&ohw=0%2C1263%2C970&ga_vid=430166992.1702977739&ga_sid=1702977742&ga_hid=1147585949&ga_fc=true&td=1&topics=9&tps=9&htps=10&a3p=EhsKDGlkNS1zeW5jLmNvbRiIx4iLyDFIAFICCGQ.&nt=1&psd=WzE1LFsyLFtbIi81MzAyL2Rlc2t0b3AvZGVza3RvcC1XZWItcHQvQXBwcy9Qcm9ncmFtcGFnZS9BVEZfTVBVX0ZpcnN0IixbXV0sWyIvNTMwMi9kZXNrdG9wL2Rlc2t0b3AtV2ViLXB0L0FwcHMvUHJvZ3JhbXBhZ2UvQVRGX05vdGlmaWNhdGlvbmJhciIsW11dLFsiLzUzMDIvZGVza3RvcC9kZXNrdG9wLVdlYi1wdC9BcHBzL1Byb2dyYW1wYWdlL0FURl9MZWFkZXJib2FyZF9GaXJzdCIsW11dXV0sbnVsbCwzXQ..&dlt=1702977735228&idt=6425&prev_scp=pos%3Dtop%26countryCluster%3DA1%26td-slot%3Dtop-mpu-1%26hvi%3Dfalse%26type%3Dtop_display_mpu%26afcSlotId%3D1217021608%26amznbid%3D2%26amznp%3D2%7Cpos%3Dtop%26countryCluster%3DA1%26td-slot%3Dnative-notificationbar%26hvi%3Dfalse%26type%3Dnative_notificationbar%26devicePlatformId%3Dwindows%7Cpos%3Dtop%26countryCluster%3DA1%26td-slot%3Dtop-leaderboard-1%26hvi%3Dfalse%26type%3Dtop_display_leaderboard%26amznbid%3D2%26amznp%3D2&cust_params=medium%3Dorganic%26campaign%3D%26source%3Dnone%26medium_campaign%3Dorganic%26medium_source%3Dorganic-none%26file%3Df46a4db4-96d4-11e6-b215-00163ec9f5fa%26reviewvecna%3Dfalse%26recat%3Dutilities-tools%26hosted%3Dfalse%26compliant%3D1%26devel%3D0%26locale%3Dpt-BR%26author%3DZhornsoftware%26content%3Drich%26country%3DUS%26region%3DA%26platformId%3Dwindows%26ad_session_id%3Dca334998-1875-4288-9025-8f913da6a89a%26pv%3D1%26ab_upr%3D6%26personalized%3D1&adks=4226504758%2C3804165121%2C1886130427&frm=20
Preview:	{"/5302/desktop/desktop-Web-pt/Apps/Programpage/ATF_MPU_First":["html",0,0,null,0,600,300,0,0,null,null,null,1,[["ID=3789708c9d74f432:T=1702977743:RT=1702977743:S=ALNI_MbSvJZdf-YhVIe1BEaQ25VI38Mzaw",1736673743,"/","softonic.com.br",1],["UID=00000dab022b7eeb:T=1702977743:RT=1702977743:S=ALNI_MZghrL0K7gX-sBL-v94m7poACg6vA",1736673743,"/","softonic.com.br",2]],[138449286096],[6394220594],[39222659],[3255419221],null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGsk0RqwgZ3S2aTdtEse5fj78UYFrED5tHdsjiTXoPlzqQlrJK0p_TwJ_-M2NMN6xpbCsw1eoLKMSL9HZifjJ52_oZsrN3Wa_C0Rs3pc","CJfE3LuWm4MDFdDuKAUd1xQP4Q",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2",null,null,null,null,null,null,null,null,["https://securepubads.g.doubleclick.net/td/sjs","https://securepubads.g.doubleclick.net/td/sts",["https://f.creativecdn.com","https://googleads.g.doubleclick.net","https://td.doubleclick.net"],"{\"maxFloorCpmUsdMicros\":\"13171996\"}",[[null,[[[11841],[1010023,101003

Chrome Cache Entry: 324

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=8876029;type=invmedia;cat=progr0;ord=2316977282064;auiddc=133230612.1702977737;u2=%2Fprogram_page;u3=Caffeine;ps=1;pcor=858286563;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F?
Preview:	<html></html>

Chrome Cache Entry: 325

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2920), with no line terminators
Category:	downloaded
Size (bytes):	2920
Entropy (8bit):	5.278382327824268
Encrypted:	false
SSDEEP:	48:0GoPdhpMzANg4+rItkVsjxe3iRfLIzzL9qMEqK/VEjbJtbmsrIonbl8Q6LBI0uBP:poPTdfbiVsjgiRfL2f9sqK/VEjiOnF6K
MD5:	653708AD1BBAE1579927B6391B2A28F3
SHA1:	4261E415C23DFD9D925F071737FB0D236F856F4E
SHA-256:	82D2DC44AAE1EDA52ABC17AFD30C6031B7175C13EE6955410164C66AE755ADFB
SHA-512:	4092D81BEEAADB7ECA73EE279AF0A5289CAF850253464BAA4F7695C49670C05F7E89630807A2C41D3D9CAD75D95A60719FDB1A16265537153952774F7450873C
Malicious:	false
URL:	https://js-sec.indexww.com/um/ixmatch.html
Preview:	<!doctype html><head></head><body><script>!function(t){var e={};function r(n){if(e[n])return e[n].exports;var i=e[n]={i:n,l:!1,exports:{}};return t[n].call(i.exports,i,i.exports,r),i.l=!0,i.exports}r.m=t,r.c=e,r.d=function(t,e,n){r.o(t,e)\|\|Object.defineProperty(t,e,{enumerable:!0,get:n})},r.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},r.t=function(t,e){if(1&e&&(t=r(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var n=Object.create(null);if(r.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var i in t)r.d(n,i,function(e){return t[e]}.bind(null,i));return n},r.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return r.d(e,"a",e),e},r.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},r.p="",r(r.s=0)}([function(t,e){let r=!1;const n={};let i,a,o,c;

Chrome Cache Entry: 326

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 17552, version 1.0
Category:	downloaded
Size (bytes):	17552
Entropy (8bit):	7.987413865061275
Encrypted:	false
SSDEEP:	384:om0VQltr4tCFNO09hUZNmoENr5o+XyfdQZx3gmCr51dI6Bph:ofVQltro8O04Z0oENregGoVCzB/
MD5:	0627EC86DFAD171BA217BBC765326ED7
SHA1:	D83F8AAC9CB272A8825602735E3766F4975D5C68
SHA-256:	D53336707C39D1EC20A2B1F7399CA9F183C45592E215A42FD596DFA2DBB8AD7A
SHA-512:	A64BB605C4C4A1D3A3905155E9F52B4C59ABB95FFFC61AA1405D6D4E4687AC308EF4104F897770AD8C7001E40F91F68EB35041D693367A970AAB2A86E80150E9
Malicious:	false
URL:	https://sc.sftcdn.net/fonts/d1174-0627e.woff2
Preview:	wOF2......D...........D..........................v.......`?STATD........8..G..4..6.$..d. ..@. ...;....v$..R.L".pc...R..-DQA.\...I.JD.O..7...UQd.Y..d:X..jO".8...2a. . .AH.8.-...2..w..Pe-..9..N....<...~.Dp.0.9pu..>.WZ*...Vw..B.)......s\..."..9....g.^.]g..........1Gh.\...._...[]...z.l...T.C:..~.x.....lB.!`...!..B...P..!"r.....J...c....!.j9.._.\..\|.8.~p..<....B..B.........{....^L...x.._..UYY...EaEgV_..T.e.rDD.b.t...-.U.....Bp..#T..c76w..<O...l.f..<[......S.X.H.........;..{..(H.C.........K.....E......na..W...P.R...#V..n..O......}...... "`..T../..Pm!a..)."?.>/..].b........i.'c.m;`..O ..<..........'..V.]S15C9.....2.L.9l....p.....%. y.H.J..f..4.{.......x.=...o..4..w^.z.-A.../kL.T..#.P...>R)R$...PA.$.X.s..L.....fP'....I....:V8..r....G.^........).......<......t.#..q&..X...t@...y.}.h...[.2.y.......oP(p......D..X.F.......jnT...{..s_#.D$.... ........3...J..y'..v.H.!..W4$.R.r+!...+.l....v.O?!}. .F!.........bR.B!...s..A.......f..........<..)@.....%.S

Chrome Cache Entry: 327

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	3872
Entropy (8bit):	7.944891888531463
Encrypted:	false
SSDEEP:	96:ZpxI5833wuZTKAFqOORI2K0QR5Lwv3akRUdcYRy+DNWO:EQZZuAFqO5quM1R4cZk5
MD5:	34147CD9E67071D9A81E30D5D67F14AB
SHA1:	71DED26B2CEAFCDB3CDCE44172A01E6300A81DB1
SHA-256:	D72FCC913FF278167A82AD6F38B75FB5643F04EF4A96EC67544805607F61F411
SHA-512:	F77DDE6D62714204EB1016332DACCC289F6105CB2F855E07FACA93E6A45843E7268244FBB74C778A000C800F9D3A0808BBFC274DB4DE1E856AC3C6E2B0431115
Malicious:	false
Preview:	RIFF....WEBPVP8L..../o....'...D..Q....(.......%m@.m7..$94...T..P...q..m[..}.]..%.....;d.Ru....(...A.@EI.P..P1.?....biF.Wh..;...;.\7....1_A+.^....i..1....I.k.......3/.........Z..YT.eJ...j...u..t.......U.....b....`............z....J.4....O2...;.q.l...nk.v..?.oDH.uZc......JQ.T7T@..\|..;c.rR?....0.@. ....\Q...(..b...;.b....I....DCr S.&.Q..D......:.,.<...$.D.......97.......Z.9;.....^s.i.3...Q.NgQ.PD+....-c3.e..V....%..L!.!.?A.@b....J.%....O..._.l......+......2..h`a.X....#.$......FYX.........R....a)..j.9..Q....Ui.F.8..`....&&.f?f/l'[.xa..X.g..F.l..KUu.G.l.(V..y.vol~...~q.)......pp.....uJ......)R.bwoww..tm....Il..&.4+..4.3C..$6.......x...._......#..A...`.[.g..Rz.....qI..#D$...4...F!.1h......#...Q..._...&[?.....]i..O!.^.b.+.g.aKc.n"B...X9Z..B..V.......7....M...l.....E..,.G,b..5.F.Z..z.]&...S/.BV..._*"...J...C..N.Vr..D%/m>..A.?..l....s.W.\..+N[\<b..J...[y...o^...\|....EG"...q......-]s,/.9...^Z.:2.....b....+xf..D.YCI...`.QH..

Chrome Cache Entry: 328

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	180
Entropy (8bit):	4.746129361819091
Encrypted:	false
SSDEEP:	3:xW8QHLGKwLHLWvHLGKwLTyTFWSJwXoJIRC9sJWWyBBdv64RNU64S0SHy4JsJY:xILGKwILGKw0bJw4WwuJR8HTuJY
MD5:	511CC822E26F1A381AEE81231117410A
SHA1:	C744515E6165AD9A3FA918F2F069DD1033856C0A
SHA-256:	9FD55A0EDEE9B34C7494600B6368D5DC4274B8B2F6FE70B68323AD8CD2BDDDDE
SHA-512:	1A2590DFB2BA63EDC648B257F6ECF7B5B3E8E797607C69C3B91F4969A44833604500A2F0A46407EB31CAA4A9876EC7ED32FA15003C98C66994F2F92115B424AB
Malicious:	false
URL:	https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.softonic.com.br
Preview:	[["softonic.com.br",null,"www.softonic.com.br",null,null,["52555387","5302"]],[],[],[31079527],null,[["5302",[["id5-sync.com","https://cdn.id5-sync.com/api/1.0/esp.js"]]]],null,[]]

Chrome Cache Entry: 329

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	3872
Entropy (8bit):	7.944891888531463
Encrypted:	false
SSDEEP:	96:ZpxI5833wuZTKAFqOORI2K0QR5Lwv3akRUdcYRy+DNWO:EQZZuAFqO5quM1R4cZk5
MD5:	34147CD9E67071D9A81E30D5D67F14AB
SHA1:	71DED26B2CEAFCDB3CDCE44172A01E6300A81DB1
SHA-256:	D72FCC913FF278167A82AD6F38B75FB5643F04EF4A96EC67544805607F61F411
SHA-512:	F77DDE6D62714204EB1016332DACCC289F6105CB2F855E07FACA93E6A45843E7268244FBB74C778A000C800F9D3A0808BBFC274DB4DE1E856AC3C6E2B0431115
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/a50240b4-a4d1-11e6-a970-00163ec9f5fa/1410616113/gs-auto-clicker-Download-GS-Auto-Clicker.jpg
Preview:	RIFF....WEBPVP8L..../o....'...D..Q....(.......%m@.m7..$94...T..P...q..m[..}.]..%.....;d.Ru....(...A.@EI.P..P1.?....biF.Wh..;...;.\7....1_A+.^....i..1....I.k.......3/.........Z..YT.eJ...j...u..t.......U.....b....`............z....J.4....O2...;.q.l...nk.v..?.oDH.uZc......JQ.T7T@..\|..;c.rR?....0.@. ....\Q...(..b...;.b....I....DCr S.&.Q..D......:.,.<...$.D.......97.......Z.9;.....^s.i.3...Q.NgQ.PD+....-c3.e..V....%..L!.!.?A.@b....J.%....O..._.l......+......2..h`a.X....#.$......FYX.........R....a)..j.9..Q....Ui.F.8..`....&&.f?f/l'[.xa..X.g..F.l..KUu.G.l.(V..y.vol~...~q.)......pp.....uJ......)R.bwoww..tm....Il..&.4+..4.3C..$6.......x...._......#..A...`.[.g..Rz.....qI..#D$...4...F!.1h......#...Q..._...&[?.....]i..O!.^.b.+.g.aKc.n"B...X9Z..B..V.......7....M...l.....E..,.G,b..5.F.Z..z.]&...S/.BV..._*"...J...C..N.Vr..D%/m>..A.?..l....s.W.\..+N[\<b..J...[y...o^...\|....EG"...q......-]s,/.9...^Z.:2.....b....+xf..D.YCI...`.QH..

Chrome Cache Entry: 330

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1726
Entropy (8bit):	7.841083874005227
Encrypted:	false
SSDEEP:	48:JAKCkiKVzFHfQLGhcR4sov12suXMKSswoEwM:lLQLusovcsu8KSswoc
MD5:	BE02947619CDB91398FEAFC78F28F72B
SHA1:	2BAE0F4C37806A564CD162922B2DF1BCAA0222B9
SHA-256:	93E563AEED3FBE7E5273337F8BDD820612AABC05649DDEEE87C2723F1DF292B3
SHA-512:	F821D6B5B56215F97A2F90E669D3E540BFB9F6EB76FAE3C92C6A44120DED7599F1AFDFAA9502C1BA515AC0F0B9A89F1EA8AD5749465DF50AF27BB056E2F0F7C5
Malicious:	false
URL:	https://images.sftcdn.net/images/t_app-icon-s/p/a3fbd9dc-96d0-11e6-88e1-00163ed833e7/146228571/cpu-z-146228571.png
Preview:	RIFF....WEBPVP8L..../o.....$g.;.0.s.nh(h#I.../..v....<.x...y.....fT...=..r$.$6.h%...Dg......@.I(....Lbs.L..cr.\|..Z7.m[.\|.d..zR...S......O....n.H.dLv.]....'...K~..wa.O_...D............z..SS...........P..%..I.G...qQ.a.....&....I.........i.....Ot...".0&p.....mC.C....m....h.D...:&1d....1...y...D..........GGv#}..J....L._...g.!3^...u_..L.../.%d.q...3.\..j`....}...w......"l....@.32.Mu..G....8/W!V.........T.......+..;x..(..0.J.2+ ........U.x..W..E.......+.V..V./.R{b.........Nx... [y^KJ(..bt..t[...y.....2V/..%.....W..<....TY...;/>l.k1b..W./....m..O....Zkr.....R....+.%..X1.`.!%.............M.6............F..[/......S..hd.._...n...F..S.~...Y...wa..Q.S..C1.R.)&....U...!....9....F...-....9d4%W....YW.y:d...Ar..;.@...;..@.-W..r......#..i..q.....x.E..;.`. ..t s8......x..XT..2.W.l.9....M...I.tG.7..JZ.a.A....J...3...Q9...Of.....t.f..V:UA6s1..&.....".#S){.=+.../..aR0.8...M.....".jz7.^\|....sJ..*r..d2..~...c...~H..-{./:....d.......MV....!.}

Chrome Cache Entry: 331

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0950611313667666
Encrypted:	false
SSDEEP:	3:CUMllRPQEsJ9pse:Gl3QEsJLse
MD5:	AD4B0F606E0F8465BC4C4C170B37E1A3
SHA1:	50B30FD5F87C85FE5CBA2635CB83316CA71250D7
SHA-256:	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
SHA-512:	EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
Malicious:	false
URL:	https://ad-delivery.net/px.gif?ch=2
Preview:	GIF89a.............!.......,...........L..;

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.999827144740539
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip
File size:	1'221'258 bytes
MD5:	7a5ecc07dd005c091a13964122209d54
SHA1:	a365d2d06123103cebf0d80769339ab6719a6beb
SHA256:	5af39a40fd88c628529eb1ba3461a6ce155ed9c32948960b4655140fbc4ea44c
SHA512:	e8b73c83308e421b82fc578142d72b9ce5f402786aa70a33513761d312e5e695ffc73e1daf60cf07fc26f3a54560a650133bd0e6051ae4b30a7b42c470c1455f
SSDEEP:	24576:p/+VBmuqbELKObM7X8nA9D63FmuuTg2GVSR7p3UB02EdbXiRl9ovBRyv2V:cSuq+KObM7M92TgVVSND2EhXYuTyeV
TLSH:	434533B1AB8504B795AB34D7C581D8AAD3B38FF4D2F363FF52B6D1A66203B468095084
File Content Preview:	PK.........I.WCn..........".$.caffeine-1.5-installer_qak-fw1.exe.. ...........[.[2....[.[2....[.[2..3l.._..N."<..Fw;.}.%.^Jz../.V.S}?...J$[....:=....d.R>......;...Oiu.o..Qtm.,[p.r.m;.X...."7D...&............W....<F..e@9...eF.i{\.d.Q.R..%.P..[7...b...`....

File Icon


Icon Hash:	1c1c1e4e4ececedc

Network Behavior

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2023 10:21:52.345572948 CET	192.168.2.16	1.1.1.1	0x35e8	Standard query (0)	d2e9lx3tt9d5g4.cloudfront.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:21:56.286849022 CET	192.168.2.16	1.1.1.1	0x8e52	Standard query (0)	images.sftcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:02.852993011 CET	192.168.2.16	1.1.1.1	0x1388	Standard query (0)	gsf-fl.softonic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:03.582643032 CET	192.168.2.16	1.1.1.1	0xa1d1	Standard query (0)	caffeine.softonic.com.br	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.251511097 CET	192.168.2.16	1.1.1.1	0x6aac	Standard query (0)	analytics.apis.mcafee.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.874396086 CET	192.168.2.16	1.1.1.1	0x9cff	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.874720097 CET	192.168.2.16	1.1.1.1	0x89a2	Standard query (0)	v7event.stats.avast.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:12.255212069 CET	192.168.2.16	1.1.1.1	0x588e	Standard query (0)	sadownload.mcafee.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:12.287395954 CET	192.168.2.16	1.1.1.1	0xf98a	Standard query (0)	analytics.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:14.366950989 CET	192.168.2.16	1.1.1.1	0xc793	Standard query (0)	gsf-fl.softonic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:14.369189024 CET	192.168.2.16	1.1.1.1	0xf388	Standard query (0)	gsf-fl.softonic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:14.377769947 CET	192.168.2.16	1.1.1.1	0x3c38	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:14.378144979 CET	192.168.2.16	1.1.1.1	0x6879	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:14.378496885 CET	192.168.2.16	1.1.1.1	0x68d6	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:14.378755093 CET	192.168.2.16	1.1.1.1	0x3a73	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:15.090054989 CET	192.168.2.16	1.1.1.1	0x9c72	Standard query (0)	caffeine.softonic.com.br	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:15.090424061 CET	192.168.2.16	1.1.1.1	0xe53e	Standard query (0)	caffeine.softonic.com.br	65	IN (0x0001)	false
Dec 19, 2023 10:22:16.369709969 CET	192.168.2.16	1.1.1.1	0xe44b	Standard query (0)	sc.sftcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.369995117 CET	192.168.2.16	1.1.1.1	0xc5ea	Standard query (0)	sc.sftcdn.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:16.375020027 CET	192.168.2.16	1.1.1.1	0x1631	Standard query (0)	images.sftcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.375403881 CET	192.168.2.16	1.1.1.1	0x225	Standard query (0)	images.sftcdn.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:16.385216951 CET	192.168.2.16	1.1.1.1	0x728	Standard query (0)	sdk.privacy-center.org	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.385466099 CET	192.168.2.16	1.1.1.1	0x326	Standard query (0)	sdk.privacy-center.org	65	IN (0x0001)	false
Dec 19, 2023 10:22:16.500519991 CET	192.168.2.16	1.1.1.1	0x806a	Standard query (0)	c.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.500787973 CET	192.168.2.16	1.1.1.1	0x9e95	Standard query (0)	c.amazon-adsystem.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:16.503695011 CET	192.168.2.16	1.1.1.1	0x6d	Standard query (0)	securepubads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.503998995 CET	192.168.2.16	1.1.1.1	0xcc55	Standard query (0)	securepubads.g.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:16.542687893 CET	192.168.2.16	1.1.1.1	0xd1a0	Standard query (0)	softonic.com.br	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.542963028 CET	192.168.2.16	1.1.1.1	0xcdea	Standard query (0)	softonic.com.br	65	IN (0x0001)	false
Dec 19, 2023 10:22:17.472901106 CET	192.168.2.16	1.1.1.1	0x920c	Standard query (0)	images.sftcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:17.473490000 CET	192.168.2.16	1.1.1.1	0x68c	Standard query (0)	images.sftcdn.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:18.236342907 CET	192.168.2.16	1.1.1.1	0xb078	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.236638069 CET	192.168.2.16	1.1.1.1	0x9efe	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:18.439899921 CET	192.168.2.16	1.1.1.1	0x1143	Standard query (0)	8876029.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.440136909 CET	192.168.2.16	1.1.1.1	0x67b7	Standard query (0)	8876029.fls.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:18.441427946 CET	192.168.2.16	1.1.1.1	0xf418	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.441724062 CET	192.168.2.16	1.1.1.1	0x883a	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:18.442377090 CET	192.168.2.16	1.1.1.1	0x5f71	Standard query (0)	12325200.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.442666054 CET	192.168.2.16	1.1.1.1	0xed7f	Standard query (0)	12325200.fls.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:18.573504925 CET	192.168.2.16	1.1.1.1	0xc5d9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.573945999 CET	192.168.2.16	1.1.1.1	0xff40	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:18.599592924 CET	192.168.2.16	1.1.1.1	0x2b9b	Standard query (0)	securepubads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.599849939 CET	192.168.2.16	1.1.1.1	0x699e	Standard query (0)	securepubads.g.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:18.602092981 CET	192.168.2.16	1.1.1.1	0xf0a1	Standard query (0)	sc.sftcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.603650093 CET	192.168.2.16	1.1.1.1	0x5075	Standard query (0)	sc.sftcdn.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:18.609714031 CET	192.168.2.16	1.1.1.1	0x55fb	Standard query (0)	softonic.com.br	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.609941959 CET	192.168.2.16	1.1.1.1	0xf342	Standard query (0)	softonic.com.br	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.037044048 CET	192.168.2.16	1.1.1.1	0xd118	Standard query (0)	www.adsensecustomsearchads.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.037295103 CET	192.168.2.16	1.1.1.1	0x9c43	Standard query (0)	www.adsensecustomsearchads.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.283557892 CET	192.168.2.16	1.1.1.1	0xe00	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.283899069 CET	192.168.2.16	1.1.1.1	0x92e1	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.284787893 CET	192.168.2.16	1.1.1.1	0x5737	Standard query (0)	www.datadoghq-browser-agent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.285263062 CET	192.168.2.16	1.1.1.1	0xcc93	Standard query (0)	www.datadoghq-browser-agent.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.605622053 CET	192.168.2.16	1.1.1.1	0x8096	Standard query (0)	www.adsensecustomsearchads.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.606031895 CET	192.168.2.16	1.1.1.1	0x4348	Standard query (0)	www.adsensecustomsearchads.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.697772026 CET	192.168.2.16	1.1.1.1	0xd019	Standard query (0)	id5-sync.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.698113918 CET	192.168.2.16	1.1.1.1	0x8824	Standard query (0)	id5-sync.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.752278090 CET	192.168.2.16	1.1.1.1	0xe6	Standard query (0)	brightcombid.marphezis.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.752614975 CET	192.168.2.16	1.1.1.1	0xd094	Standard query (0)	brightcombid.marphezis.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.757004023 CET	192.168.2.16	1.1.1.1	0x9e16	Standard query (0)	hbopenbid.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.757281065 CET	192.168.2.16	1.1.1.1	0x103b	Standard query (0)	hbopenbid.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.759800911 CET	192.168.2.16	1.1.1.1	0x507b	Standard query (0)	prebid.media.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.760139942 CET	192.168.2.16	1.1.1.1	0xbe6f	Standard query (0)	prebid.media.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.763664007 CET	192.168.2.16	1.1.1.1	0x23e2	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.763907909 CET	192.168.2.16	1.1.1.1	0xdf16	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.767370939 CET	192.168.2.16	1.1.1.1	0x7103	Standard query (0)	ad.360yield.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.767633915 CET	192.168.2.16	1.1.1.1	0x8cad	Standard query (0)	ad.360yield.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.769258976 CET	192.168.2.16	1.1.1.1	0xb99	Standard query (0)	hb-api.omnitagjs.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.769424915 CET	192.168.2.16	1.1.1.1	0xc97a	Standard query (0)	hb-api.omnitagjs.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.771214008 CET	192.168.2.16	1.1.1.1	0x63e1	Standard query (0)	ap.lijit.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.771480083 CET	192.168.2.16	1.1.1.1	0x3e15	Standard query (0)	ap.lijit.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.777481079 CET	192.168.2.16	1.1.1.1	0x5557	Standard query (0)	htlb.casalemedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.777798891 CET	192.168.2.16	1.1.1.1	0x6b8b	Standard query (0)	htlb.casalemedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:19.779697895 CET	192.168.2.16	1.1.1.1	0x4f24	Standard query (0)	shb.richaudience.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.779911995 CET	192.168.2.16	1.1.1.1	0x7f8a	Standard query (0)	shb.richaudience.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:20.045111895 CET	192.168.2.16	1.1.1.1	0xc4b5	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.045391083 CET	192.168.2.16	1.1.1.1	0xc2eb	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:20.241153955 CET	192.168.2.16	1.1.1.1	0x8feb	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.241770029 CET	192.168.2.16	1.1.1.1	0xa9aa	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:20.283737898 CET	192.168.2.16	1.1.1.1	0x90ba	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.284019947 CET	192.168.2.16	1.1.1.1	0x2370	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:20.351255894 CET	192.168.2.16	1.1.1.1	0x84be	Standard query (0)	ampcid.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.351506948 CET	192.168.2.16	1.1.1.1	0x1f6a	Standard query (0)	ampcid.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:20.565176964 CET	192.168.2.16	1.1.1.1	0xf907	Standard query (0)	caffeine.softonic.com.br	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.565550089 CET	192.168.2.16	1.1.1.1	0x94c5	Standard query (0)	caffeine.softonic.com.br	65	IN (0x0001)	false
Dec 19, 2023 10:22:20.707264900 CET	192.168.2.16	1.1.1.1	0x77d6	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.707442999 CET	192.168.2.16	1.1.1.1	0xb08b	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:20.793642998 CET	192.168.2.16	1.1.1.1	0xfa53	Standard query (0)	btloader.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.793873072 CET	192.168.2.16	1.1.1.1	0x8912	Standard query (0)	btloader.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:20.804683924 CET	192.168.2.16	1.1.1.1	0xb814	Standard query (0)	lb.eu-1-id5-sync.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.804975033 CET	192.168.2.16	1.1.1.1	0x33a1	Standard query (0)	lb.eu-1-id5-sync.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:20.825479984 CET	192.168.2.16	1.1.1.1	0xf077	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.825689077 CET	192.168.2.16	1.1.1.1	0x9b19	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:20.863405943 CET	192.168.2.16	1.1.1.1	0x90a0	Standard query (0)	htlb.casalemedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.864968061 CET	192.168.2.16	1.1.1.1	0x4de9	Standard query (0)	htlb.casalemedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:21.318650961 CET	192.168.2.16	1.1.1.1	0x528a	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:21.319094896 CET	192.168.2.16	1.1.1.1	0x5dbd	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:21.476284981 CET	192.168.2.16	1.1.1.1	0xe0f6	Standard query (0)	aax.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:21.476506948 CET	192.168.2.16	1.1.1.1	0x87d3	Standard query (0)	aax.amazon-adsystem.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:21.782514095 CET	192.168.2.16	1.1.1.1	0x524a	Standard query (0)	api.btloader.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:21.782826900 CET	192.168.2.16	1.1.1.1	0x7241	Standard query (0)	api.btloader.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:22.424124956 CET	192.168.2.16	1.1.1.1	0x4629	Standard query (0)	s.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:22.424613953 CET	192.168.2.16	1.1.1.1	0xb7d0	Standard query (0)	s.amazon-adsystem.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:22.855281115 CET	192.168.2.16	1.1.1.1	0xa64d	Standard query (0)	securepubads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:22.855452061 CET	192.168.2.16	1.1.1.1	0x4522	Standard query (0)	securepubads.g.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.050843000 CET	192.168.2.16	1.1.1.1	0xe34a	Standard query (0)	ap.lijit.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.051239014 CET	192.168.2.16	1.1.1.1	0x71f0	Standard query (0)	ap.lijit.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.176412106 CET	192.168.2.16	1.1.1.1	0xee37	Standard query (0)	id5-sync.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.176654100 CET	192.168.2.16	1.1.1.1	0xa6dc	Standard query (0)	id5-sync.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.215343952 CET	192.168.2.16	1.1.1.1	0xdd1a	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.215607882 CET	192.168.2.16	1.1.1.1	0x7010	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.217946053 CET	192.168.2.16	1.1.1.1	0x71d4	Standard query (0)	ampcid.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.218183994 CET	192.168.2.16	1.1.1.1	0xfd3a	Standard query (0)	ampcid.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.226332903 CET	192.168.2.16	1.1.1.1	0x853f	Standard query (0)	lb.eu-1-id5-sync.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.226536989 CET	192.168.2.16	1.1.1.1	0xc9a6	Standard query (0)	lb.eu-1-id5-sync.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.280195951 CET	192.168.2.16	1.1.1.1	0x1961	Standard query (0)	c.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.280524015 CET	192.168.2.16	1.1.1.1	0xac75	Standard query (0)	c.amazon-adsystem.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.289742947 CET	192.168.2.16	1.1.1.1	0xa973	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.290071964 CET	192.168.2.16	1.1.1.1	0x8c59	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.296945095 CET	192.168.2.16	1.1.1.1	0x3d19	Standard query (0)	aax.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.297116041 CET	192.168.2.16	1.1.1.1	0x7ab5	Standard query (0)	aax.amazon-adsystem.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.829567909 CET	192.168.2.16	1.1.1.1	0x14c1	Standard query (0)	ap.lijit.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.830409050 CET	192.168.2.16	1.1.1.1	0xc32f	Standard query (0)	ap.lijit.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.830952883 CET	192.168.2.16	1.1.1.1	0xb050	Standard query (0)	visitor.omnitagjs.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.831449032 CET	192.168.2.16	1.1.1.1	0x1a4a	Standard query (0)	visitor.omnitagjs.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.918736935 CET	192.168.2.16	1.1.1.1	0xf3b0	Standard query (0)	acdn.adnxs.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.918998003 CET	192.168.2.16	1.1.1.1	0xd8b9	Standard query (0)	acdn.adnxs.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.919600964 CET	192.168.2.16	1.1.1.1	0x5338	Standard query (0)	js-sec.indexww.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.919771910 CET	192.168.2.16	1.1.1.1	0xcb94	Standard query (0)	js-sec.indexww.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.920392990 CET	192.168.2.16	1.1.1.1	0xcf34	Standard query (0)	ads.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.920591116 CET	192.168.2.16	1.1.1.1	0x38d0	Standard query (0)	ads.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:23.921211958 CET	192.168.2.16	1.1.1.1	0x2f3d	Standard query (0)	sync.richaudience.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.921416998 CET	192.168.2.16	1.1.1.1	0xa188	Standard query (0)	sync.richaudience.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:24.880152941 CET	192.168.2.16	1.1.1.1	0x5eb	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:24.880453110 CET	192.168.2.16	1.1.1.1	0xf476	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:24.899949074 CET	192.168.2.16	1.1.1.1	0xd27e	Standard query (0)	www.googletagservices.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:24.900247097 CET	192.168.2.16	1.1.1.1	0xd025	Standard query (0)	www.googletagservices.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:25.219687939 CET	192.168.2.16	1.1.1.1	0x4083	Standard query (0)	www.googletagservices.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.219947100 CET	192.168.2.16	1.1.1.1	0x5320	Standard query (0)	www.googletagservices.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:25.530333996 CET	192.168.2.16	1.1.1.1	0x50f4	Standard query (0)	secure.adnxs.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.530558109 CET	192.168.2.16	1.1.1.1	0x9ca7	Standard query (0)	secure.adnxs.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:25.560810089 CET	192.168.2.16	1.1.1.1	0x89c2	Standard query (0)	dis.criteo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.561064959 CET	192.168.2.16	1.1.1.1	0xeab2	Standard query (0)	dis.criteo.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:25.568779945 CET	192.168.2.16	1.1.1.1	0x76f4	Standard query (0)	x.bidswitch.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.568954945 CET	192.168.2.16	1.1.1.1	0x514	Standard query (0)	x.bidswitch.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:25.570030928 CET	192.168.2.16	1.1.1.1	0xc5a1	Standard query (0)	api-2-0.spot.im	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.570244074 CET	192.168.2.16	1.1.1.1	0x379a	Standard query (0)	api-2-0.spot.im	65	IN (0x0001)	false
Dec 19, 2023 10:22:25.572072029 CET	192.168.2.16	1.1.1.1	0x6f58	Standard query (0)	creativecdn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.573039055 CET	192.168.2.16	1.1.1.1	0x13ce	Standard query (0)	creativecdn.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:25.579411983 CET	192.168.2.16	1.1.1.1	0x1a9e	Standard query (0)	match.prod.bidr.io	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.579588890 CET	192.168.2.16	1.1.1.1	0x3ae6	Standard query (0)	match.prod.bidr.io	65	IN (0x0001)	false
Dec 19, 2023 10:22:25.581059933 CET	192.168.2.16	1.1.1.1	0xd0fe	Standard query (0)	match.adsrvr.org	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.581299067 CET	192.168.2.16	1.1.1.1	0x90e3	Standard query (0)	match.adsrvr.org	65	IN (0x0001)	false
Dec 19, 2023 10:22:25.586283922 CET	192.168.2.16	1.1.1.1	0x8e3b	Standard query (0)	image6.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.586561918 CET	192.168.2.16	1.1.1.1	0x7442	Standard query (0)	image6.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.030354023 CET	192.168.2.16	1.1.1.1	0xb071	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.030678034 CET	192.168.2.16	1.1.1.1	0xd46b	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.742897987 CET	192.168.2.16	1.1.1.1	0x6fdb	Standard query (0)	s.spotim.market	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.748868942 CET	192.168.2.16	1.1.1.1	0xb3bc	Standard query (0)	s.spotim.market	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.749389887 CET	192.168.2.16	1.1.1.1	0x51e	Standard query (0)	secure-assets.rubiconproject.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.749649048 CET	192.168.2.16	1.1.1.1	0xd243	Standard query (0)	secure-assets.rubiconproject.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.756263971 CET	192.168.2.16	1.1.1.1	0x517a	Standard query (0)	ssc-cms.33across.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.756524086 CET	192.168.2.16	1.1.1.1	0x6ec4	Standard query (0)	ssc-cms.33across.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.757045984 CET	192.168.2.16	1.1.1.1	0x7406	Standard query (0)	onetag-sys.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.757220984 CET	192.168.2.16	1.1.1.1	0x1d4e	Standard query (0)	onetag-sys.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.759025097 CET	192.168.2.16	1.1.1.1	0xe15d	Standard query (0)	ssbsync.smartadserver.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.759242058 CET	192.168.2.16	1.1.1.1	0xe941	Standard query (0)	ssbsync.smartadserver.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.760421038 CET	192.168.2.16	1.1.1.1	0xd199	Standard query (0)	sync.1rx.io	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.760727882 CET	192.168.2.16	1.1.1.1	0x5a84	Standard query (0)	sync.1rx.io	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.761363029 CET	192.168.2.16	1.1.1.1	0x93fb	Standard query (0)	rtb.gumgum.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.761636019 CET	192.168.2.16	1.1.1.1	0xaeab	Standard query (0)	rtb.gumgum.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.762159109 CET	192.168.2.16	1.1.1.1	0xb9b3	Standard query (0)	ssum-sec.casalemedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.762444019 CET	192.168.2.16	1.1.1.1	0xb24e	Standard query (0)	ssum-sec.casalemedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.763384104 CET	192.168.2.16	1.1.1.1	0x75ff	Standard query (0)	eus.rubiconproject.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.763571978 CET	192.168.2.16	1.1.1.1	0x5148	Standard query (0)	eus.rubiconproject.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.764034033 CET	192.168.2.16	1.1.1.1	0x6765	Standard query (0)	u.openx.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.764319897 CET	192.168.2.16	1.1.1.1	0x2caa	Standard query (0)	u.openx.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.764698982 CET	192.168.2.16	1.1.1.1	0xf9ce	Standard query (0)	ssbsync-us.smartadserver.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.764918089 CET	192.168.2.16	1.1.1.1	0xc9d5	Standard query (0)	ssbsync-us.smartadserver.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.811399937 CET	192.168.2.16	1.1.1.1	0x52c6	Standard query (0)	eb2.3lift.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.811558962 CET	192.168.2.16	1.1.1.1	0xd52b	Standard query (0)	eb2.3lift.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:26.927926064 CET	192.168.2.16	1.1.1.1	0x8790	Standard query (0)	ce.lijit.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.936068058 CET	192.168.2.16	1.1.1.1	0x29fd	Standard query (0)	ce.lijit.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.098202944 CET	192.168.2.16	1.1.1.1	0x1f2e	Standard query (0)	ad.360yield.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.098407984 CET	192.168.2.16	1.1.1.1	0xec35	Standard query (0)	ad.360yield.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.435231924 CET	192.168.2.16	1.1.1.1	0x85da	Standard query (0)	csync.smilewanted.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.436165094 CET	192.168.2.16	1.1.1.1	0xb7a7	Standard query (0)	csync.smilewanted.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.498672009 CET	192.168.2.16	1.1.1.1	0x1198	Standard query (0)	b1sync.zemanta.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.499165058 CET	192.168.2.16	1.1.1.1	0xb342	Standard query (0)	b1sync.zemanta.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.725975990 CET	192.168.2.16	1.1.1.1	0x38dc	Standard query (0)	de.tynt.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.726269007 CET	192.168.2.16	1.1.1.1	0xffd8	Standard query (0)	de.tynt.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.891110897 CET	192.168.2.16	1.1.1.1	0xa18e	Standard query (0)	um.simpli.fi	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.891366959 CET	192.168.2.16	1.1.1.1	0xad85	Standard query (0)	um.simpli.fi	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.892014980 CET	192.168.2.16	1.1.1.1	0xe63a	Standard query (0)	pixel-eu.rubiconproject.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.892658949 CET	192.168.2.16	1.1.1.1	0xf5cd	Standard query (0)	pixel-eu.rubiconproject.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.893580914 CET	192.168.2.16	1.1.1.1	0xae2a	Standard query (0)	data.adsrvr.org	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.893775940 CET	192.168.2.16	1.1.1.1	0x8a39	Standard query (0)	data.adsrvr.org	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.894335985 CET	192.168.2.16	1.1.1.1	0xc054	Standard query (0)	pixel-us-east.rubiconproject.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.894510031 CET	192.168.2.16	1.1.1.1	0xeda2	Standard query (0)	pixel-us-east.rubiconproject.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.905261040 CET	192.168.2.16	1.1.1.1	0x3112	Standard query (0)	us-u.openx.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.905548096 CET	192.168.2.16	1.1.1.1	0x865d	Standard query (0)	us-u.openx.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.968949080 CET	192.168.2.16	1.1.1.1	0x2b35	Standard query (0)	csync.loopme.me	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.969244957 CET	192.168.2.16	1.1.1.1	0x7f49	Standard query (0)	csync.loopme.me	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.969774008 CET	192.168.2.16	1.1.1.1	0x4032	Standard query (0)	rtb-csync.smartadserver.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.970015049 CET	192.168.2.16	1.1.1.1	0xa5ec	Standard query (0)	rtb-csync.smartadserver.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.035715103 CET	192.168.2.16	1.1.1.1	0xb95	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.036292076 CET	192.168.2.16	1.1.1.1	0x1252	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.037131071 CET	192.168.2.16	1.1.1.1	0xdac4	Standard query (0)	pixel.tapad.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.037573099 CET	192.168.2.16	1.1.1.1	0xb798	Standard query (0)	pixel.tapad.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.038383961 CET	192.168.2.16	1.1.1.1	0x57ae	Standard query (0)	us01.z.antigena.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.038690090 CET	192.168.2.16	1.1.1.1	0xe1c5	Standard query (0)	us01.z.antigena.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.219041109 CET	192.168.2.16	1.1.1.1	0x560c	Standard query (0)	simage2.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.219305038 CET	192.168.2.16	1.1.1.1	0x90dc	Standard query (0)	simage2.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.399382114 CET	192.168.2.16	1.1.1.1	0xf2af	Standard query (0)	pr-bh.ybp.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.399574995 CET	192.168.2.16	1.1.1.1	0x555c	Standard query (0)	pr-bh.ybp.yahoo.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.485825062 CET	192.168.2.16	1.1.1.1	0xf147	Standard query (0)	i.liadm.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.486110926 CET	192.168.2.16	1.1.1.1	0x9e28	Standard query (0)	i.liadm.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.490818977 CET	192.168.2.16	1.1.1.1	0xf2bc	Standard query (0)	pixel-sync.sitescout.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.491061926 CET	192.168.2.16	1.1.1.1	0x4c55	Standard query (0)	pixel-sync.sitescout.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.491744995 CET	192.168.2.16	1.1.1.1	0x7187	Standard query (0)	a.tribalfusion.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.492290974 CET	192.168.2.16	1.1.1.1	0x5862	Standard query (0)	a.tribalfusion.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.493520975 CET	192.168.2.16	1.1.1.1	0x74ef	Standard query (0)	dmp.brand-display.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.495480061 CET	192.168.2.16	1.1.1.1	0x6f37	Standard query (0)	dmp.brand-display.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.522654057 CET	192.168.2.16	1.1.1.1	0x19	Standard query (0)	hde.tynt.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.522835016 CET	192.168.2.16	1.1.1.1	0xf955	Standard query (0)	hde.tynt.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.798244953 CET	192.168.2.16	1.1.1.1	0x8df3	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.798444033 CET	192.168.2.16	1.1.1.1	0xd958	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.828728914 CET	192.168.2.16	1.1.1.1	0x7e81	Standard query (0)	dis.criteo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.829108953 CET	192.168.2.16	1.1.1.1	0xd9c3	Standard query (0)	dis.criteo.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.887759924 CET	192.168.2.16	1.1.1.1	0xc180	Standard query (0)	server.cpmstar.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.888042927 CET	192.168.2.16	1.1.1.1	0xda95	Standard query (0)	server.cpmstar.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.915987015 CET	192.168.2.16	1.1.1.1	0xd5dd	Standard query (0)	dsum-sec.casalemedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.916280031 CET	192.168.2.16	1.1.1.1	0x44df	Standard query (0)	dsum-sec.casalemedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:28.959563017 CET	192.168.2.16	1.1.1.1	0x9241	Standard query (0)	s.company-target.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.959805965 CET	192.168.2.16	1.1.1.1	0x204c	Standard query (0)	s.company-target.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.112446070 CET	192.168.2.16	1.1.1.1	0x9292	Standard query (0)	visitor-us-west-2.omnitagjs.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.112710953 CET	192.168.2.16	1.1.1.1	0x760b	Standard query (0)	visitor-us-west-2.omnitagjs.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.241642952 CET	192.168.2.16	1.1.1.1	0xa36e	Standard query (0)	ups.analytics.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.241906881 CET	192.168.2.16	1.1.1.1	0x4c6f	Standard query (0)	ups.analytics.yahoo.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.301894903 CET	192.168.2.16	1.1.1.1	0x56c4	Standard query (0)	sync.mathtag.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.302442074 CET	192.168.2.16	1.1.1.1	0x3b28	Standard query (0)	sync.mathtag.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.309674978 CET	192.168.2.16	1.1.1.1	0x6120	Standard query (0)	ads.stickyadstv.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.309897900 CET	192.168.2.16	1.1.1.1	0x6baa	Standard query (0)	ads.stickyadstv.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.312388897 CET	192.168.2.16	1.1.1.1	0xc2e8	Standard query (0)	pixel.rubiconproject.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.312694073 CET	192.168.2.16	1.1.1.1	0x980a	Standard query (0)	pixel.rubiconproject.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.316093922 CET	192.168.2.16	1.1.1.1	0x80b5	Standard query (0)	cs.admanmedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.316329002 CET	192.168.2.16	1.1.1.1	0xb3bc	Standard query (0)	cs.admanmedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.326900005 CET	192.168.2.16	1.1.1.1	0x550c	Standard query (0)	t.adx.opera.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.326900005 CET	192.168.2.16	1.1.1.1	0x98a1	Standard query (0)	t.adx.opera.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.378788948 CET	192.168.2.16	1.1.1.1	0x8957	Standard query (0)	pubmatic-match.dotomi.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.379235983 CET	192.168.2.16	1.1.1.1	0x8e0d	Standard query (0)	pubmatic-match.dotomi.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.452225924 CET	192.168.2.16	1.1.1.1	0x1c6d	Standard query (0)	image2.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.452572107 CET	192.168.2.16	1.1.1.1	0x177b	Standard query (0)	image2.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.592694044 CET	192.168.2.16	1.1.1.1	0x6cab	Standard query (0)	s.tribalfusion.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.592956066 CET	192.168.2.16	1.1.1.1	0xb2f5	Standard query (0)	s.tribalfusion.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.702893972 CET	192.168.2.16	1.1.1.1	0xe63c	Standard query (0)	dsum.casalemedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.703056097 CET	192.168.2.16	1.1.1.1	0x35a	Standard query (0)	dsum.casalemedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.856904030 CET	192.168.2.16	1.1.1.1	0x4e72	Standard query (0)	sync-tm.everesttech.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.857081890 CET	192.168.2.16	1.1.1.1	0xe524	Standard query (0)	sync-tm.everesttech.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.900604963 CET	192.168.2.16	1.1.1.1	0x859f	Standard query (0)	aax-eu.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.900970936 CET	192.168.2.16	1.1.1.1	0xec98	Standard query (0)	aax-eu.amazon-adsystem.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:29.976742983 CET	192.168.2.16	1.1.1.1	0xdda9	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.976954937 CET	192.168.2.16	1.1.1.1	0xf867	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.143449068 CET	192.168.2.16	1.1.1.1	0x872	Standard query (0)	bh.contextweb.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.143652916 CET	192.168.2.16	1.1.1.1	0x6835	Standard query (0)	bh.contextweb.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.226434946 CET	192.168.2.16	1.1.1.1	0xd80d	Standard query (0)	rtb.openx.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.226602077 CET	192.168.2.16	1.1.1.1	0x4db5	Standard query (0)	rtb.openx.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.280697107 CET	192.168.2.16	1.1.1.1	0x9ab2	Standard query (0)	cs.krushmedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.280956030 CET	192.168.2.16	1.1.1.1	0xc6ce	Standard query (0)	cs.krushmedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.281409025 CET	192.168.2.16	1.1.1.1	0x46e5	Standard query (0)	aorta.clickagy.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.282109976 CET	192.168.2.16	1.1.1.1	0x5f6f	Standard query (0)	aorta.clickagy.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.303697109 CET	192.168.2.16	1.1.1.1	0x7444	Standard query (0)	ad.turn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.304020882 CET	192.168.2.16	1.1.1.1	0x908a	Standard query (0)	ad.turn.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.369086981 CET	192.168.2.16	1.1.1.1	0x5f7f	Standard query (0)	token.rubiconproject.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.369494915 CET	192.168.2.16	1.1.1.1	0x2f3e	Standard query (0)	token.rubiconproject.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.570904016 CET	192.168.2.16	1.1.1.1	0x4f1d	Standard query (0)	match.sharethrough.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.571065903 CET	192.168.2.16	1.1.1.1	0xe4f	Standard query (0)	match.sharethrough.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.578368902 CET	192.168.2.16	1.1.1.1	0x7c69	Standard query (0)	sync.srv.stackadapt.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.578752995 CET	192.168.2.16	1.1.1.1	0x70c3	Standard query (0)	sync.srv.stackadapt.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.590702057 CET	192.168.2.16	1.1.1.1	0xa050	Standard query (0)	sync.ipredictive.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.590877056 CET	192.168.2.16	1.1.1.1	0x6fef	Standard query (0)	sync.ipredictive.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.602528095 CET	192.168.2.16	1.1.1.1	0x3f68	Standard query (0)	match.deepintent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.602693081 CET	192.168.2.16	1.1.1.1	0x446f	Standard query (0)	match.deepintent.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.630779982 CET	192.168.2.16	1.1.1.1	0x3999	Standard query (0)	c1.adform.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.632915020 CET	192.168.2.16	1.1.1.1	0xd2d9	Standard query (0)	c1.adform.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:30.811459064 CET	192.168.2.16	1.1.1.1	0x6666	Standard query (0)	sync-dmp.mobtrakk.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.811655998 CET	192.168.2.16	1.1.1.1	0x19cf	Standard query (0)	sync-dmp.mobtrakk.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.079384089 CET	192.168.2.16	1.1.1.1	0xc414	Standard query (0)	tg.socdm.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.079678059 CET	192.168.2.16	1.1.1.1	0x68f7	Standard query (0)	tg.socdm.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.311131954 CET	192.168.2.16	1.1.1.1	0xbed1	Standard query (0)	thrtle.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.311296940 CET	192.168.2.16	1.1.1.1	0xa5bb	Standard query (0)	thrtle.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.312051058 CET	192.168.2.16	1.1.1.1	0x1cc7	Standard query (0)	crb.kargo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.312571049 CET	192.168.2.16	1.1.1.1	0x22ad	Standard query (0)	crb.kargo.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.313240051 CET	192.168.2.16	1.1.1.1	0xf3c4	Standard query (0)	sync.bfmio.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.313504934 CET	192.168.2.16	1.1.1.1	0x7b80	Standard query (0)	sync.bfmio.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.313893080 CET	192.168.2.16	1.1.1.1	0x85c9	Standard query (0)	pmp.mxptint.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.314122915 CET	192.168.2.16	1.1.1.1	0x4626	Standard query (0)	pmp.mxptint.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.314662933 CET	192.168.2.16	1.1.1.1	0xee58	Standard query (0)	rtb.adentifi.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.314862013 CET	192.168.2.16	1.1.1.1	0x274f	Standard query (0)	rtb.adentifi.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.438591957 CET	192.168.2.16	1.1.1.1	0xda73	Standard query (0)	tr.blismedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.439124107 CET	192.168.2.16	1.1.1.1	0x8a1c	Standard query (0)	tr.blismedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.491605997 CET	192.168.2.16	1.1.1.1	0x8f1f	Standard query (0)	usersync.gumgum.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.491802931 CET	192.168.2.16	1.1.1.1	0xf5e7	Standard query (0)	usersync.gumgum.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.652921915 CET	192.168.2.16	1.1.1.1	0x689f	Standard query (0)	image8.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.653090954 CET	192.168.2.16	1.1.1.1	0xd4b4	Standard query (0)	image8.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.676714897 CET	192.168.2.16	1.1.1.1	0xed47	Standard query (0)	ssbsync-global.smartadserver.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.676969051 CET	192.168.2.16	1.1.1.1	0x1507	Standard query (0)	ssbsync-global.smartadserver.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.679450035 CET	192.168.2.16	1.1.1.1	0xa1a9	Standard query (0)	qsearch-a.akamaihd.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.679754019 CET	192.168.2.16	1.1.1.1	0x4460	Standard query (0)	qsearch-a.akamaihd.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.684679031 CET	192.168.2.16	1.1.1.1	0xe832	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.697227001 CET	192.168.2.16	1.1.1.1	0x19e4	Standard query (0)	simage4.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.697529078 CET	192.168.2.16	1.1.1.1	0x8d3d	Standard query (0)	simage4.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.698183060 CET	192.168.2.16	1.1.1.1	0xf05e	Standard query (0)	config.aps.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.698537111 CET	192.168.2.16	1.1.1.1	0x51f3	Standard query (0)	config.aps.amazon-adsystem.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.699039936 CET	192.168.2.16	1.1.1.1	0x2cd4	Standard query (0)	ad-delivery.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.699294090 CET	192.168.2.16	1.1.1.1	0x9df2	Standard query (0)	ad-delivery.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.699721098 CET	192.168.2.16	1.1.1.1	0xf45e	Standard query (0)	sync.adotmob.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.699958086 CET	192.168.2.16	1.1.1.1	0x3d1b	Standard query (0)	sync.adotmob.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.700795889 CET	192.168.2.16	1.1.1.1	0xe684	Standard query (0)	rtb.mfadsrvr.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.700978994 CET	192.168.2.16	1.1.1.1	0x136f	Standard query (0)	rtb.mfadsrvr.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.725744009 CET	192.168.2.16	1.1.1.1	0x72d	Standard query (0)	odr.mookie1.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.726068020 CET	192.168.2.16	1.1.1.1	0xe9f5	Standard query (0)	odr.mookie1.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.766103983 CET	192.168.2.16	1.1.1.1	0xf573	Standard query (0)	p.rfihub.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.766335964 CET	192.168.2.16	1.1.1.1	0xd526	Standard query (0)	p.rfihub.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.838674068 CET	192.168.2.16	1.1.1.1	0xf050	Standard query (0)	inv-nets.admixer.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.838895082 CET	192.168.2.16	1.1.1.1	0x5007	Standard query (0)	inv-nets.admixer.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.841628075 CET	192.168.2.16	1.1.1.1	0xe47e	Standard query (0)	cms.quantserve.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.841852903 CET	192.168.2.16	1.1.1.1	0xb8c0	Standard query (0)	cms.quantserve.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:31.891117096 CET	192.168.2.16	1.1.1.1	0x8b33	Standard query (0)	cs-server-s2s.yellowblue.io	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.891352892 CET	192.168.2.16	1.1.1.1	0x6e24	Standard query (0)	cs-server-s2s.yellowblue.io	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.099627018 CET	192.168.2.16	1.1.1.1	0x9c7c	Standard query (0)	bttrack.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.099850893 CET	192.168.2.16	1.1.1.1	0x5e63	Standard query (0)	bttrack.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.117899895 CET	192.168.2.16	1.1.1.1	0xc79e	Standard query (0)	cm.adgrx.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.118100882 CET	192.168.2.16	1.1.1.1	0x12cc	Standard query (0)	cm.adgrx.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.122159958 CET	192.168.2.16	1.1.1.1	0xb856	Standard query (0)	cdn-ima.33across.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.122503042 CET	192.168.2.16	1.1.1.1	0xeb91	Standard query (0)	cdn-ima.33across.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.138537884 CET	192.168.2.16	1.1.1.1	0x60b9	Standard query (0)	cdn.id5-sync.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.138741016 CET	192.168.2.16	1.1.1.1	0x3dc2	Standard query (0)	cdn.id5-sync.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.256912947 CET	192.168.2.16	1.1.1.1	0xc5a	Standard query (0)	jadserve.postrelease.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.257086992 CET	192.168.2.16	1.1.1.1	0x9e0f	Standard query (0)	jadserve.postrelease.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.285335064 CET	192.168.2.16	1.1.1.1	0x84c1	Standard query (0)	dsp.adfarm1.adition.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.285489082 CET	192.168.2.16	1.1.1.1	0x1097	Standard query (0)	dsp.adfarm1.adition.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.287916899 CET	192.168.2.16	1.1.1.1	0x9885	Standard query (0)	ums.acuityplatform.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.288160086 CET	192.168.2.16	1.1.1.1	0xcaf0	Standard query (0)	ums.acuityplatform.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.289227009 CET	192.168.2.16	1.1.1.1	0x412b	Standard query (0)	rbp.mxptint.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.289505005 CET	192.168.2.16	1.1.1.1	0xa8bb	Standard query (0)	rbp.mxptint.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.484549999 CET	192.168.2.16	1.1.1.1	0x1fe0	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.484736919 CET	192.168.2.16	1.1.1.1	0x5435	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.626121998 CET	192.168.2.16	1.1.1.1	0x7df7	Standard query (0)	33across-match.dotomi.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.626477957 CET	192.168.2.16	1.1.1.1	0xb6f2	Standard query (0)	33across-match.dotomi.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.723808050 CET	192.168.2.16	1.1.1.1	0xf363	Standard query (0)	sync.spotim.market	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.724065065 CET	192.168.2.16	1.1.1.1	0xc16	Standard query (0)	sync.spotim.market	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.725718975 CET	192.168.2.16	1.1.1.1	0x91a2	Standard query (0)	ads.betweendigital.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.726042986 CET	192.168.2.16	1.1.1.1	0xcce4	Standard query (0)	ads.betweendigital.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:32.846543074 CET	192.168.2.16	1.1.1.1	0xd076	Standard query (0)	s0.2mdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.846801996 CET	192.168.2.16	1.1.1.1	0x9d39	Standard query (0)	s0.2mdn.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:33.129529953 CET	192.168.2.16	1.1.1.1	0xef2f	Standard query (0)	sync.crwdcntrl.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.129755974 CET	192.168.2.16	1.1.1.1	0x3f7f	Standard query (0)	sync.crwdcntrl.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:33.131330013 CET	192.168.2.16	1.1.1.1	0xefcd	Standard query (0)	d.turn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.131730080 CET	192.168.2.16	1.1.1.1	0x3cad	Standard query (0)	d.turn.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:33.133162975 CET	192.168.2.16	1.1.1.1	0xe698	Standard query (0)	casale-match.dotomi.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.133462906 CET	192.168.2.16	1.1.1.1	0xdc1a	Standard query (0)	casale-match.dotomi.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:33.135313034 CET	192.168.2.16	1.1.1.1	0x4351	Standard query (0)	cm.ctnsnet.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.135530949 CET	192.168.2.16	1.1.1.1	0x9d4d	Standard query (0)	cm.ctnsnet.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:33.139759064 CET	192.168.2.16	1.1.1.1	0x922e	Standard query (0)	cdn.indexww.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.140050888 CET	192.168.2.16	1.1.1.1	0xaac3	Standard query (0)	cdn.indexww.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:33.254185915 CET	192.168.2.16	1.1.1.1	0x6c50	Standard query (0)	a.sportradarserving.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.254338026 CET	192.168.2.16	1.1.1.1	0x5784	Standard query (0)	a.sportradarserving.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:33.267364979 CET	192.168.2.16	1.1.1.1	0x3c63	Standard query (0)	image4.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.267673016 CET	192.168.2.16	1.1.1.1	0xbb94	Standard query (0)	image4.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:33.603674889 CET	192.168.2.16	1.1.1.1	0xa480	Standard query (0)	capi.connatix.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.604861021 CET	192.168.2.16	1.1.1.1	0xc454	Standard query (0)	capi.connatix.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:33.644426107 CET	192.168.2.16	1.1.1.1	0x912b	Standard query (0)	rubicon-match.dotomi.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.644702911 CET	192.168.2.16	1.1.1.1	0x169	Standard query (0)	rubicon-match.dotomi.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:33.962790966 CET	192.168.2.16	1.1.1.1	0x9e0f	Standard query (0)	pm.w55c.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.962959051 CET	192.168.2.16	1.1.1.1	0xe597	Standard query (0)	pm.w55c.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.083164930 CET	192.168.2.16	1.1.1.1	0xf9ac	Standard query (0)	cs.minutemedia-prebid.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.083760977 CET	192.168.2.16	1.1.1.1	0xba3a	Standard query (0)	cs.minutemedia-prebid.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.180222034 CET	192.168.2.16	1.1.1.1	0x298e	Standard query (0)	lexicon.33across.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.180712938 CET	192.168.2.16	1.1.1.1	0x4671	Standard query (0)	lexicon.33across.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.211404085 CET	192.168.2.16	1.1.1.1	0xce1d	Standard query (0)	beacon.lynx.cognitivlabs.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.211601973 CET	192.168.2.16	1.1.1.1	0xf03a	Standard query (0)	beacon.lynx.cognitivlabs.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.244636059 CET	192.168.2.16	1.1.1.1	0x25a9	Standard query (0)	cs.yellowblue.io	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.245297909 CET	192.168.2.16	1.1.1.1	0x5d59	Standard query (0)	cs.yellowblue.io	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.246270895 CET	192.168.2.16	1.1.1.1	0x3dfc	Standard query (0)	ads.yieldmo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.246440887 CET	192.168.2.16	1.1.1.1	0xd861	Standard query (0)	ads.yieldmo.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.307200909 CET	192.168.2.16	1.1.1.1	0xbcfe	Standard query (0)	s.seedtag.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.307516098 CET	192.168.2.16	1.1.1.1	0x8a0b	Standard query (0)	s.seedtag.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.324821949 CET	192.168.2.16	1.1.1.1	0xcdd5	Standard query (0)	s2s.t13.io	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.325238943 CET	192.168.2.16	1.1.1.1	0x97c1	Standard query (0)	s2s.t13.io	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.466813087 CET	192.168.2.16	1.1.1.1	0x38fc	Standard query (0)	id.rlcdn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.467063904 CET	192.168.2.16	1.1.1.1	0x63e4	Standard query (0)	id.rlcdn.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.498137951 CET	192.168.2.16	1.1.1.1	0x638	Standard query (0)	e.serverbid.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.498313904 CET	192.168.2.16	1.1.1.1	0xc72f	Standard query (0)	e.serverbid.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.591552973 CET	192.168.2.16	1.1.1.1	0x5425	Standard query (0)	synchroscript.deliveryengine.adswizz.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.591810942 CET	192.168.2.16	1.1.1.1	0x6335	Standard query (0)	synchroscript.deliveryengine.adswizz.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.595211983 CET	192.168.2.16	1.1.1.1	0xc4a7	Standard query (0)	idsync.rlcdn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.595374107 CET	192.168.2.16	1.1.1.1	0xf528	Standard query (0)	idsync.rlcdn.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.596947908 CET	192.168.2.16	1.1.1.1	0x88e5	Standard query (0)	bcp.crwdcntrl.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.597170115 CET	192.168.2.16	1.1.1.1	0x6040	Standard query (0)	bcp.crwdcntrl.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.619575024 CET	192.168.2.16	1.1.1.1	0x85be	Standard query (0)	prebid-match.dotomi.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.619885921 CET	192.168.2.16	1.1.1.1	0x5ed6	Standard query (0)	prebid-match.dotomi.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:34.990739107 CET	192.168.2.16	1.1.1.1	0xaad3	Standard query (0)	match.sync.ad.cpe.dotomi.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.990864038 CET	192.168.2.16	1.1.1.1	0x5504	Standard query (0)	match.sync.ad.cpe.dotomi.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.001359940 CET	192.168.2.16	1.1.1.1	0x2c24	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.180006027 CET	192.168.2.16	1.1.1.1	0x241f	Standard query (0)	sync.targeting.unrulymedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.181791067 CET	192.168.2.16	1.1.1.1	0x5008	Standard query (0)	sync.targeting.unrulymedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.277220011 CET	192.168.2.16	1.1.1.1	0x2e24	Standard query (0)	match.adsby.bidtheatre.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.277220011 CET	192.168.2.16	1.1.1.1	0x6a27	Standard query (0)	match.adsby.bidtheatre.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.338006020 CET	192.168.2.16	1.1.1.1	0x3285	Standard query (0)	eb2.3lift.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.338006020 CET	192.168.2.16	1.1.1.1	0x7493	Standard query (0)	eb2.3lift.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.350032091 CET	192.168.2.16	1.1.1.1	0x8576	Standard query (0)	prebid.a-mo.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.350351095 CET	192.168.2.16	1.1.1.1	0xd767	Standard query (0)	prebid.a-mo.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.351996899 CET	192.168.2.16	1.1.1.1	0x6e5	Standard query (0)	visitor.omnitagjs.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.352435112 CET	192.168.2.16	1.1.1.1	0x86c8	Standard query (0)	visitor.omnitagjs.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.379679918 CET	192.168.2.16	1.1.1.1	0xd623	Standard query (0)	live.rezync.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.379827976 CET	192.168.2.16	1.1.1.1	0xdbc9	Standard query (0)	live.rezync.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.885245085 CET	192.168.2.16	1.1.1.1	0x5d7d	Standard query (0)	usr.undertone.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.885245085 CET	192.168.2.16	1.1.1.1	0x6a40	Standard query (0)	usr.undertone.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.888926029 CET	192.168.2.16	1.1.1.1	0xacf5	Standard query (0)	ad.mrtnsvr.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.889142990 CET	192.168.2.16	1.1.1.1	0x5bd7	Standard query (0)	ad.mrtnsvr.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.891251087 CET	192.168.2.16	1.1.1.1	0x189	Standard query (0)	gocm.c.appier.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.891824961 CET	192.168.2.16	1.1.1.1	0xb3fe	Standard query (0)	gocm.c.appier.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.892258883 CET	192.168.2.16	1.1.1.1	0x9c1f	Standard query (0)	ipac.ctnsnet.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.892757893 CET	192.168.2.16	1.1.1.1	0xdc54	Standard query (0)	ipac.ctnsnet.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.892858028 CET	192.168.2.16	1.1.1.1	0xeeff	Standard query (0)	core.iprom.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.893322945 CET	192.168.2.16	1.1.1.1	0x9c92	Standard query (0)	core.iprom.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.893322945 CET	192.168.2.16	1.1.1.1	0x5007	Standard query (0)	matching.truffle.bid	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.893865108 CET	192.168.2.16	1.1.1.1	0x8903	Standard query (0)	matching.truffle.bid	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.894313097 CET	192.168.2.16	1.1.1.1	0x9e6d	Standard query (0)	px.owneriq.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.894313097 CET	192.168.2.16	1.1.1.1	0xc4b6	Standard query (0)	px.owneriq.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.894714117 CET	192.168.2.16	1.1.1.1	0x7a97	Standard query (0)	bpi.rtactivate.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.895054102 CET	192.168.2.16	1.1.1.1	0x31f6	Standard query (0)	bpi.rtactivate.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.972865105 CET	192.168.2.16	1.1.1.1	0xcd3d	Standard query (0)	events-ssc.33across.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.972865105 CET	192.168.2.16	1.1.1.1	0x51e6	Standard query (0)	events-ssc.33across.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.973551989 CET	192.168.2.16	1.1.1.1	0x50a1	Standard query (0)	live.primis.tech	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.974138021 CET	192.168.2.16	1.1.1.1	0x6417	Standard query (0)	live.primis.tech	65	IN (0x0001)	false
Dec 19, 2023 10:22:35.974138021 CET	192.168.2.16	1.1.1.1	0x115d	Standard query (0)	sync-km.ads.yieldmo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.974582911 CET	192.168.2.16	1.1.1.1	0xc3ff	Standard query (0)	sync-km.ads.yieldmo.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:36.425529003 CET	192.168.2.16	1.1.1.1	0xce63	Standard query (0)	sync.ex.co	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.425740004 CET	192.168.2.16	1.1.1.1	0xee6c	Standard query (0)	sync.ex.co	65	IN (0x0001)	false
Dec 19, 2023 10:22:36.537158012 CET	192.168.2.16	1.1.1.1	0x2ec0	Standard query (0)	1f2e7.v.fwmrm.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.537280083 CET	192.168.2.16	1.1.1.1	0x7e5e	Standard query (0)	1f2e7.v.fwmrm.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:36.584544897 CET	192.168.2.16	1.1.1.1	0x9b13	Standard query (0)	sync.outbrain.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.584671021 CET	192.168.2.16	1.1.1.1	0x96a5	Standard query (0)	sync.outbrain.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:37.091192007 CET	192.168.2.16	1.1.1.1	0x1bdc	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.091322899 CET	192.168.2.16	1.1.1.1	0x8de7	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:37.092653990 CET	192.168.2.16	1.1.1.1	0x75fe	Standard query (0)	rtb-csync.smartadserver.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.092858076 CET	192.168.2.16	1.1.1.1	0x1cb	Standard query (0)	rtb-csync.smartadserver.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:37.138669014 CET	192.168.2.16	1.1.1.1	0x8773	Standard query (0)	s.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.138788939 CET	192.168.2.16	1.1.1.1	0x1b7a	Standard query (0)	s.amazon-adsystem.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:37.155970097 CET	192.168.2.16	1.1.1.1	0x9087	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.156100988 CET	192.168.2.16	1.1.1.1	0x6c26	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:37.495273113 CET	192.168.2.16	1.1.1.1	0xcccc	Standard query (0)	exchange.mediavine.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.495394945 CET	192.168.2.16	1.1.1.1	0xb5	Standard query (0)	exchange.mediavine.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:37.496264935 CET	192.168.2.16	1.1.1.1	0x740b	Standard query (0)	prebid-s2s.media.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.496395111 CET	192.168.2.16	1.1.1.1	0xb4a4	Standard query (0)	prebid-s2s.media.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:37.522797108 CET	192.168.2.16	1.1.1.1	0x759	Standard query (0)	simage2.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.522923946 CET	192.168.2.16	1.1.1.1	0x4390	Standard query (0)	simage2.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.063483000 CET	192.168.2.16	1.1.1.1	0x1c37	Standard query (0)	sync.aniview.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.063651085 CET	192.168.2.16	1.1.1.1	0xc62e	Standard query (0)	sync.aniview.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.277995110 CET	192.168.2.16	1.1.1.1	0x3b98	Standard query (0)	analytics.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.363969088 CET	192.168.2.16	1.1.1.1	0x34b9	Standard query (0)	analytics.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.366478920 CET	192.168.2.16	1.1.1.1	0x4cc8	Standard query (0)	shepherd.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.398602962 CET	192.168.2.16	1.1.1.1	0x9c3b	Standard query (0)	sync.intentiq.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.398725033 CET	192.168.2.16	1.1.1.1	0xec6b	Standard query (0)	sync.intentiq.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.413681030 CET	192.168.2.16	1.1.1.1	0x372b	Standard query (0)	pr-bh.ybp.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.413811922 CET	192.168.2.16	1.1.1.1	0xdcf2	Standard query (0)	pr-bh.ybp.yahoo.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.479652882 CET	192.168.2.16	1.1.1.1	0x7d5b	Standard query (0)	io.narrative.io	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.479778051 CET	192.168.2.16	1.1.1.1	0x4762	Standard query (0)	io.narrative.io	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.480863094 CET	192.168.2.16	1.1.1.1	0x96c0	Standard query (0)	a.audrte.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.480978012 CET	192.168.2.16	1.1.1.1	0x173	Standard query (0)	a.audrte.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.487185955 CET	192.168.2.16	1.1.1.1	0x298b	Standard query (0)	sync.richaudience.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.487567902 CET	192.168.2.16	1.1.1.1	0x71d9	Standard query (0)	sync.richaudience.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.531702995 CET	192.168.2.16	1.1.1.1	0x15eb	Standard query (0)	image2.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.531822920 CET	192.168.2.16	1.1.1.1	0xda3a	Standard query (0)	image2.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.671432018 CET	192.168.2.16	1.1.1.1	0xc000	Standard query (0)	dsum.casalemedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.671557903 CET	192.168.2.16	1.1.1.1	0x316c	Standard query (0)	dsum.casalemedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.672631979 CET	192.168.2.16	1.1.1.1	0xec9	Standard query (0)	us-u.openx.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.672738075 CET	192.168.2.16	1.1.1.1	0x4a24	Standard query (0)	us-u.openx.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.675548077 CET	192.168.2.16	1.1.1.1	0x67fe	Standard query (0)	ce.lijit.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.675683022 CET	192.168.2.16	1.1.1.1	0xd101	Standard query (0)	ce.lijit.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.676841974 CET	192.168.2.16	1.1.1.1	0xeb02	Standard query (0)	dsum-sec.casalemedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.676949978 CET	192.168.2.16	1.1.1.1	0x6d6b	Standard query (0)	dsum-sec.casalemedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.682658911 CET	192.168.2.16	1.1.1.1	0x9838	Standard query (0)	visitor-us-west-2.omnitagjs.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.682790041 CET	192.168.2.16	1.1.1.1	0x2c6b	Standard query (0)	visitor-us-west-2.omnitagjs.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.686044931 CET	192.168.2.16	1.1.1.1	0x6b2a	Standard query (0)	token.rubiconproject.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.686197042 CET	192.168.2.16	1.1.1.1	0x50f	Standard query (0)	token.rubiconproject.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.688908100 CET	192.168.2.16	1.1.1.1	0xe59f	Standard query (0)	onetag-sys.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.689034939 CET	192.168.2.16	1.1.1.1	0xb053	Standard query (0)	onetag-sys.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.691128016 CET	192.168.2.16	1.1.1.1	0xe6ef	Standard query (0)	aa.agkn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.691267967 CET	192.168.2.16	1.1.1.1	0x1180	Standard query (0)	aa.agkn.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.813368082 CET	192.168.2.16	1.1.1.1	0xd1a8	Standard query (0)	ads.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.813499928 CET	192.168.2.16	1.1.1.1	0xf3fe	Standard query (0)	ads.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.819660902 CET	192.168.2.16	1.1.1.1	0xa6df	Standard query (0)	aax-eu.amazon-adsystem.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.819787979 CET	192.168.2.16	1.1.1.1	0x7c1a	Standard query (0)	aax-eu.amazon-adsystem.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.827409983 CET	192.168.2.16	1.1.1.1	0xe0e7	Standard query (0)	pixel.rubiconproject.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.827539921 CET	192.168.2.16	1.1.1.1	0x5985	Standard query (0)	pixel.rubiconproject.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.834108114 CET	192.168.2.16	1.1.1.1	0xbe11	Standard query (0)	match.deepintent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.834450960 CET	192.168.2.16	1.1.1.1	0xb833	Standard query (0)	match.deepintent.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:38.838778019 CET	192.168.2.16	1.1.1.1	0xf07f	Standard query (0)	match.sharethrough.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.838910103 CET	192.168.2.16	1.1.1.1	0x136c	Standard query (0)	match.sharethrough.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:39.059293032 CET	192.168.2.16	1.1.1.1	0x9981	Standard query (0)	uipglob.semasio.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.059417963 CET	192.168.2.16	1.1.1.1	0x1d0f	Standard query (0)	uipglob.semasio.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:39.082926035 CET	192.168.2.16	1.1.1.1	0x7a01	Standard query (0)	ad-delivery.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.083095074 CET	192.168.2.16	1.1.1.1	0xaf6a	Standard query (0)	ad-delivery.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:39.084383011 CET	192.168.2.16	1.1.1.1	0x29fb	Standard query (0)	crb.kargo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.084512949 CET	192.168.2.16	1.1.1.1	0xfe09	Standard query (0)	crb.kargo.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:39.088027954 CET	192.168.2.16	1.1.1.1	0x814a	Standard query (0)	odr.mookie1.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.088391066 CET	192.168.2.16	1.1.1.1	0x399	Standard query (0)	odr.mookie1.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:39.095346928 CET	192.168.2.16	1.1.1.1	0x7877	Standard query (0)	usersync.gumgum.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.095499992 CET	192.168.2.16	1.1.1.1	0x8a35	Standard query (0)	usersync.gumgum.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:39.096570015 CET	192.168.2.16	1.1.1.1	0x96f	Standard query (0)	qsearch-a.akamaihd.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.096687078 CET	192.168.2.16	1.1.1.1	0xa6da	Standard query (0)	qsearch-a.akamaihd.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:39.098767042 CET	192.168.2.16	1.1.1.1	0xa5ae	Standard query (0)	cs-server-s2s.yellowblue.io	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.098896980 CET	192.168.2.16	1.1.1.1	0xbfff	Standard query (0)	cs-server-s2s.yellowblue.io	65	IN (0x0001)	false
Dec 19, 2023 10:22:39.106807947 CET	192.168.2.16	1.1.1.1	0x80d5	Standard query (0)	sync.spotim.market	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.106935978 CET	192.168.2.16	1.1.1.1	0xc864	Standard query (0)	sync.spotim.market	65	IN (0x0001)	false
Dec 19, 2023 10:22:39.344172001 CET	192.168.2.16	1.1.1.1	0x3209	Standard query (0)	image4.pubmatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.344397068 CET	192.168.2.16	1.1.1.1	0x104	Standard query (0)	image4.pubmatic.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:39.751050949 CET	192.168.2.16	1.1.1.1	0xe508	Standard query (0)	sync-tm.everesttech.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.751210928 CET	192.168.2.16	1.1.1.1	0x90a	Standard query (0)	sync-tm.everesttech.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:40.101005077 CET	192.168.2.16	1.1.1.1	0x100d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.101169109 CET	192.168.2.16	1.1.1.1	0xfec6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:40.112179041 CET	192.168.2.16	1.1.1.1	0xf41a	Standard query (0)	ssum-sec.casalemedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.112317085 CET	192.168.2.16	1.1.1.1	0xa521	Standard query (0)	ssum-sec.casalemedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:40.113341093 CET	192.168.2.16	1.1.1.1	0xda58	Standard query (0)	cdn.indexww.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.113468885 CET	192.168.2.16	1.1.1.1	0x894e	Standard query (0)	cdn.indexww.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:40.114532948 CET	192.168.2.16	1.1.1.1	0x2a73	Standard query (0)	s0.2mdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.114665031 CET	192.168.2.16	1.1.1.1	0x8c14	Standard query (0)	s0.2mdn.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:40.115712881 CET	192.168.2.16	1.1.1.1	0x3c39	Standard query (0)	api.btloader.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.115855932 CET	192.168.2.16	1.1.1.1	0x83a9	Standard query (0)	api.btloader.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:40.122479916 CET	192.168.2.16	1.1.1.1	0xd5eb	Standard query (0)	pixel.tapad.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.122617960 CET	192.168.2.16	1.1.1.1	0xd764	Standard query (0)	pixel.tapad.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:40.129410982 CET	192.168.2.16	1.1.1.1	0x4bdf	Standard query (0)	e.serverbid.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.129533052 CET	192.168.2.16	1.1.1.1	0x6131	Standard query (0)	e.serverbid.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:40.360929012 CET	192.168.2.16	1.1.1.1	0x7955	Standard query (0)	rtb.gumgum.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.361066103 CET	192.168.2.16	1.1.1.1	0xf3a4	Standard query (0)	rtb.gumgum.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:40.362035036 CET	192.168.2.16	1.1.1.1	0xa55a	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.362178087 CET	192.168.2.16	1.1.1.1	0xb6fc	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:40.364161015 CET	192.168.2.16	1.1.1.1	0x7b60	Standard query (0)	lexicon.33across.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.364300013 CET	192.168.2.16	1.1.1.1	0x2523	Standard query (0)	lexicon.33across.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:41.014425993 CET	192.168.2.16	1.1.1.1	0xa9da	Standard query (0)	cs.minutemedia-prebid.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.014642000 CET	192.168.2.16	1.1.1.1	0x7a55	Standard query (0)	cs.minutemedia-prebid.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:41.052093983 CET	192.168.2.16	1.1.1.1	0x8f9e	Standard query (0)	cs.yellowblue.io	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.052226067 CET	192.168.2.16	1.1.1.1	0x8aad	Standard query (0)	cs.yellowblue.io	65	IN (0x0001)	false
Dec 19, 2023 10:22:41.094319105 CET	192.168.2.16	1.1.1.1	0x79c5	Standard query (0)	thrtle.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.094469070 CET	192.168.2.16	1.1.1.1	0x7d68	Standard query (0)	thrtle.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:41.097187042 CET	192.168.2.16	1.1.1.1	0xc558	Standard query (0)	ads.yieldmo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.097321987 CET	192.168.2.16	1.1.1.1	0xacbc	Standard query (0)	ads.yieldmo.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:41.125706911 CET	192.168.2.16	1.1.1.1	0xdc7f	Standard query (0)	s2s.t13.io	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.125844955 CET	192.168.2.16	1.1.1.1	0x388f	Standard query (0)	s2s.t13.io	65	IN (0x0001)	false
Dec 19, 2023 10:22:41.128392935 CET	192.168.2.16	1.1.1.1	0xc1b3	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.128525019 CET	192.168.2.16	1.1.1.1	0x27c5	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:41.156984091 CET	192.168.2.16	1.1.1.1	0xed66	Standard query (0)	match.sync.ad.cpe.dotomi.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.157103062 CET	192.168.2.16	1.1.1.1	0x6094	Standard query (0)	match.sync.ad.cpe.dotomi.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:41.211663008 CET	192.168.2.16	1.1.1.1	0x6a69	Standard query (0)	synchroscript.deliveryengine.adswizz.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.211786985 CET	192.168.2.16	1.1.1.1	0xb2bd	Standard query (0)	synchroscript.deliveryengine.adswizz.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:41.495898962 CET	192.168.2.16	1.1.1.1	0x4e66	Standard query (0)	sync1.intentiq.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.496032953 CET	192.168.2.16	1.1.1.1	0x25b	Standard query (0)	sync1.intentiq.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:41.782599926 CET	192.168.2.16	1.1.1.1	0xef26	Standard query (0)	sync-km.ads.yieldmo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.782737017 CET	192.168.2.16	1.1.1.1	0x1ff	Standard query (0)	sync-km.ads.yieldmo.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:42.189492941 CET	192.168.2.16	1.1.1.1	0x711a	Standard query (0)	pippio.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:42.189663887 CET	192.168.2.16	1.1.1.1	0x9510	Standard query (0)	pippio.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:42.632080078 CET	192.168.2.16	1.1.1.1	0x8eac	Standard query (0)	bpi.rtactivate.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:42.632210970 CET	192.168.2.16	1.1.1.1	0x3b1d	Standard query (0)	bpi.rtactivate.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:42.889363050 CET	192.168.2.16	1.1.1.1	0x31cd	Standard query (0)	id.rlcdn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:42.889498949 CET	192.168.2.16	1.1.1.1	0xf0bf	Standard query (0)	id.rlcdn.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:42.972182035 CET	192.168.2.16	1.1.1.1	0x6300	Standard query (0)	usr.undertone.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:42.972341061 CET	192.168.2.16	1.1.1.1	0x3d2f	Standard query (0)	usr.undertone.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:43.310210943 CET	192.168.2.16	1.1.1.1	0x2e29	Standard query (0)	hb.yahoo.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.310343981 CET	192.168.2.16	1.1.1.1	0xef02	Standard query (0)	hb.yahoo.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:43.343882084 CET	192.168.2.16	1.1.1.1	0x94b6	Standard query (0)	capi.connatix.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.344011068 CET	192.168.2.16	1.1.1.1	0x239a	Standard query (0)	capi.connatix.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:43.506849051 CET	192.168.2.16	1.1.1.1	0x96e6	Standard query (0)	sync.ex.co	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.507004023 CET	192.168.2.16	1.1.1.1	0xcbfd	Standard query (0)	sync.ex.co	65	IN (0x0001)	false
Dec 19, 2023 10:22:43.523469925 CET	192.168.2.16	1.1.1.1	0x83ba	Standard query (0)	sync.outbrain.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.523597956 CET	192.168.2.16	1.1.1.1	0x17e5	Standard query (0)	sync.outbrain.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:43.555656910 CET	192.168.2.16	1.1.1.1	0x2a	Standard query (0)	events-ssc.33across.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.555761099 CET	192.168.2.16	1.1.1.1	0xa08f	Standard query (0)	events-ssc.33across.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:43.632680893 CET	192.168.2.16	1.1.1.1	0xa628	Standard query (0)	sync.crwdcntrl.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.633174896 CET	192.168.2.16	1.1.1.1	0x6b67	Standard query (0)	sync.crwdcntrl.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:43.692269087 CET	192.168.2.16	1.1.1.1	0x4dc9	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.716123104 CET	192.168.2.16	1.1.1.1	0xfc7a	Standard query (0)	sync.aniview.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.716234922 CET	192.168.2.16	1.1.1.1	0xa6c7	Standard query (0)	sync.aniview.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:43.722209930 CET	192.168.2.16	1.1.1.1	0xb68	Standard query (0)	bcp.crwdcntrl.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.722318888 CET	192.168.2.16	1.1.1.1	0x16a3	Standard query (0)	bcp.crwdcntrl.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:44.231425047 CET	192.168.2.16	1.1.1.1	0x29	Standard query (0)	exchange.mediavine.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.231532097 CET	192.168.2.16	1.1.1.1	0xd5a5	Standard query (0)	exchange.mediavine.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:44.269896984 CET	192.168.2.16	1.1.1.1	0x71fb	Standard query (0)	sync.technoratimedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.269999981 CET	192.168.2.16	1.1.1.1	0x6c89	Standard query (0)	sync.technoratimedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:44.638468981 CET	192.168.2.16	1.1.1.1	0x2ec8	Standard query (0)	i6.liadm.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.638575077 CET	192.168.2.16	1.1.1.1	0xdbd7	Standard query (0)	i6.liadm.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:45.970349073 CET	192.168.2.16	1.1.1.1	0x4e13	Standard query (0)	shepherd.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:46.743834972 CET	192.168.2.16	1.1.1.1	0x4443	Standard query (0)	home.mcafee.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.032740116 CET	192.168.2.16	1.1.1.1	0xad85	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.032871962 CET	192.168.2.16	1.1.1.1	0xa280	Standard query (0)	honzik.avcdn.net	28	IN (0x0001)	false
Dec 19, 2023 10:22:47.033061981 CET	192.168.2.16	1.1.1.1	0x6c60	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.033178091 CET	192.168.2.16	1.1.1.1	0x46cf	Standard query (0)	honzik.avcdn.net	28	IN (0x0001)	false
Dec 19, 2023 10:22:47.054757118 CET	192.168.2.16	1.1.1.1	0xf3cd	Standard query (0)	sadownload.mcafee.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.077900887 CET	192.168.2.16	1.1.1.1	0x5e3e	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.077996969 CET	192.168.2.16	1.1.1.1	0x5041	Standard query (0)	honzik.avcdn.net	28	IN (0x0001)	false
Dec 19, 2023 10:22:47.078200102 CET	192.168.2.16	1.1.1.1	0x2cb6	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.078315020 CET	192.168.2.16	1.1.1.1	0x4fe1	Standard query (0)	honzik.avcdn.net	28	IN (0x0001)	false
Dec 19, 2023 10:22:47.342921019 CET	192.168.2.16	1.1.1.1	0x8a22	Standard query (0)	x.dlx.addthis.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.343147993 CET	192.168.2.16	1.1.1.1	0x365c	Standard query (0)	x.dlx.addthis.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:47.734529972 CET	192.168.2.16	1.1.1.1	0x11c	Standard query (0)	analytics.apis.mcafee.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.897032976 CET	192.168.2.16	1.1.1.1	0xb9be	Standard query (0)	r.casalemedia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.897140980 CET	192.168.2.16	1.1.1.1	0x3121	Standard query (0)	r.casalemedia.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:48.106930971 CET	192.168.2.16	1.1.1.1	0x91db	Standard query (0)	sync.springserve.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.107027054 CET	192.168.2.16	1.1.1.1	0xc9fb	Standard query (0)	sync.springserve.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:48.850570917 CET	192.168.2.16	1.1.1.1	0xc5	Standard query (0)	dmp.adform.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.850718021 CET	192.168.2.16	1.1.1.1	0xc6c	Standard query (0)	dmp.adform.net	65	IN (0x0001)	false
Dec 19, 2023 10:22:49.159934998 CET	192.168.2.16	1.1.1.1	0x3495	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:49.159934998 CET	192.168.2.16	1.1.1.1	0xa95f	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:50.239468098 CET	192.168.2.16	1.1.1.1	0x26bc	Standard query (0)	analytics.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:51.119390965 CET	192.168.2.16	1.1.1.1	0xf73d	Standard query (0)	analytics.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:51.290371895 CET	192.168.2.16	1.1.1.1	0xbd98	Standard query (0)	shepherd.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:52.348910093 CET	192.168.2.16	1.1.1.1	0x21e	Standard query (0)	chrome.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:52.349044085 CET	192.168.2.16	1.1.1.1	0x7cd	Standard query (0)	chrome.google.com	65	IN (0x0001)	false
Dec 19, 2023 10:22:52.501770020 CET	192.168.2.16	1.1.1.1	0xdf88	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:52.501867056 CET	192.168.2.16	1.1.1.1	0xb5da	Standard query (0)	honzik.avcdn.net	28	IN (0x0001)	false
Dec 19, 2023 10:22:52.502048969 CET	192.168.2.16	1.1.1.1	0x6d76	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:52.502151966 CET	192.168.2.16	1.1.1.1	0x9d1b	Standard query (0)	honzik.avcdn.net	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2023 10:21:52.529772043 CET	1.1.1.1	192.168.2.16	0x35e8	No error (0)	d2e9lx3tt9d5g4.cloudfront.net		18.64.171.94	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:21:52.529772043 CET	1.1.1.1	192.168.2.16	0x35e8	No error (0)	d2e9lx3tt9d5g4.cloudfront.net		18.64.171.11	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:21:52.529772043 CET	1.1.1.1	192.168.2.16	0x35e8	No error (0)	d2e9lx3tt9d5g4.cloudfront.net		18.64.171.83	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:21:52.529772043 CET	1.1.1.1	192.168.2.16	0x35e8	No error (0)	d2e9lx3tt9d5g4.cloudfront.net		18.64.171.9	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:21:56.485274076 CET	1.1.1.1	192.168.2.16	0x8e52	No error (0)	images.sftcdn.net	softonic.san.cloudinary.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:21:56.485274076 CET	1.1.1.1	192.168.2.16	0x8e52	No error (0)	softonic.san.cloudinary.com	s4-san.cloudinary.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:03.011574030 CET	1.1.1.1	192.168.2.16	0x1388	No error (0)	gsf-fl.softonic.com	us-eu.softonic.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:03.011574030 CET	1.1.1.1	192.168.2.16	0x1388	No error (0)	us-eu.softonic.map.fastly.net		199.232.194.133	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:03.011574030 CET	1.1.1.1	192.168.2.16	0x1388	No error (0)	us-eu.softonic.map.fastly.net		199.232.198.133	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:03.941494942 CET	1.1.1.1	192.168.2.16	0xa1d1	No error (0)	caffeine.softonic.com.br		35.227.233.104	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.377417088 CET	1.1.1.1	192.168.2.16	0x6aac	No error (0)	analytics.apis.mcafee.com	mosaic-nova.apis.mcafee.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:09.377417088 CET	1.1.1.1	192.168.2.16	0x6aac	No error (0)	mosaic-nova.apis.mcafee.com		35.167.194.178	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.377417088 CET	1.1.1.1	192.168.2.16	0x6aac	No error (0)	mosaic-nova.apis.mcafee.com		54.201.164.34	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.377417088 CET	1.1.1.1	192.168.2.16	0x6aac	No error (0)	mosaic-nova.apis.mcafee.com		34.209.243.51	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.377417088 CET	1.1.1.1	192.168.2.16	0x6aac	No error (0)	mosaic-nova.apis.mcafee.com		34.213.112.26	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.377417088 CET	1.1.1.1	192.168.2.16	0x6aac	No error (0)	mosaic-nova.apis.mcafee.com		54.201.31.72	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.377417088 CET	1.1.1.1	192.168.2.16	0x6aac	No error (0)	mosaic-nova.apis.mcafee.com		52.13.13.90	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.377417088 CET	1.1.1.1	192.168.2.16	0x6aac	No error (0)	mosaic-nova.apis.mcafee.com		44.224.220.194	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.377417088 CET	1.1.1.1	192.168.2.16	0x6aac	No error (0)	mosaic-nova.apis.mcafee.com		44.229.45.4	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:09.999787092 CET	1.1.1.1	192.168.2.16	0x89a2	No error (0)	v7event.stats.avast.com	analytics.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:09.999787092 CET	1.1.1.1	192.168.2.16	0x89a2	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:09.999787092 CET	1.1.1.1	192.168.2.16	0x89a2	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:10.000509977 CET	1.1.1.1	192.168.2.16	0x9cff	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:12.380521059 CET	1.1.1.1	192.168.2.16	0x588e	No error (0)	sadownload.mcafee.com	sadownload-r53.awsconsumer.mcafee.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:12.380521059 CET	1.1.1.1	192.168.2.16	0x588e	No error (0)	sadownload-r53.awsconsumer.mcafee.com	sadownload.mcafee.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:12.412489891 CET	1.1.1.1	192.168.2.16	0xf98a	No error (0)	analytics.avcdn.net	analytics.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:12.412489891 CET	1.1.1.1	192.168.2.16	0xf98a	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:12.412489891 CET	1.1.1.1	192.168.2.16	0xf98a	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:14.503305912 CET	1.1.1.1	192.168.2.16	0x3c38	No error (0)	accounts.google.com		192.178.50.45	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:14.503510952 CET	1.1.1.1	192.168.2.16	0x68d6	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:14.503510952 CET	1.1.1.1	192.168.2.16	0x68d6	No error (0)	clients.l.google.com		192.178.50.46	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:14.504244089 CET	1.1.1.1	192.168.2.16	0x3a73	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:14.528042078 CET	1.1.1.1	192.168.2.16	0xf388	No error (0)	gsf-fl.softonic.com	us-eu.softonic.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:14.529294014 CET	1.1.1.1	192.168.2.16	0xc793	No error (0)	gsf-fl.softonic.com	us-eu.softonic.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:14.529294014 CET	1.1.1.1	192.168.2.16	0xc793	No error (0)	us-eu.softonic.map.fastly.net		199.232.194.133	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:14.529294014 CET	1.1.1.1	192.168.2.16	0xc793	No error (0)	us-eu.softonic.map.fastly.net		199.232.198.133	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:15.468961954 CET	1.1.1.1	192.168.2.16	0x9c72	No error (0)	caffeine.softonic.com.br		35.227.233.104	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.497266054 CET	1.1.1.1	192.168.2.16	0xe44b	No error (0)	sc.sftcdn.net	n.sni.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:16.497627974 CET	1.1.1.1	192.168.2.16	0xc5ea	No error (0)	sc.sftcdn.net	n.sni.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:16.500449896 CET	1.1.1.1	192.168.2.16	0x225	No error (0)	images.sftcdn.net	softonic.san.cloudinary.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:16.500449896 CET	1.1.1.1	192.168.2.16	0x225	No error (0)	softonic.san.cloudinary.com	s4-san.cloudinary.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:16.501889944 CET	1.1.1.1	192.168.2.16	0x1631	No error (0)	images.sftcdn.net	softonic.san.cloudinary.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:16.501889944 CET	1.1.1.1	192.168.2.16	0x1631	No error (0)	softonic.san.cloudinary.com	s4-san.cloudinary.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:16.510098934 CET	1.1.1.1	192.168.2.16	0x728	No error (0)	sdk.privacy-center.org		65.8.178.46	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.510098934 CET	1.1.1.1	192.168.2.16	0x728	No error (0)	sdk.privacy-center.org		65.8.178.69	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.510098934 CET	1.1.1.1	192.168.2.16	0x728	No error (0)	sdk.privacy-center.org		65.8.178.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.510098934 CET	1.1.1.1	192.168.2.16	0x728	No error (0)	sdk.privacy-center.org		65.8.178.25	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.625160933 CET	1.1.1.1	192.168.2.16	0x806a	No error (0)	c.amazon-adsystem.com	d1ykf07e75w7ss.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:16.625160933 CET	1.1.1.1	192.168.2.16	0x806a	No error (0)	d1ykf07e75w7ss.cloudfront.net		65.8.27.208	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.626091957 CET	1.1.1.1	192.168.2.16	0x9e95	No error (0)	c.amazon-adsystem.com	d1ykf07e75w7ss.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:16.628866911 CET	1.1.1.1	192.168.2.16	0x6d	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:16.628866911 CET	1.1.1.1	192.168.2.16	0x6d	No error (0)	securepubads46.g.doubleclick.net		172.217.3.66	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:16.629499912 CET	1.1.1.1	192.168.2.16	0xcc55	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:16.868005991 CET	1.1.1.1	192.168.2.16	0xd1a0	No error (0)	softonic.com.br		35.227.233.104	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:17.599045038 CET	1.1.1.1	192.168.2.16	0x920c	No error (0)	images.sftcdn.net	softonic.san.cloudinary.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:17.599045038 CET	1.1.1.1	192.168.2.16	0x920c	No error (0)	softonic.san.cloudinary.com	s4-san.cloudinary.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:17.653273106 CET	1.1.1.1	192.168.2.16	0x68c	No error (0)	images.sftcdn.net	softonic.san.cloudinary.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:17.653273106 CET	1.1.1.1	192.168.2.16	0x68c	No error (0)	softonic.san.cloudinary.com	s4-san.cloudinary.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:18.363756895 CET	1.1.1.1	192.168.2.16	0x9efe	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:18.363771915 CET	1.1.1.1	192.168.2.16	0xb078	No error (0)	www.google.com		142.250.189.132	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.566140890 CET	1.1.1.1	192.168.2.16	0xf418	No error (0)	td.doubleclick.net		192.178.50.66	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.591900110 CET	1.1.1.1	192.168.2.16	0x67b7	No error (0)	8876029.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:18.592231035 CET	1.1.1.1	192.168.2.16	0x1143	No error (0)	8876029.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:18.592231035 CET	1.1.1.1	192.168.2.16	0x1143	No error (0)	dart.l.doubleclick.net		142.250.64.166	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.592818022 CET	1.1.1.1	192.168.2.16	0x5f71	No error (0)	12325200.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:18.592818022 CET	1.1.1.1	192.168.2.16	0x5f71	No error (0)	dart.l.doubleclick.net		142.250.217.166	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.595855951 CET	1.1.1.1	192.168.2.16	0xed7f	No error (0)	12325200.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:18.703460932 CET	1.1.1.1	192.168.2.16	0xff40	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:18.703727961 CET	1.1.1.1	192.168.2.16	0xc5d9	No error (0)	www.google.com		172.217.3.68	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.724778891 CET	1.1.1.1	192.168.2.16	0x2b9b	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:18.724778891 CET	1.1.1.1	192.168.2.16	0x2b9b	No error (0)	securepubads46.g.doubleclick.net		192.178.50.66	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:18.725999117 CET	1.1.1.1	192.168.2.16	0x699e	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:18.729186058 CET	1.1.1.1	192.168.2.16	0x5075	No error (0)	sc.sftcdn.net	n.sni.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:18.743660927 CET	1.1.1.1	192.168.2.16	0xf0a1	No error (0)	sc.sftcdn.net	n.sni.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:18.749732018 CET	1.1.1.1	192.168.2.16	0x55fb	No error (0)	softonic.com.br		35.227.233.104	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.163350105 CET	1.1.1.1	192.168.2.16	0x9c43	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.163666964 CET	1.1.1.1	192.168.2.16	0xd118	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.163666964 CET	1.1.1.1	192.168.2.16	0xd118	No error (0)	www3.l.google.com		142.250.217.206	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.411117077 CET	1.1.1.1	192.168.2.16	0xe00	No error (0)	ad.doubleclick.net		192.178.50.70	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.411133051 CET	1.1.1.1	192.168.2.16	0x92e1	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Dec 19, 2023 10:22:19.411242962 CET	1.1.1.1	192.168.2.16	0x5737	No error (0)	www.datadoghq-browser-agent.com		13.226.54.207	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.732774019 CET	1.1.1.1	192.168.2.16	0x8096	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.732774019 CET	1.1.1.1	192.168.2.16	0x8096	No error (0)	www3.l.google.com		172.217.2.206	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.733977079 CET	1.1.1.1	192.168.2.16	0x4348	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.823189020 CET	1.1.1.1	192.168.2.16	0xd019	No error (0)	id5-sync.com		162.19.138.116	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.823189020 CET	1.1.1.1	192.168.2.16	0xd019	No error (0)	id5-sync.com		141.95.33.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.823189020 CET	1.1.1.1	192.168.2.16	0xd019	No error (0)	id5-sync.com		162.19.138.82	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.823189020 CET	1.1.1.1	192.168.2.16	0xd019	No error (0)	id5-sync.com		162.19.138.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.823189020 CET	1.1.1.1	192.168.2.16	0xd019	No error (0)	id5-sync.com		141.95.98.65	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.823189020 CET	1.1.1.1	192.168.2.16	0xd019	No error (0)	id5-sync.com		141.95.98.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.823189020 CET	1.1.1.1	192.168.2.16	0xd019	No error (0)	id5-sync.com		162.19.138.119	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.823189020 CET	1.1.1.1	192.168.2.16	0xd019	No error (0)	id5-sync.com		162.19.138.118	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.823189020 CET	1.1.1.1	192.168.2.16	0xd019	No error (0)	id5-sync.com		162.19.138.83	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.823189020 CET	1.1.1.1	192.168.2.16	0xd019	No error (0)	id5-sync.com		162.19.138.117	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.884232044 CET	1.1.1.1	192.168.2.16	0xe6	No error (0)	brightcombid.marphezis.com	rt.marphezis.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.884232044 CET	1.1.1.1	192.168.2.16	0xe6	No error (0)	rt.marphezis.com		178.128.135.204	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.884840012 CET	1.1.1.1	192.168.2.16	0xd094	No error (0)	brightcombid.marphezis.com	rt.marphezis.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897113085 CET	1.1.1.1	192.168.2.16	0x9e16	No error (0)	hbopenbid.pubmatic.com	hbprebid-v3.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897113085 CET	1.1.1.1	192.168.2.16	0x9e16	No error (0)	hbprebid-v3.pubmnet.com	gob-njr3.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897113085 CET	1.1.1.1	192.168.2.16	0x9e16	No error (0)	gob-njr3.pubmnet.com		104.36.115.111	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897553921 CET	1.1.1.1	192.168.2.16	0x507b	No error (0)	prebid.media.net		34.120.63.153	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897969961 CET	1.1.1.1	192.168.2.16	0x63e1	No error (0)	ap.lijit.com	vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897969961 CET	1.1.1.1	192.168.2.16	0x63e1	No error (0)	vap.lijit.com	nase.vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897969961 CET	1.1.1.1	192.168.2.16	0x63e1	No error (0)	nase.vap.lijit.com		69.175.41.32	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897969961 CET	1.1.1.1	192.168.2.16	0x63e1	No error (0)	nase.vap.lijit.com		63.251.86.49	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897969961 CET	1.1.1.1	192.168.2.16	0x63e1	No error (0)	nase.vap.lijit.com		63.251.86.51	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897979975 CET	1.1.1.1	192.168.2.16	0xb99	No error (0)	hb-api.omnitagjs.com	hb-api-us-west-2.omnitagjs.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897979975 CET	1.1.1.1	192.168.2.16	0xb99	No error (0)	hb-api-us-west-2.omnitagjs.com		44.231.162.210	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897979975 CET	1.1.1.1	192.168.2.16	0xb99	No error (0)	hb-api-us-west-2.omnitagjs.com		35.161.37.58	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897979975 CET	1.1.1.1	192.168.2.16	0xb99	No error (0)	hb-api-us-west-2.omnitagjs.com		35.163.115.57	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897979975 CET	1.1.1.1	192.168.2.16	0xb99	No error (0)	hb-api-us-west-2.omnitagjs.com		54.148.50.154	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897979975 CET	1.1.1.1	192.168.2.16	0xb99	No error (0)	hb-api-us-west-2.omnitagjs.com		52.35.73.235	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897979975 CET	1.1.1.1	192.168.2.16	0xb99	No error (0)	hb-api-us-west-2.omnitagjs.com		54.68.213.114	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897979975 CET	1.1.1.1	192.168.2.16	0xb99	No error (0)	hb-api-us-west-2.omnitagjs.com		44.236.142.66	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.897979975 CET	1.1.1.1	192.168.2.16	0xb99	No error (0)	hb-api-us-west-2.omnitagjs.com		52.40.169.197	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898164034 CET	1.1.1.1	192.168.2.16	0x7103	No error (0)	ad.360yield.com	ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898164034 CET	1.1.1.1	192.168.2.16	0x7103	No error (0)	ice.360yield.com	na-ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898164034 CET	1.1.1.1	192.168.2.16	0x7103	No error (0)	na-ice.360yield.com		50.19.31.61	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898164034 CET	1.1.1.1	192.168.2.16	0x7103	No error (0)	na-ice.360yield.com		44.214.222.116	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898164034 CET	1.1.1.1	192.168.2.16	0x7103	No error (0)	na-ice.360yield.com		3.208.65.29	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898164034 CET	1.1.1.1	192.168.2.16	0x7103	No error (0)	na-ice.360yield.com		23.20.176.142	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898164034 CET	1.1.1.1	192.168.2.16	0x7103	No error (0)	na-ice.360yield.com		54.211.30.152	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898164034 CET	1.1.1.1	192.168.2.16	0x7103	No error (0)	na-ice.360yield.com		52.204.206.139	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898164034 CET	1.1.1.1	192.168.2.16	0x7103	No error (0)	na-ice.360yield.com		18.206.143.86	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898164034 CET	1.1.1.1	192.168.2.16	0x7103	No error (0)	na-ice.360yield.com		54.164.168.111	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.179.164	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.161.182	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.160.184	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.160.76	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.179.87	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.160.24	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.178.10	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.179.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.179.153	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.179.166	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.160.132	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898227930 CET	1.1.1.1	192.168.2.16	0x23e2	No error (0)	ib.anycast.adnxs.com		68.67.160.26	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898260117 CET	1.1.1.1	192.168.2.16	0xc97a	No error (0)	hb-api.omnitagjs.com	hb-api-us-west-2.omnitagjs.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898348093 CET	1.1.1.1	192.168.2.16	0x3e15	No error (0)	ap.lijit.com	vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898348093 CET	1.1.1.1	192.168.2.16	0x3e15	No error (0)	vap.lijit.com	nase.vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898365021 CET	1.1.1.1	192.168.2.16	0x8cad	No error (0)	ad.360yield.com	ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.898365021 CET	1.1.1.1	192.168.2.16	0x8cad	No error (0)	ice.360yield.com	na-ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:19.902479887 CET	1.1.1.1	192.168.2.16	0x5557	No error (0)	htlb.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.902479887 CET	1.1.1.1	192.168.2.16	0x5557	No error (0)	htlb.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:19.903007030 CET	1.1.1.1	192.168.2.16	0x6b8b	No error (0)	htlb.casalemedia.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:19.905368090 CET	1.1.1.1	192.168.2.16	0x4f24	No error (0)	shb.richaudience.com		208.115.232.150	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.171978951 CET	1.1.1.1	192.168.2.16	0xc2eb	No error (0)	adservice.google.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:20.172018051 CET	1.1.1.1	192.168.2.16	0xc4b5	No error (0)	adservice.google.com		192.178.50.34	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.366264105 CET	1.1.1.1	192.168.2.16	0x8feb	No error (0)	ad.doubleclick.net		142.250.64.230	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.367104053 CET	1.1.1.1	192.168.2.16	0xa9aa	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Dec 19, 2023 10:22:20.408616066 CET	1.1.1.1	192.168.2.16	0x90ba	No error (0)	ad.doubleclick.net		172.217.15.198	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.408674002 CET	1.1.1.1	192.168.2.16	0x2370	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Dec 19, 2023 10:22:20.476747990 CET	1.1.1.1	192.168.2.16	0x84be	No error (0)	ampcid.google.com		142.250.217.238	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.690838099 CET	1.1.1.1	192.168.2.16	0xf907	No error (0)	caffeine.softonic.com.br		35.227.233.104	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.831854105 CET	1.1.1.1	192.168.2.16	0x77d6	No error (0)	ad.doubleclick.net		172.217.15.198	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.832321882 CET	1.1.1.1	192.168.2.16	0xb08b	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Dec 19, 2023 10:22:20.920763016 CET	1.1.1.1	192.168.2.16	0xfa53	No error (0)	btloader.com		104.22.74.216	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.920763016 CET	1.1.1.1	192.168.2.16	0xfa53	No error (0)	btloader.com		172.67.41.60	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.920763016 CET	1.1.1.1	192.168.2.16	0xfa53	No error (0)	btloader.com		104.22.75.216	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.920777082 CET	1.1.1.1	192.168.2.16	0x8912	No error (0)	btloader.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:20.939047098 CET	1.1.1.1	192.168.2.16	0xb814	No error (0)	lb.eu-1-id5-sync.com		162.19.138.119	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.939047098 CET	1.1.1.1	192.168.2.16	0xb814	No error (0)	lb.eu-1-id5-sync.com		162.19.138.116	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.939047098 CET	1.1.1.1	192.168.2.16	0xb814	No error (0)	lb.eu-1-id5-sync.com		162.19.138.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.939047098 CET	1.1.1.1	192.168.2.16	0xb814	No error (0)	lb.eu-1-id5-sync.com		162.19.138.117	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.939047098 CET	1.1.1.1	192.168.2.16	0xb814	No error (0)	lb.eu-1-id5-sync.com		162.19.138.82	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.939047098 CET	1.1.1.1	192.168.2.16	0xb814	No error (0)	lb.eu-1-id5-sync.com		141.95.98.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.939047098 CET	1.1.1.1	192.168.2.16	0xb814	No error (0)	lb.eu-1-id5-sync.com		141.95.33.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.939047098 CET	1.1.1.1	192.168.2.16	0xb814	No error (0)	lb.eu-1-id5-sync.com		141.95.98.65	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.939047098 CET	1.1.1.1	192.168.2.16	0xb814	No error (0)	lb.eu-1-id5-sync.com		162.19.138.83	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.939047098 CET	1.1.1.1	192.168.2.16	0xb814	No error (0)	lb.eu-1-id5-sync.com		162.19.138.118	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.965161085 CET	1.1.1.1	192.168.2.16	0xf077	No error (0)	www.google.com		142.250.217.164	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.965173006 CET	1.1.1.1	192.168.2.16	0x9b19	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:20.995821953 CET	1.1.1.1	192.168.2.16	0x90a0	No error (0)	htlb.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.995821953 CET	1.1.1.1	192.168.2.16	0x90a0	No error (0)	htlb.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:20.999907017 CET	1.1.1.1	192.168.2.16	0x4de9	No error (0)	htlb.casalemedia.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:21.448323965 CET	1.1.1.1	192.168.2.16	0x528a	No error (0)	stats.g.doubleclick.net		173.194.219.154	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:21.448323965 CET	1.1.1.1	192.168.2.16	0x528a	No error (0)	stats.g.doubleclick.net		173.194.219.156	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:21.448323965 CET	1.1.1.1	192.168.2.16	0x528a	No error (0)	stats.g.doubleclick.net		173.194.219.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:21.448323965 CET	1.1.1.1	192.168.2.16	0x528a	No error (0)	stats.g.doubleclick.net		173.194.219.157	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:21.600506067 CET	1.1.1.1	192.168.2.16	0xe0f6	No error (0)	aax.amazon-adsystem.com	aax-dtb-cf.amazon-adsystem.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:21.600506067 CET	1.1.1.1	192.168.2.16	0xe0f6	No error (0)	aax-dtb-cf.amazon-adsystem.com	aax-dtb-cf.amazon-adsystem.amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:21.600506067 CET	1.1.1.1	192.168.2.16	0xe0f6	No error (0)	aax-dtb-cf.amazon-adsystem.amazon.com	d1jvc9b8z3vcjs.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:21.600506067 CET	1.1.1.1	192.168.2.16	0xe0f6	No error (0)	d1jvc9b8z3vcjs.cloudfront.net		99.84.242.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:21.602045059 CET	1.1.1.1	192.168.2.16	0x87d3	No error (0)	aax.amazon-adsystem.com	aax-dtb-cf.amazon-adsystem.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:21.602045059 CET	1.1.1.1	192.168.2.16	0x87d3	No error (0)	aax-dtb-cf.amazon-adsystem.com	aax-dtb-cf.amazon-adsystem.amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:21.602045059 CET	1.1.1.1	192.168.2.16	0x87d3	No error (0)	aax-dtb-cf.amazon-adsystem.amazon.com	d1jvc9b8z3vcjs.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:21.907412052 CET	1.1.1.1	192.168.2.16	0x524a	No error (0)	api.btloader.com		130.211.23.194	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:22.549211979 CET	1.1.1.1	192.168.2.16	0x4629	No error (0)	s.amazon-adsystem.com		52.46.128.147	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:22.980704069 CET	1.1.1.1	192.168.2.16	0xa64d	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:22.980704069 CET	1.1.1.1	192.168.2.16	0xa64d	No error (0)	securepubads46.g.doubleclick.net		142.250.217.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:22.980761051 CET	1.1.1.1	192.168.2.16	0x4522	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.007025003 CET	1.1.1.1	192.168.2.16	0x5546	No error (0)	pagead-googlehosted.l.google.com		192.178.50.33	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.176161051 CET	1.1.1.1	192.168.2.16	0x71f0	No error (0)	ap.lijit.com	vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.176161051 CET	1.1.1.1	192.168.2.16	0x71f0	No error (0)	vap.lijit.com	nase.vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.176774025 CET	1.1.1.1	192.168.2.16	0xe34a	No error (0)	ap.lijit.com	vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.176774025 CET	1.1.1.1	192.168.2.16	0xe34a	No error (0)	vap.lijit.com	nase.vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.176774025 CET	1.1.1.1	192.168.2.16	0xe34a	No error (0)	nase.vap.lijit.com		69.175.41.44	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.176774025 CET	1.1.1.1	192.168.2.16	0xe34a	No error (0)	nase.vap.lijit.com		63.251.86.51	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.176774025 CET	1.1.1.1	192.168.2.16	0xe34a	No error (0)	nase.vap.lijit.com		63.251.86.49	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.301897049 CET	1.1.1.1	192.168.2.16	0xee37	No error (0)	id5-sync.com		141.95.33.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.301897049 CET	1.1.1.1	192.168.2.16	0xee37	No error (0)	id5-sync.com		141.95.98.65	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.301897049 CET	1.1.1.1	192.168.2.16	0xee37	No error (0)	id5-sync.com		162.19.138.116	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.301897049 CET	1.1.1.1	192.168.2.16	0xee37	No error (0)	id5-sync.com		162.19.138.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.301897049 CET	1.1.1.1	192.168.2.16	0xee37	No error (0)	id5-sync.com		162.19.138.118	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.301897049 CET	1.1.1.1	192.168.2.16	0xee37	No error (0)	id5-sync.com		162.19.138.83	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.301897049 CET	1.1.1.1	192.168.2.16	0xee37	No error (0)	id5-sync.com		162.19.138.119	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.301897049 CET	1.1.1.1	192.168.2.16	0xee37	No error (0)	id5-sync.com		141.95.98.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.301897049 CET	1.1.1.1	192.168.2.16	0xee37	No error (0)	id5-sync.com		162.19.138.117	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.301897049 CET	1.1.1.1	192.168.2.16	0xee37	No error (0)	id5-sync.com		162.19.138.82	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.344957113 CET	1.1.1.1	192.168.2.16	0xdd1a	No error (0)	adservice.google.com		142.250.217.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.344970942 CET	1.1.1.1	192.168.2.16	0x7010	No error (0)	adservice.google.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:23.345057964 CET	1.1.1.1	192.168.2.16	0x71d4	No error (0)	ampcid.google.com		192.178.50.78	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.351438046 CET	1.1.1.1	192.168.2.16	0x853f	No error (0)	lb.eu-1-id5-sync.com		162.19.138.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.351438046 CET	1.1.1.1	192.168.2.16	0x853f	No error (0)	lb.eu-1-id5-sync.com		162.19.138.118	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.351438046 CET	1.1.1.1	192.168.2.16	0x853f	No error (0)	lb.eu-1-id5-sync.com		162.19.138.117	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.351438046 CET	1.1.1.1	192.168.2.16	0x853f	No error (0)	lb.eu-1-id5-sync.com		141.95.33.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.351438046 CET	1.1.1.1	192.168.2.16	0x853f	No error (0)	lb.eu-1-id5-sync.com		141.95.98.65	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.351438046 CET	1.1.1.1	192.168.2.16	0x853f	No error (0)	lb.eu-1-id5-sync.com		162.19.138.116	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.351438046 CET	1.1.1.1	192.168.2.16	0x853f	No error (0)	lb.eu-1-id5-sync.com		162.19.138.83	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.351438046 CET	1.1.1.1	192.168.2.16	0x853f	No error (0)	lb.eu-1-id5-sync.com		162.19.138.82	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.351438046 CET	1.1.1.1	192.168.2.16	0x853f	No error (0)	lb.eu-1-id5-sync.com		162.19.138.119	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.351438046 CET	1.1.1.1	192.168.2.16	0x853f	No error (0)	lb.eu-1-id5-sync.com		141.95.98.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.423727036 CET	1.1.1.1	192.168.2.16	0xac75	No error (0)	c.amazon-adsystem.com	d1ykf07e75w7ss.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.424057961 CET	1.1.1.1	192.168.2.16	0x1961	No error (0)	c.amazon-adsystem.com	d1ykf07e75w7ss.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.424057961 CET	1.1.1.1	192.168.2.16	0x1961	No error (0)	d1ykf07e75w7ss.cloudfront.net		65.8.27.208	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.427254915 CET	1.1.1.1	192.168.2.16	0xa973	No error (0)	stats.g.doubleclick.net		172.253.124.156	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.427254915 CET	1.1.1.1	192.168.2.16	0xa973	No error (0)	stats.g.doubleclick.net		172.253.124.157	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.427254915 CET	1.1.1.1	192.168.2.16	0xa973	No error (0)	stats.g.doubleclick.net		172.253.124.154	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.427254915 CET	1.1.1.1	192.168.2.16	0xa973	No error (0)	stats.g.doubleclick.net		172.253.124.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.427898884 CET	1.1.1.1	192.168.2.16	0x3d19	No error (0)	aax.amazon-adsystem.com	aax-dtb-cf.amazon-adsystem.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.427898884 CET	1.1.1.1	192.168.2.16	0x3d19	No error (0)	aax-dtb-cf.amazon-adsystem.com	aax-dtb-cf.amazon-adsystem.amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.427898884 CET	1.1.1.1	192.168.2.16	0x3d19	No error (0)	aax-dtb-cf.amazon-adsystem.amazon.com	d1jvc9b8z3vcjs.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.427898884 CET	1.1.1.1	192.168.2.16	0x3d19	No error (0)	d1jvc9b8z3vcjs.cloudfront.net		99.84.242.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.427975893 CET	1.1.1.1	192.168.2.16	0x7ab5	No error (0)	aax.amazon-adsystem.com	aax-dtb-cf.amazon-adsystem.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.427975893 CET	1.1.1.1	192.168.2.16	0x7ab5	No error (0)	aax-dtb-cf.amazon-adsystem.com	aax-dtb-cf.amazon-adsystem.amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.427975893 CET	1.1.1.1	192.168.2.16	0x7ab5	No error (0)	aax-dtb-cf.amazon-adsystem.amazon.com	d1jvc9b8z3vcjs.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.954606056 CET	1.1.1.1	192.168.2.16	0x14c1	No error (0)	ap.lijit.com	vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.954606056 CET	1.1.1.1	192.168.2.16	0x14c1	No error (0)	vap.lijit.com	nase.vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.954606056 CET	1.1.1.1	192.168.2.16	0x14c1	No error (0)	nase.vap.lijit.com		63.251.86.49	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.954606056 CET	1.1.1.1	192.168.2.16	0x14c1	No error (0)	nase.vap.lijit.com		63.251.86.51	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.954606056 CET	1.1.1.1	192.168.2.16	0x14c1	No error (0)	nase.vap.lijit.com		69.175.41.2	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.955131054 CET	1.1.1.1	192.168.2.16	0xc32f	No error (0)	ap.lijit.com	vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.955131054 CET	1.1.1.1	192.168.2.16	0xc32f	No error (0)	vap.lijit.com	nase.vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.955504894 CET	1.1.1.1	192.168.2.16	0xb050	No error (0)	visitor.omnitagjs.com	visitor-us-west-2.omnitagjs.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:23.955504894 CET	1.1.1.1	192.168.2.16	0xb050	No error (0)	visitor-us-west-2.omnitagjs.com		35.163.115.57	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.955504894 CET	1.1.1.1	192.168.2.16	0xb050	No error (0)	visitor-us-west-2.omnitagjs.com		54.200.95.152	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.955504894 CET	1.1.1.1	192.168.2.16	0xb050	No error (0)	visitor-us-west-2.omnitagjs.com		35.160.171.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.955504894 CET	1.1.1.1	192.168.2.16	0xb050	No error (0)	visitor-us-west-2.omnitagjs.com		52.89.73.205	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.955504894 CET	1.1.1.1	192.168.2.16	0xb050	No error (0)	visitor-us-west-2.omnitagjs.com		44.240.16.56	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.955504894 CET	1.1.1.1	192.168.2.16	0xb050	No error (0)	visitor-us-west-2.omnitagjs.com		44.231.162.210	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.955504894 CET	1.1.1.1	192.168.2.16	0xb050	No error (0)	visitor-us-west-2.omnitagjs.com		35.161.37.58	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.955504894 CET	1.1.1.1	192.168.2.16	0xb050	No error (0)	visitor-us-west-2.omnitagjs.com		34.208.38.108	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:23.956262112 CET	1.1.1.1	192.168.2.16	0x1a4a	No error (0)	visitor.omnitagjs.com	visitor-us-west-2.omnitagjs.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:24.043493032 CET	1.1.1.1	192.168.2.16	0xf3b0	No error (0)	acdn.adnxs.com	prod.appnexus.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:24.043493032 CET	1.1.1.1	192.168.2.16	0xf3b0	No error (0)	prod.appnexus.map.fastly.net		151.101.193.108	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:24.043493032 CET	1.1.1.1	192.168.2.16	0xf3b0	No error (0)	prod.appnexus.map.fastly.net		151.101.65.108	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:24.043493032 CET	1.1.1.1	192.168.2.16	0xf3b0	No error (0)	prod.appnexus.map.fastly.net		151.101.129.108	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:24.043493032 CET	1.1.1.1	192.168.2.16	0xf3b0	No error (0)	prod.appnexus.map.fastly.net		151.101.1.108	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:24.044164896 CET	1.1.1.1	192.168.2.16	0x5338	No error (0)	js-sec.indexww.com		104.18.38.76	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:24.044164896 CET	1.1.1.1	192.168.2.16	0x5338	No error (0)	js-sec.indexww.com		172.64.149.180	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:24.044318914 CET	1.1.1.1	192.168.2.16	0xcb94	No error (0)	js-sec.indexww.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:24.045466900 CET	1.1.1.1	192.168.2.16	0x38d0	No error (0)	ads.pubmatic.com	pubmatic.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:24.045917988 CET	1.1.1.1	192.168.2.16	0xcf34	No error (0)	ads.pubmatic.com	pubmatic.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:24.047435045 CET	1.1.1.1	192.168.2.16	0x2f3d	No error (0)	sync.richaudience.com		162.55.236.225	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.005707026 CET	1.1.1.1	192.168.2.16	0xf476	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Dec 19, 2023 10:22:25.006016970 CET	1.1.1.1	192.168.2.16	0x5eb	No error (0)	googleads.g.doubleclick.net		142.250.189.130	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.024625063 CET	1.1.1.1	192.168.2.16	0xd27e	No error (0)	www.googletagservices.com		142.250.217.194	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.344235897 CET	1.1.1.1	192.168.2.16	0x4083	No error (0)	www.googletagservices.com		142.250.217.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	secure.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.181.211	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.161.182	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.160.132	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.160.76	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.178.10	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.161.208	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.179.153	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.160.137	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.160.184	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.179.87	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.160.75	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.654789925 CET	1.1.1.1	192.168.2.16	0x50f4	No error (0)	ib.anycast.adnxs.com		68.67.179.166	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.685760975 CET	1.1.1.1	192.168.2.16	0x89c2	No error (0)	dis.criteo.com	widget.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:25.685760975 CET	1.1.1.1	192.168.2.16	0x89c2	No error (0)	widget.va1.vip.prod.criteo.com		74.119.119.150	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.686852932 CET	1.1.1.1	192.168.2.16	0xeab2	No error (0)	dis.criteo.com	widget.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:25.693394899 CET	1.1.1.1	192.168.2.16	0x76f4	No error (0)	x.bidswitch.net	user-data-us-east.bidswitch.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:25.693394899 CET	1.1.1.1	192.168.2.16	0x76f4	No error (0)	user-data-us-east.bidswitch.net		35.211.178.172	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.694179058 CET	1.1.1.1	192.168.2.16	0x514	No error (0)	x.bidswitch.net	user-data-us-east.bidswitch.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:25.695902109 CET	1.1.1.1	192.168.2.16	0xc5a1	No error (0)	api-2-0.spot.im		65.8.178.13	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.695902109 CET	1.1.1.1	192.168.2.16	0xc5a1	No error (0)	api-2-0.spot.im		65.8.178.18	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.695902109 CET	1.1.1.1	192.168.2.16	0xc5a1	No error (0)	api-2-0.spot.im		65.8.178.100	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.695902109 CET	1.1.1.1	192.168.2.16	0xc5a1	No error (0)	api-2-0.spot.im		65.8.178.15	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.697236061 CET	1.1.1.1	192.168.2.16	0x6f58	No error (0)	creativecdn.com		185.184.8.90	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705034018 CET	1.1.1.1	192.168.2.16	0x1a9e	No error (0)	match.prod.bidr.io		52.7.115.91	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705034018 CET	1.1.1.1	192.168.2.16	0x1a9e	No error (0)	match.prod.bidr.io		54.157.75.191	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705034018 CET	1.1.1.1	192.168.2.16	0x1a9e	No error (0)	match.prod.bidr.io		54.144.201.168	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705034018 CET	1.1.1.1	192.168.2.16	0x1a9e	No error (0)	match.prod.bidr.io		52.73.106.251	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705034018 CET	1.1.1.1	192.168.2.16	0x1a9e	No error (0)	match.prod.bidr.io		54.152.0.153	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705034018 CET	1.1.1.1	192.168.2.16	0x1a9e	No error (0)	match.prod.bidr.io		52.54.197.187	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705034018 CET	1.1.1.1	192.168.2.16	0x1a9e	No error (0)	match.prod.bidr.io		52.87.120.123	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705034018 CET	1.1.1.1	192.168.2.16	0x1a9e	No error (0)	match.prod.bidr.io		54.145.124.5	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705722094 CET	1.1.1.1	192.168.2.16	0xd0fe	No error (0)	match.adsrvr.org		15.197.193.217	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705722094 CET	1.1.1.1	192.168.2.16	0xd0fe	No error (0)	match.adsrvr.org		3.33.220.150	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705722094 CET	1.1.1.1	192.168.2.16	0xd0fe	No error (0)	match.adsrvr.org		35.71.131.137	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.705722094 CET	1.1.1.1	192.168.2.16	0xd0fe	No error (0)	match.adsrvr.org		52.223.40.198	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.710496902 CET	1.1.1.1	192.168.2.16	0x8e3b	No error (0)	image6.pubmatic.com	image6v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:25.710496902 CET	1.1.1.1	192.168.2.16	0x8e3b	No error (0)	image6v2.pubmnet.com	pugm-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:25.710496902 CET	1.1.1.1	192.168.2.16	0x8e3b	No error (0)	pugm-vac.pubmnet.com		8.28.7.81	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:25.711139917 CET	1.1.1.1	192.168.2.16	0x7442	No error (0)	image6.pubmatic.com	image6v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:25.711139917 CET	1.1.1.1	192.168.2.16	0x7442	No error (0)	image6v2.pubmnet.com	pugm-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.161.208	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.179.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.160.114	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.179.87	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.179.153	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.160.75	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.179.166	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.160.186	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.160.26	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.160.117	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.179.164	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.155399084 CET	1.1.1.1	192.168.2.16	0xb071	No error (0)	ib.anycast.adnxs.com		68.67.181.211	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.874130964 CET	1.1.1.1	192.168.2.16	0x51e	No error (0)	secure-assets.rubiconproject.com	digicertwc.rubiconproject.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.874228001 CET	1.1.1.1	192.168.2.16	0xb3bc	No error (0)	s.spotim.market	vast.unoadsrv.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.874228001 CET	1.1.1.1	192.168.2.16	0xb3bc	No error (0)	vast.unoadsrv.com	s-unoadsrv-com.geodns.me		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.874866962 CET	1.1.1.1	192.168.2.16	0xd243	No error (0)	secure-assets.rubiconproject.com	digicertwc.rubiconproject.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.881386995 CET	1.1.1.1	192.168.2.16	0x517a	No error (0)	ssc-cms.33across.com	pixel.33across.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.881386995 CET	1.1.1.1	192.168.2.16	0x517a	No error (0)	pixel.33across.com		67.202.105.21	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.881386995 CET	1.1.1.1	192.168.2.16	0x517a	No error (0)	pixel.33across.com		67.202.105.23	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.881603956 CET	1.1.1.1	192.168.2.16	0x7406	No error (0)	onetag-sys.com		51.222.239.230	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.881603956 CET	1.1.1.1	192.168.2.16	0x7406	No error (0)	onetag-sys.com		51.222.39.186	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.881603956 CET	1.1.1.1	192.168.2.16	0x7406	No error (0)	onetag-sys.com		51.222.39.184	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.881603956 CET	1.1.1.1	192.168.2.16	0x7406	No error (0)	onetag-sys.com		51.222.239.232	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.881603956 CET	1.1.1.1	192.168.2.16	0x7406	No error (0)	onetag-sys.com		51.222.39.187	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.881603956 CET	1.1.1.1	192.168.2.16	0x7406	No error (0)	onetag-sys.com		51.222.39.185	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.881675005 CET	1.1.1.1	192.168.2.16	0x6ec4	No error (0)	ssc-cms.33across.com	pixel.33across.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync.smartadserver.com	ssbsync-geo.smartadserver.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync-geo.smartadserver.com	usersync-geo-global.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync-usw1.smartadserver.com		23.83.76.38	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync-usw1.smartadserver.com		23.83.76.68	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync-usw1.smartadserver.com		23.83.76.85	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync-usw1.smartadserver.com		23.83.76.52	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync-usw1.smartadserver.com		23.83.76.84	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync-usw1.smartadserver.com		23.83.76.53	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync-usw1.smartadserver.com		23.83.76.69	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync-usw1.smartadserver.com		23.83.76.100	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync-usw1.smartadserver.com		23.83.76.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887406111 CET	1.1.1.1	192.168.2.16	0xe15d	No error (0)	ssbsync-usw1.smartadserver.com		23.83.76.39	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887427092 CET	1.1.1.1	192.168.2.16	0xe941	No error (0)	ssbsync.smartadserver.com	ssbsync-geo.smartadserver.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887427092 CET	1.1.1.1	192.168.2.16	0xe941	No error (0)	ssbsync-geo.smartadserver.com	usersync-geo-global.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887465954 CET	1.1.1.1	192.168.2.16	0xd199	No error (0)	sync.1rx.io		69.194.240.13	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887476921 CET	1.1.1.1	192.168.2.16	0x93fb	No error (0)	rtb.gumgum.com		3.94.183.232	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887476921 CET	1.1.1.1	192.168.2.16	0x93fb	No error (0)	rtb.gumgum.com		44.194.152.208	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887476921 CET	1.1.1.1	192.168.2.16	0x93fb	No error (0)	rtb.gumgum.com		34.231.114.219	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887476921 CET	1.1.1.1	192.168.2.16	0x93fb	No error (0)	rtb.gumgum.com		50.17.48.108	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887476921 CET	1.1.1.1	192.168.2.16	0x93fb	No error (0)	rtb.gumgum.com		44.197.19.224	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887476921 CET	1.1.1.1	192.168.2.16	0x93fb	No error (0)	rtb.gumgum.com		54.221.226.34	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887476921 CET	1.1.1.1	192.168.2.16	0x93fb	No error (0)	rtb.gumgum.com		3.219.246.189	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887476921 CET	1.1.1.1	192.168.2.16	0x93fb	No error (0)	rtb.gumgum.com		34.193.134.86	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887763023 CET	1.1.1.1	192.168.2.16	0xb9b3	No error (0)	ssum-sec.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887763023 CET	1.1.1.1	192.168.2.16	0xb9b3	No error (0)	ssum-sec.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.887877941 CET	1.1.1.1	192.168.2.16	0xb24e	No error (0)	ssum-sec.casalemedia.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:26.888262987 CET	1.1.1.1	192.168.2.16	0x5148	No error (0)	eus.rubiconproject.com	eus.rubiconproject.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.889018059 CET	1.1.1.1	192.168.2.16	0x75ff	No error (0)	eus.rubiconproject.com	eus.rubiconproject.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.889409065 CET	1.1.1.1	192.168.2.16	0x6765	No error (0)	u.openx.net		35.244.159.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.889409065 CET	1.1.1.1	192.168.2.16	0x6765	No error (0)	u.openx.net		34.98.64.218	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890647888 CET	1.1.1.1	192.168.2.16	0xc9d5	No error (0)	ssbsync-us.smartadserver.com	ssbsync-use1.smartadserver.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-us.smartadserver.com	ssbsync-use1.smartadserver.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.4	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.159	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.37	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.170	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		23.105.14.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.53	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.143	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.36	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		23.105.14.100	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.158	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.142	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.5	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.52	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.890711069 CET	1.1.1.1	192.168.2.16	0xf9ce	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.171	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.940474987 CET	1.1.1.1	192.168.2.16	0x52c6	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.940474987 CET	1.1.1.1	192.168.2.16	0x52c6	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.940474987 CET	1.1.1.1	192.168.2.16	0x52c6	No error (0)	us-east-eb2.3lift.com		52.223.22.214	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.940474987 CET	1.1.1.1	192.168.2.16	0x52c6	No error (0)	us-east-eb2.3lift.com		35.71.139.29	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:26.940628052 CET	1.1.1.1	192.168.2.16	0xd52b	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:26.940628052 CET	1.1.1.1	192.168.2.16	0xd52b	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:27.054214001 CET	1.1.1.1	192.168.2.16	0x8790	No error (0)	ce.lijit.com	ce-ue1.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:27.054214001 CET	1.1.1.1	192.168.2.16	0x8790	No error (0)	ce-ue1.lijit.com	vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:27.054214001 CET	1.1.1.1	192.168.2.16	0x8790	No error (0)	vap.lijit.com	nase.vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:27.054214001 CET	1.1.1.1	192.168.2.16	0x8790	No error (0)	nase.vap.lijit.com		69.175.41.15	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.054214001 CET	1.1.1.1	192.168.2.16	0x8790	No error (0)	nase.vap.lijit.com		63.251.86.49	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.054214001 CET	1.1.1.1	192.168.2.16	0x8790	No error (0)	nase.vap.lijit.com		63.251.86.51	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.061660051 CET	1.1.1.1	192.168.2.16	0x29fd	No error (0)	ce.lijit.com	ce-ue1.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:27.061660051 CET	1.1.1.1	192.168.2.16	0x29fd	No error (0)	ce-ue1.lijit.com	vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:27.061660051 CET	1.1.1.1	192.168.2.16	0x29fd	No error (0)	vap.lijit.com	nase.vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:27.222918034 CET	1.1.1.1	192.168.2.16	0x1f2e	No error (0)	ad.360yield.com	ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:27.222918034 CET	1.1.1.1	192.168.2.16	0x1f2e	No error (0)	ice.360yield.com	na-ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:27.222918034 CET	1.1.1.1	192.168.2.16	0x1f2e	No error (0)	na-ice.360yield.com		52.72.45.103	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.222918034 CET	1.1.1.1	192.168.2.16	0x1f2e	No error (0)	na-ice.360yield.com		3.216.224.228	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.222918034 CET	1.1.1.1	192.168.2.16	0x1f2e	No error (0)	na-ice.360yield.com		34.204.145.238	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.222918034 CET	1.1.1.1	192.168.2.16	0x1f2e	No error (0)	na-ice.360yield.com		44.221.184.26	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.222918034 CET	1.1.1.1	192.168.2.16	0x1f2e	No error (0)	na-ice.360yield.com		34.231.218.104	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.222918034 CET	1.1.1.1	192.168.2.16	0x1f2e	No error (0)	na-ice.360yield.com		34.232.60.164	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.222918034 CET	1.1.1.1	192.168.2.16	0x1f2e	No error (0)	na-ice.360yield.com		100.26.6.110	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.222918034 CET	1.1.1.1	192.168.2.16	0x1f2e	No error (0)	na-ice.360yield.com		54.81.164.109	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.223795891 CET	1.1.1.1	192.168.2.16	0xec35	Name error (3)	ad.360yield.com	none	none	65	IN (0x0001)	false
Dec 19, 2023 10:22:27.561041117 CET	1.1.1.1	192.168.2.16	0x85da	No error (0)	csync.smilewanted.com		104.22.68.131	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.561041117 CET	1.1.1.1	192.168.2.16	0x85da	No error (0)	csync.smilewanted.com		104.22.69.131	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.561041117 CET	1.1.1.1	192.168.2.16	0x85da	No error (0)	csync.smilewanted.com		172.67.10.198	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.562515974 CET	1.1.1.1	192.168.2.16	0xb7a7	No error (0)	csync.smilewanted.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:27.851985931 CET	1.1.1.1	192.168.2.16	0x38dc	No error (0)	de.tynt.com		67.202.105.33	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:27.851985931 CET	1.1.1.1	192.168.2.16	0x38dc	No error (0)	de.tynt.com		67.202.105.32	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.015686035 CET	1.1.1.1	192.168.2.16	0xa18e	No error (0)	um.simpli.fi		35.236.220.17	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.015686035 CET	1.1.1.1	192.168.2.16	0xa18e	No error (0)	um.simpli.fi		35.194.66.159	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.015686035 CET	1.1.1.1	192.168.2.16	0xa18e	No error (0)	um.simpli.fi		34.150.170.96	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.017317057 CET	1.1.1.1	192.168.2.16	0xe63a	No error (0)	pixel-eu.rubiconproject.com	pixel-eu.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.018583059 CET	1.1.1.1	192.168.2.16	0xf5cd	No error (0)	pixel-eu.rubiconproject.com	pixel-eu.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.018904924 CET	1.1.1.1	192.168.2.16	0xc054	No error (0)	pixel-us-east.rubiconproject.com	pixel-us-east.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.019463062 CET	1.1.1.1	192.168.2.16	0xae2a	No error (0)	data.adsrvr.org	match.adsrvr.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.019463062 CET	1.1.1.1	192.168.2.16	0xae2a	No error (0)	match.adsrvr.org		35.71.131.137	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.019463062 CET	1.1.1.1	192.168.2.16	0xae2a	No error (0)	match.adsrvr.org		15.197.193.217	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.019463062 CET	1.1.1.1	192.168.2.16	0xae2a	No error (0)	match.adsrvr.org		3.33.220.150	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.019463062 CET	1.1.1.1	192.168.2.16	0xae2a	No error (0)	match.adsrvr.org		52.223.40.198	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.020267010 CET	1.1.1.1	192.168.2.16	0x8a39	No error (0)	data.adsrvr.org	match.adsrvr.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.020674944 CET	1.1.1.1	192.168.2.16	0xeda2	No error (0)	pixel-us-east.rubiconproject.com	pixel-us-east.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.031476974 CET	1.1.1.1	192.168.2.16	0x3112	No error (0)	us-u.openx.net		35.244.159.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.031476974 CET	1.1.1.1	192.168.2.16	0x3112	No error (0)	us-u.openx.net		34.98.64.218	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094331026 CET	1.1.1.1	192.168.2.16	0x2b35	No error (0)	csync.loopme.me	envoy-hl.envoy-csync1.core-b8mf.ov1o.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094331026 CET	1.1.1.1	192.168.2.16	0x2b35	No error (0)	envoy-hl.envoy-csync1.core-b8mf.ov1o.com		35.214.128.77	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094331026 CET	1.1.1.1	192.168.2.16	0x2b35	No error (0)	envoy-hl.envoy-csync1.core-b8mf.ov1o.com		35.214.243.245	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094331026 CET	1.1.1.1	192.168.2.16	0x2b35	No error (0)	envoy-hl.envoy-csync1.core-b8mf.ov1o.com		35.214.187.199	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094331026 CET	1.1.1.1	192.168.2.16	0x2b35	No error (0)	envoy-hl.envoy-csync1.core-b8mf.ov1o.com		35.214.242.163	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094331026 CET	1.1.1.1	192.168.2.16	0x2b35	No error (0)	envoy-hl.envoy-csync1.core-b8mf.ov1o.com		35.214.241.154	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094331026 CET	1.1.1.1	192.168.2.16	0x2b35	No error (0)	envoy-hl.envoy-csync1.core-b8mf.ov1o.com		35.214.218.94	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094516039 CET	1.1.1.1	192.168.2.16	0x7f49	No error (0)	csync.loopme.me	envoy-hl.envoy-csync1.core-b8mf.ov1o.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync.smartadserver.com	rtb-csync-geo.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		23.105.14.106	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.56	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.150	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		23.105.14.105	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.136	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.40	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.151	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.9	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.57	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.173	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.41	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.172	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.094988108 CET	1.1.1.1	192.168.2.16	0x4032	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.137	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.095011950 CET	1.1.1.1	192.168.2.16	0xa5ec	No error (0)	rtb-csync.smartadserver.com	rtb-csync-geo.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.160610914 CET	1.1.1.1	192.168.2.16	0xb95	No error (0)	cm.g.doubleclick.net		142.250.217.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.162018061 CET	1.1.1.1	192.168.2.16	0xdac4	No error (0)	pixel.tapad.com		34.111.113.62	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.164186954 CET	1.1.1.1	192.168.2.16	0x57ae	No error (0)	us01.z.antigena.com		40.76.134.238	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.344125986 CET	1.1.1.1	192.168.2.16	0x560c	No error (0)	simage2.pubmatic.com	simage2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.344125986 CET	1.1.1.1	192.168.2.16	0x560c	No error (0)	simage2v2.pubmnet.com	pug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.344125986 CET	1.1.1.1	192.168.2.16	0x560c	No error (0)	pug-vac.pubmnet.com		8.28.7.83	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.344408035 CET	1.1.1.1	192.168.2.16	0x90dc	No error (0)	simage2.pubmatic.com	simage2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.344408035 CET	1.1.1.1	192.168.2.16	0x90dc	No error (0)	simage2v2.pubmnet.com	pug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.524770975 CET	1.1.1.1	192.168.2.16	0xf2af	No error (0)	pr-bh.ybp.yahoo.com	ds-pr-bh.ybp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.524770975 CET	1.1.1.1	192.168.2.16	0xf2af	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		44.207.23.148	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.524770975 CET	1.1.1.1	192.168.2.16	0xf2af	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		34.233.75.175	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.524770975 CET	1.1.1.1	192.168.2.16	0xf2af	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		52.207.153.119	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.524770975 CET	1.1.1.1	192.168.2.16	0xf2af	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		52.45.36.109	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.524894953 CET	1.1.1.1	192.168.2.16	0x555c	No error (0)	pr-bh.ybp.yahoo.com	ds-pr-bh.ybp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.610008001 CET	1.1.1.1	192.168.2.16	0xf147	No error (0)	i.liadm.com	idaas-ext.cph.liveintent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.610008001 CET	1.1.1.1	192.168.2.16	0xf147	No error (0)	idaas-ext.cph.liveintent.com		54.82.32.1	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.610008001 CET	1.1.1.1	192.168.2.16	0xf147	No error (0)	idaas-ext.cph.liveintent.com		34.196.92.141	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.610008001 CET	1.1.1.1	192.168.2.16	0xf147	No error (0)	idaas-ext.cph.liveintent.com		54.235.170.236	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.610008001 CET	1.1.1.1	192.168.2.16	0xf147	No error (0)	idaas-ext.cph.liveintent.com		54.166.141.119	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.610008001 CET	1.1.1.1	192.168.2.16	0xf147	No error (0)	idaas-ext.cph.liveintent.com		35.169.223.36	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.610008001 CET	1.1.1.1	192.168.2.16	0xf147	No error (0)	idaas-ext.cph.liveintent.com		3.212.146.122	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.610008001 CET	1.1.1.1	192.168.2.16	0xf147	No error (0)	idaas-ext.cph.liveintent.com		34.232.121.20	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.610008001 CET	1.1.1.1	192.168.2.16	0xf147	No error (0)	idaas-ext.cph.liveintent.com		3.223.88.167	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.611037016 CET	1.1.1.1	192.168.2.16	0x9e28	No error (0)	i.liadm.com	idaas-ext.cph.liveintent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.615988016 CET	1.1.1.1	192.168.2.16	0x4c55	No error (0)	pixel-sync.sitescout.com	pixel-a.sitescout.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.616055012 CET	1.1.1.1	192.168.2.16	0xf2bc	No error (0)	pixel-sync.sitescout.com	pixel-a.sitescout.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.616055012 CET	1.1.1.1	192.168.2.16	0xf2bc	No error (0)	pixel-a.sitescout.com		207.198.113.203	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.616420031 CET	1.1.1.1	192.168.2.16	0x7187	No error (0)	a.tribalfusion.com		104.18.25.173	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.616420031 CET	1.1.1.1	192.168.2.16	0x7187	No error (0)	a.tribalfusion.com		104.18.24.173	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.617531061 CET	1.1.1.1	192.168.2.16	0x5862	No error (0)	a.tribalfusion.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:28.618376017 CET	1.1.1.1	192.168.2.16	0x74ef	No error (0)	dmp.brand-display.com		34.160.19.107	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.646950960 CET	1.1.1.1	192.168.2.16	0x19	No error (0)	hde.tynt.com		67.202.105.32	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.646950960 CET	1.1.1.1	192.168.2.16	0x19	No error (0)	hde.tynt.com		67.202.105.31	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.923145056 CET	1.1.1.1	192.168.2.16	0xd958	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Dec 19, 2023 10:22:28.923157930 CET	1.1.1.1	192.168.2.16	0x8df3	No error (0)	googleads.g.doubleclick.net		192.178.50.66	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:28.953566074 CET	1.1.1.1	192.168.2.16	0xd9c3	No error (0)	dis.criteo.com	widget.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.953866959 CET	1.1.1.1	192.168.2.16	0x7e81	No error (0)	dis.criteo.com	widget.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:28.953866959 CET	1.1.1.1	192.168.2.16	0x7e81	No error (0)	widget.va1.vip.prod.criteo.com		74.119.119.150	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.040983915 CET	1.1.1.1	192.168.2.16	0xd5dd	No error (0)	dsum-sec.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.040983915 CET	1.1.1.1	192.168.2.16	0xd5dd	No error (0)	dsum-sec.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.041810989 CET	1.1.1.1	192.168.2.16	0x44df	No error (0)	dsum-sec.casalemedia.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:29.115040064 CET	1.1.1.1	192.168.2.16	0x9241	No error (0)	s.company-target.com	s.dsp-prod.demandbase.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.115040064 CET	1.1.1.1	192.168.2.16	0x9241	No error (0)	s.dsp-prod.demandbase.com		34.96.71.22	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.120064974 CET	1.1.1.1	192.168.2.16	0x204c	No error (0)	s.company-target.com	s.dsp-prod.demandbase.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.237093925 CET	1.1.1.1	192.168.2.16	0x9292	No error (0)	visitor-us-west-2.omnitagjs.com		52.89.73.205	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.237093925 CET	1.1.1.1	192.168.2.16	0x9292	No error (0)	visitor-us-west-2.omnitagjs.com		35.161.37.58	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.237093925 CET	1.1.1.1	192.168.2.16	0x9292	No error (0)	visitor-us-west-2.omnitagjs.com		54.68.213.114	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.237093925 CET	1.1.1.1	192.168.2.16	0x9292	No error (0)	visitor-us-west-2.omnitagjs.com		54.200.95.152	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.237093925 CET	1.1.1.1	192.168.2.16	0x9292	No error (0)	visitor-us-west-2.omnitagjs.com		54.148.50.154	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.237093925 CET	1.1.1.1	192.168.2.16	0x9292	No error (0)	visitor-us-west-2.omnitagjs.com		35.163.115.57	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.237093925 CET	1.1.1.1	192.168.2.16	0x9292	No error (0)	visitor-us-west-2.omnitagjs.com		44.236.142.66	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.237093925 CET	1.1.1.1	192.168.2.16	0x9292	No error (0)	visitor-us-west-2.omnitagjs.com		44.240.16.56	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.366380930 CET	1.1.1.1	192.168.2.16	0xa36e	No error (0)	ups.analytics.yahoo.com	prod.ups-ats.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.366380930 CET	1.1.1.1	192.168.2.16	0xa36e	No error (0)	prod.ups-ats.aolp-ds-prd.aws.oath.cloud	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.366380930 CET	1.1.1.1	192.168.2.16	0xa36e	No error (0)	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.366380930 CET	1.1.1.1	192.168.2.16	0xa36e	No error (0)	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		34.200.65.202	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.366380930 CET	1.1.1.1	192.168.2.16	0xa36e	No error (0)	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		3.225.218.10	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.366566896 CET	1.1.1.1	192.168.2.16	0x4c6f	No error (0)	ups.analytics.yahoo.com	prod.ups-ats.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.366566896 CET	1.1.1.1	192.168.2.16	0x4c6f	No error (0)	prod.ups-ats.aolp-ds-prd.aws.oath.cloud	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.366566896 CET	1.1.1.1	192.168.2.16	0x4c6f	No error (0)	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.426769972 CET	1.1.1.1	192.168.2.16	0x56c4	No error (0)	sync.mathtag.com	pixel-origin.mathtag.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.426769972 CET	1.1.1.1	192.168.2.16	0x56c4	No error (0)	pixel-origin.mathtag.com		74.121.140.211	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.426769972 CET	1.1.1.1	192.168.2.16	0x56c4	No error (0)	pixel-origin.mathtag.com		216.200.232.249	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.426769972 CET	1.1.1.1	192.168.2.16	0x56c4	No error (0)	pixel-origin.mathtag.com		216.200.232.253	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.427988052 CET	1.1.1.1	192.168.2.16	0x3b28	No error (0)	sync.mathtag.com	pixel-origin.mathtag.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.434629917 CET	1.1.1.1	192.168.2.16	0x6baa	No error (0)	ads.stickyadstv.com	ip1.ads.stickyadstv.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.435297012 CET	1.1.1.1	192.168.2.16	0x6120	No error (0)	ads.stickyadstv.com	ip1.ads.stickyadstv.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.437015057 CET	1.1.1.1	192.168.2.16	0xc2e8	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.440393925 CET	1.1.1.1	192.168.2.16	0x980a	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.440812111 CET	1.1.1.1	192.168.2.16	0x80b5	No error (0)	cs.admanmedia.com		80.77.87.166	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.451546907 CET	1.1.1.1	192.168.2.16	0x550c	No error (0)	t.adx.opera.com	outspot2-ams.adx.opera.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.451546907 CET	1.1.1.1	192.168.2.16	0x550c	No error (0)	outspot2-ams.adx.opera.com		82.145.213.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.452099085 CET	1.1.1.1	192.168.2.16	0x98a1	No error (0)	t.adx.opera.com	outspot2-ams.adx.opera.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.504648924 CET	1.1.1.1	192.168.2.16	0x8e0d	No error (0)	pubmatic-match.dotomi.com	bfp.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.525592089 CET	1.1.1.1	192.168.2.16	0x8957	No error (0)	pubmatic-match.dotomi.com	bfp.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.576998949 CET	1.1.1.1	192.168.2.16	0x1c6d	No error (0)	image2.pubmatic.com	image2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.576998949 CET	1.1.1.1	192.168.2.16	0x1c6d	No error (0)	image2v2.pubmnet.com	pug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.576998949 CET	1.1.1.1	192.168.2.16	0x1c6d	No error (0)	pug-vac.pubmnet.com		8.28.7.83	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.577698946 CET	1.1.1.1	192.168.2.16	0x177b	No error (0)	image2.pubmatic.com	image2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.577698946 CET	1.1.1.1	192.168.2.16	0x177b	No error (0)	image2v2.pubmnet.com	pug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.717367887 CET	1.1.1.1	192.168.2.16	0x6cab	No error (0)	s.tribalfusion.com		104.18.25.173	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.717367887 CET	1.1.1.1	192.168.2.16	0x6cab	No error (0)	s.tribalfusion.com		104.18.24.173	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.717864037 CET	1.1.1.1	192.168.2.16	0xb2f5	No error (0)	s.tribalfusion.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:29.827531099 CET	1.1.1.1	192.168.2.16	0xe63c	No error (0)	dsum.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.827531099 CET	1.1.1.1	192.168.2.16	0xe63c	No error (0)	dsum.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:29.828095913 CET	1.1.1.1	192.168.2.16	0x35a	No error (0)	dsum.casalemedia.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:29.981601000 CET	1.1.1.1	192.168.2.16	0x4e72	No error (0)	sync-tm.everesttech.net	sync.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.981601000 CET	1.1.1.1	192.168.2.16	0x4e72	No error (0)	sync.tubemogul.com	syncf.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.981601000 CET	1.1.1.1	192.168.2.16	0x4e72	No error (0)	syncf.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.982275963 CET	1.1.1.1	192.168.2.16	0xe524	No error (0)	sync-tm.everesttech.net	sync.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.982275963 CET	1.1.1.1	192.168.2.16	0xe524	No error (0)	sync.tubemogul.com	syncf.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:29.982275963 CET	1.1.1.1	192.168.2.16	0xe524	No error (0)	syncf.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.025183916 CET	1.1.1.1	192.168.2.16	0x859f	No error (0)	aax-eu.amazon-adsystem.com		54.239.38.253	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.102210999 CET	1.1.1.1	192.168.2.16	0xdda9	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.268277884 CET	1.1.1.1	192.168.2.16	0x872	No error (0)	bh.contextweb.com	lga-bh.contextweb.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.268277884 CET	1.1.1.1	192.168.2.16	0x872	No error (0)	lga-bh.contextweb.com	lga-direct-bgp.contextweb.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.268277884 CET	1.1.1.1	192.168.2.16	0x872	No error (0)	lga-direct-bgp.contextweb.com		198.148.27.131	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.269066095 CET	1.1.1.1	192.168.2.16	0x6835	No error (0)	bh.contextweb.com	lga-bh.contextweb.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.269066095 CET	1.1.1.1	192.168.2.16	0x6835	No error (0)	lga-bh.contextweb.com	lga-direct-bgp.contextweb.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.351391077 CET	1.1.1.1	192.168.2.16	0xd80d	No error (0)	rtb.openx.net		35.186.253.211	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.351391077 CET	1.1.1.1	192.168.2.16	0xd80d	No error (0)	rtb.openx.net		35.227.252.103	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.406408072 CET	1.1.1.1	192.168.2.16	0x9ab2	No error (0)	cs.krushmedia.com		8.2.110.134	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.407737017 CET	1.1.1.1	192.168.2.16	0x46e5	No error (0)	aorta.clickagy.com		52.20.73.112	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.407737017 CET	1.1.1.1	192.168.2.16	0x46e5	No error (0)	aorta.clickagy.com		35.169.93.15	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.407737017 CET	1.1.1.1	192.168.2.16	0x46e5	No error (0)	aorta.clickagy.com		34.197.163.191	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.407737017 CET	1.1.1.1	192.168.2.16	0x46e5	No error (0)	aorta.clickagy.com		44.214.186.206	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.433574915 CET	1.1.1.1	192.168.2.16	0x7444	No error (0)	ad.turn.com	ad.turn.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.433589935 CET	1.1.1.1	192.168.2.16	0x908a	No error (0)	ad.turn.com	ad.turn.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.497127056 CET	1.1.1.1	192.168.2.16	0x5f7f	No error (0)	token.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.497939110 CET	1.1.1.1	192.168.2.16	0x2f3e	No error (0)	token.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.696019888 CET	1.1.1.1	192.168.2.16	0xe4f	No error (0)	match.sharethrough.com	match-us-east-1-ecs.sharethrough.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.696238995 CET	1.1.1.1	192.168.2.16	0x4f1d	No error (0)	match.sharethrough.com	match-us-east-1-ecs.sharethrough.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.696238995 CET	1.1.1.1	192.168.2.16	0x4f1d	No error (0)	match-us-east-1-ecs.sharethrough.com		34.227.128.134	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.696238995 CET	1.1.1.1	192.168.2.16	0x4f1d	No error (0)	match-us-east-1-ecs.sharethrough.com		3.91.137.4	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.696238995 CET	1.1.1.1	192.168.2.16	0x4f1d	No error (0)	match-us-east-1-ecs.sharethrough.com		3.217.170.248	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.696238995 CET	1.1.1.1	192.168.2.16	0x4f1d	No error (0)	match-us-east-1-ecs.sharethrough.com		23.20.118.237	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.696238995 CET	1.1.1.1	192.168.2.16	0x4f1d	No error (0)	match-us-east-1-ecs.sharethrough.com		34.207.52.118	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.696238995 CET	1.1.1.1	192.168.2.16	0x4f1d	No error (0)	match-us-east-1-ecs.sharethrough.com		34.225.212.107	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.696238995 CET	1.1.1.1	192.168.2.16	0x4f1d	No error (0)	match-us-east-1-ecs.sharethrough.com		54.88.60.104	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.696238995 CET	1.1.1.1	192.168.2.16	0x4f1d	No error (0)	match-us-east-1-ecs.sharethrough.com		3.226.24.27	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.703969002 CET	1.1.1.1	192.168.2.16	0x7c69	No error (0)	sync.srv.stackadapt.com		54.224.142.7	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.703969002 CET	1.1.1.1	192.168.2.16	0x7c69	No error (0)	sync.srv.stackadapt.com		54.209.153.200	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.703969002 CET	1.1.1.1	192.168.2.16	0x7c69	No error (0)	sync.srv.stackadapt.com		54.159.180.193	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.703969002 CET	1.1.1.1	192.168.2.16	0x7c69	No error (0)	sync.srv.stackadapt.com		54.160.62.46	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.703969002 CET	1.1.1.1	192.168.2.16	0x7c69	No error (0)	sync.srv.stackadapt.com		54.159.41.249	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.703969002 CET	1.1.1.1	192.168.2.16	0x7c69	No error (0)	sync.srv.stackadapt.com		54.174.240.211	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.703969002 CET	1.1.1.1	192.168.2.16	0x7c69	No error (0)	sync.srv.stackadapt.com		54.166.150.36	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.703969002 CET	1.1.1.1	192.168.2.16	0x7c69	No error (0)	sync.srv.stackadapt.com		54.157.109.0	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.723788023 CET	1.1.1.1	192.168.2.16	0xa050	No error (0)	sync.ipredictive.com		52.86.247.227	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.723788023 CET	1.1.1.1	192.168.2.16	0xa050	No error (0)	sync.ipredictive.com		52.73.59.200	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.723788023 CET	1.1.1.1	192.168.2.16	0xa050	No error (0)	sync.ipredictive.com		52.72.99.93	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.723788023 CET	1.1.1.1	192.168.2.16	0xa050	No error (0)	sync.ipredictive.com		54.162.157.217	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.723788023 CET	1.1.1.1	192.168.2.16	0xa050	No error (0)	sync.ipredictive.com		52.7.115.38	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.723788023 CET	1.1.1.1	192.168.2.16	0xa050	No error (0)	sync.ipredictive.com		54.146.33.131	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.723788023 CET	1.1.1.1	192.168.2.16	0xa050	No error (0)	sync.ipredictive.com		52.3.160.15	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.723788023 CET	1.1.1.1	192.168.2.16	0xa050	No error (0)	sync.ipredictive.com		52.4.171.27	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.727902889 CET	1.1.1.1	192.168.2.16	0x446f	No error (0)	match.deepintent.com	m.deepintent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.727915049 CET	1.1.1.1	192.168.2.16	0x3f68	No error (0)	match.deepintent.com	m.deepintent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.727915049 CET	1.1.1.1	192.168.2.16	0x3f68	No error (0)	m.deepintent.com		169.197.150.7	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.727915049 CET	1.1.1.1	192.168.2.16	0x3f68	No error (0)	m.deepintent.com		8.18.47.7	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.727915049 CET	1.1.1.1	192.168.2.16	0x3f68	No error (0)	m.deepintent.com		38.91.45.7	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.727915049 CET	1.1.1.1	192.168.2.16	0x3f68	No error (0)	m.deepintent.com		169.197.150.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.755562067 CET	1.1.1.1	192.168.2.16	0x3999	No error (0)	c1.adform.net	track.adformnet.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.757705927 CET	1.1.1.1	192.168.2.16	0xd2d9	No error (0)	c1.adform.net	track.adformnet.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:30.936136007 CET	1.1.1.1	192.168.2.16	0x6666	No error (0)	sync-dmp.mobtrakk.com		5.161.124.197	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.936136007 CET	1.1.1.1	192.168.2.16	0x6666	No error (0)	sync-dmp.mobtrakk.com		5.161.181.189	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.936136007 CET	1.1.1.1	192.168.2.16	0x6666	No error (0)	sync-dmp.mobtrakk.com		5.161.204.250	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.936136007 CET	1.1.1.1	192.168.2.16	0x6666	No error (0)	sync-dmp.mobtrakk.com		5.161.188.99	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.936136007 CET	1.1.1.1	192.168.2.16	0x6666	No error (0)	sync-dmp.mobtrakk.com		5.161.195.128	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.936136007 CET	1.1.1.1	192.168.2.16	0x6666	No error (0)	sync-dmp.mobtrakk.com		5.161.187.67	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.936136007 CET	1.1.1.1	192.168.2.16	0x6666	No error (0)	sync-dmp.mobtrakk.com		5.161.62.221	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:30.936136007 CET	1.1.1.1	192.168.2.16	0x6666	No error (0)	sync-dmp.mobtrakk.com		5.161.92.137	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.socdm.com	tg.dr.socdm.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		211.120.53.201	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		124.146.153.164	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		124.146.153.168	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		124.146.153.165	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		211.120.53.203	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		124.146.153.167	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		124.146.153.163	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		211.120.53.206	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		124.146.153.161	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		124.146.153.170	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		124.146.153.160	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		211.120.53.204	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		124.146.153.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		211.120.53.205	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		124.146.153.166	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		211.120.53.202	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		211.120.53.200	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.204818010 CET	1.1.1.1	192.168.2.16	0xc414	No error (0)	tg.dr.socdm.com		124.146.153.169	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.205308914 CET	1.1.1.1	192.168.2.16	0x68f7	No error (0)	tg.socdm.com	tg.dr.socdm.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436142921 CET	1.1.1.1	192.168.2.16	0xbed1	No error (0)	thrtle.com		44.197.22.251	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436142921 CET	1.1.1.1	192.168.2.16	0xbed1	No error (0)	thrtle.com		50.19.110.14	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436142921 CET	1.1.1.1	192.168.2.16	0xbed1	No error (0)	thrtle.com		52.71.16.59	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436142921 CET	1.1.1.1	192.168.2.16	0xbed1	No error (0)	thrtle.com		54.159.245.111	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436142921 CET	1.1.1.1	192.168.2.16	0xbed1	No error (0)	thrtle.com		204.236.210.31	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436142921 CET	1.1.1.1	192.168.2.16	0xbed1	No error (0)	thrtle.com		54.158.15.169	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436142921 CET	1.1.1.1	192.168.2.16	0xbed1	No error (0)	thrtle.com		34.235.53.166	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436142921 CET	1.1.1.1	192.168.2.16	0xbed1	No error (0)	thrtle.com		54.156.62.74	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436631918 CET	1.1.1.1	192.168.2.16	0x1cc7	No error (0)	crb.kargo.com		34.230.139.192	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436631918 CET	1.1.1.1	192.168.2.16	0x1cc7	No error (0)	crb.kargo.com		34.195.28.76	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436631918 CET	1.1.1.1	192.168.2.16	0x1cc7	No error (0)	crb.kargo.com		52.1.240.135	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436631918 CET	1.1.1.1	192.168.2.16	0x1cc7	No error (0)	crb.kargo.com		34.224.103.168	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436631918 CET	1.1.1.1	192.168.2.16	0x1cc7	No error (0)	crb.kargo.com		34.199.50.181	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.436631918 CET	1.1.1.1	192.168.2.16	0x1cc7	No error (0)	crb.kargo.com		34.234.144.3	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.438869953 CET	1.1.1.1	192.168.2.16	0xf3c4	No error (0)	sync.bfmio.com	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.438869953 CET	1.1.1.1	192.168.2.16	0xf3c4	No error (0)	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com		52.4.146.202	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.438869953 CET	1.1.1.1	192.168.2.16	0xf3c4	No error (0)	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com		52.23.26.141	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.438869953 CET	1.1.1.1	192.168.2.16	0xf3c4	No error (0)	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com		52.44.250.119	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.438869953 CET	1.1.1.1	192.168.2.16	0xf3c4	No error (0)	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com		52.72.189.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.438869953 CET	1.1.1.1	192.168.2.16	0xf3c4	No error (0)	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com		52.70.181.24	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.438869953 CET	1.1.1.1	192.168.2.16	0xf3c4	No error (0)	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com		52.4.1.221	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.438869953 CET	1.1.1.1	192.168.2.16	0xf3c4	No error (0)	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com		52.3.7.191	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.438869953 CET	1.1.1.1	192.168.2.16	0xf3c4	No error (0)	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com		52.70.125.191	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.439019918 CET	1.1.1.1	192.168.2.16	0x85c9	No error (0)	pmp.mxptint.net		38.98.69.175	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.439487934 CET	1.1.1.1	192.168.2.16	0x7b80	No error (0)	sync.bfmio.com	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.439851046 CET	1.1.1.1	192.168.2.16	0xee58	No error (0)	rtb.adentifi.com		54.198.64.103	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.439851046 CET	1.1.1.1	192.168.2.16	0xee58	No error (0)	rtb.adentifi.com		54.81.245.140	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.439851046 CET	1.1.1.1	192.168.2.16	0xee58	No error (0)	rtb.adentifi.com		3.228.157.65	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.439851046 CET	1.1.1.1	192.168.2.16	0xee58	No error (0)	rtb.adentifi.com		52.0.102.42	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.439851046 CET	1.1.1.1	192.168.2.16	0xee58	No error (0)	rtb.adentifi.com		52.21.58.192	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.439851046 CET	1.1.1.1	192.168.2.16	0xee58	No error (0)	rtb.adentifi.com		3.210.93.214	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.439851046 CET	1.1.1.1	192.168.2.16	0xee58	No error (0)	rtb.adentifi.com		107.23.119.165	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.439851046 CET	1.1.1.1	192.168.2.16	0xee58	No error (0)	rtb.adentifi.com		35.175.93.117	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.563477993 CET	1.1.1.1	192.168.2.16	0xda73	No error (0)	tr.blismedia.com		34.96.105.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.617381096 CET	1.1.1.1	192.168.2.16	0x8f1f	No error (0)	usersync.gumgum.com		35.172.99.217	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.617381096 CET	1.1.1.1	192.168.2.16	0x8f1f	No error (0)	usersync.gumgum.com		52.207.45.55	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.617381096 CET	1.1.1.1	192.168.2.16	0x8f1f	No error (0)	usersync.gumgum.com		3.213.224.199	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.617381096 CET	1.1.1.1	192.168.2.16	0x8f1f	No error (0)	usersync.gumgum.com		3.214.33.241	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.617381096 CET	1.1.1.1	192.168.2.16	0x8f1f	No error (0)	usersync.gumgum.com		54.87.127.173	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.777929068 CET	1.1.1.1	192.168.2.16	0xd4b4	No error (0)	image8.pubmatic.com	image8-v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.777929068 CET	1.1.1.1	192.168.2.16	0xd4b4	No error (0)	image8-v2.pubmnet.com	imagesync-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.778459072 CET	1.1.1.1	192.168.2.16	0x689f	No error (0)	image8.pubmatic.com	image8-v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.778459072 CET	1.1.1.1	192.168.2.16	0x689f	No error (0)	image8-v2.pubmnet.com	imgsync-njrpb.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.778459072 CET	1.1.1.1	192.168.2.16	0x689f	No error (0)	imgsync-njrpb.pubmnet.com		162.248.18.32	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.801928043 CET	1.1.1.1	192.168.2.16	0x1507	No error (0)	ssbsync-global.smartadserver.com	usersync-geo-global.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-global.smartadserver.com	usersync-geo-global.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.143	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.37	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		23.105.14.100	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.171	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.53	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		23.105.14.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.159	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.5	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.4	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.158	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.142	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.52	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		216.22.16.36	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.802047968 CET	1.1.1.1	192.168.2.16	0xed47	No error (0)	ssbsync-use1.smartadserver.com		23.105.12.170	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.804996967 CET	1.1.1.1	192.168.2.16	0xa1a9	No error (0)	qsearch-a.akamaihd.net	qsearch-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.805452108 CET	1.1.1.1	192.168.2.16	0x4460	No error (0)	qsearch-a.akamaihd.net	qsearch-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.810184002 CET	1.1.1.1	192.168.2.16	0xe832	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823040962 CET	1.1.1.1	192.168.2.16	0x8d3d	No error (0)	simage4.pubmatic.com	image4-v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823040962 CET	1.1.1.1	192.168.2.16	0x8d3d	No error (0)	image4-v2.pubmnet.com	spug-njrpb.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823148012 CET	1.1.1.1	192.168.2.16	0x19e4	No error (0)	simage4.pubmatic.com	image4-v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823148012 CET	1.1.1.1	192.168.2.16	0x19e4	No error (0)	image4-v2.pubmnet.com	spug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823148012 CET	1.1.1.1	192.168.2.16	0x19e4	No error (0)	spug-vac.pubmnet.com		8.28.7.84	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823580027 CET	1.1.1.1	192.168.2.16	0xf05e	No error (0)	config.aps.amazon-adsystem.com		108.157.162.90	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823580027 CET	1.1.1.1	192.168.2.16	0xf05e	No error (0)	config.aps.amazon-adsystem.com		108.157.162.100	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823580027 CET	1.1.1.1	192.168.2.16	0xf05e	No error (0)	config.aps.amazon-adsystem.com		108.157.162.50	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823580027 CET	1.1.1.1	192.168.2.16	0xf05e	No error (0)	config.aps.amazon-adsystem.com		108.157.162.92	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823849916 CET	1.1.1.1	192.168.2.16	0x2cd4	No error (0)	ad-delivery.net		104.26.3.70	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823849916 CET	1.1.1.1	192.168.2.16	0x2cd4	No error (0)	ad-delivery.net		172.67.69.19	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.823849916 CET	1.1.1.1	192.168.2.16	0x2cd4	No error (0)	ad-delivery.net		104.26.2.70	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.824158907 CET	1.1.1.1	192.168.2.16	0xf45e	No error (0)	sync.adotmob.com		45.137.176.88	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.824229002 CET	1.1.1.1	192.168.2.16	0x9df2	No error (0)	ad-delivery.net			65	IN (0x0001)	false
Dec 19, 2023 10:22:31.825623989 CET	1.1.1.1	192.168.2.16	0xe684	No error (0)	rtb.mfadsrvr.com	pool.dorpat.iponweb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.825623989 CET	1.1.1.1	192.168.2.16	0xe684	No error (0)	pool.dorpat.iponweb.net	dorpat.geo.iponweb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.825623989 CET	1.1.1.1	192.168.2.16	0xe684	No error (0)	dorpat.geo.iponweb.net		35.207.24.140	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.826188087 CET	1.1.1.1	192.168.2.16	0x136f	No error (0)	rtb.mfadsrvr.com	pool.dorpat.iponweb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.826188087 CET	1.1.1.1	192.168.2.16	0x136f	No error (0)	pool.dorpat.iponweb.net	dorpat.geo.iponweb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.850029945 CET	1.1.1.1	192.168.2.16	0x72d	No error (0)	odr.mookie1.com	tagr-gcp-odr-use1.mookie1.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.850029945 CET	1.1.1.1	192.168.2.16	0x72d	No error (0)	tagr-gcp-odr-use1.mookie1.com		35.190.90.30	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.851596117 CET	1.1.1.1	192.168.2.16	0xe9f5	No error (0)	odr.mookie1.com	tagr-gcp-odr-use1.mookie1.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.891393900 CET	1.1.1.1	192.168.2.16	0xf573	No error (0)	p.rfihub.com	a.rfihub.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.891393900 CET	1.1.1.1	192.168.2.16	0xf573	No error (0)	a.rfihub.com	a.rfihub.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.891812086 CET	1.1.1.1	192.168.2.16	0xd526	No error (0)	p.rfihub.com	a.rfihub.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.891812086 CET	1.1.1.1	192.168.2.16	0xd526	No error (0)	a.rfihub.com	a.rfihub.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.963887930 CET	1.1.1.1	192.168.2.16	0xf050	No error (0)	inv-nets.admixer.net		216.219.92.22	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.965950966 CET	1.1.1.1	192.168.2.16	0xb8c0	No error (0)	cms.quantserve.com	2kpixel.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.965950966 CET	1.1.1.1	192.168.2.16	0xb8c0	No error (0)	2kpixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.966954947 CET	1.1.1.1	192.168.2.16	0xe47e	No error (0)	cms.quantserve.com	2kpixel.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.966954947 CET	1.1.1.1	192.168.2.16	0xe47e	No error (0)	2kpixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:31.966954947 CET	1.1.1.1	192.168.2.16	0xe47e	No error (0)	global.px.quantserve.com		192.184.68.215	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.966954947 CET	1.1.1.1	192.168.2.16	0xe47e	No error (0)	global.px.quantserve.com		192.184.68.134	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.966954947 CET	1.1.1.1	192.168.2.16	0xe47e	No error (0)	global.px.quantserve.com		192.184.68.254	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.966954947 CET	1.1.1.1	192.168.2.16	0xe47e	No error (0)	global.px.quantserve.com		192.184.68.166	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:31.966954947 CET	1.1.1.1	192.168.2.16	0xe47e	No error (0)	global.px.quantserve.com		192.184.68.149	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.016133070 CET	1.1.1.1	192.168.2.16	0x8b33	No error (0)	cs-server-s2s.yellowblue.io		3.84.70.71	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.016133070 CET	1.1.1.1	192.168.2.16	0x8b33	No error (0)	cs-server-s2s.yellowblue.io		52.22.211.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.016133070 CET	1.1.1.1	192.168.2.16	0x8b33	No error (0)	cs-server-s2s.yellowblue.io		3.233.88.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.016133070 CET	1.1.1.1	192.168.2.16	0x8b33	No error (0)	cs-server-s2s.yellowblue.io		52.0.247.215	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.224318027 CET	1.1.1.1	192.168.2.16	0x9c7c	No error (0)	bttrack.com		192.132.33.69	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.224318027 CET	1.1.1.1	192.168.2.16	0x9c7c	No error (0)	bttrack.com		192.132.33.67	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.224318027 CET	1.1.1.1	192.168.2.16	0x9c7c	No error (0)	bttrack.com		192.132.33.68	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.242556095 CET	1.1.1.1	192.168.2.16	0xc79e	No error (0)	cm.adgrx.com	rtb.adgrx.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.242556095 CET	1.1.1.1	192.168.2.16	0xc79e	No error (0)	rtb.adgrx.com		173.231.178.83	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.242556095 CET	1.1.1.1	192.168.2.16	0xc79e	No error (0)	rtb.adgrx.com		173.231.184.20	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.242556095 CET	1.1.1.1	192.168.2.16	0xc79e	No error (0)	rtb.adgrx.com		173.231.178.117	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.242556095 CET	1.1.1.1	192.168.2.16	0xc79e	No error (0)	rtb.adgrx.com		173.231.178.115	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.242556095 CET	1.1.1.1	192.168.2.16	0xc79e	No error (0)	rtb.adgrx.com		173.231.178.81	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.242556095 CET	1.1.1.1	192.168.2.16	0xc79e	No error (0)	rtb.adgrx.com		173.231.178.77	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.242556095 CET	1.1.1.1	192.168.2.16	0xc79e	No error (0)	rtb.adgrx.com		72.251.229.176	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.242556095 CET	1.1.1.1	192.168.2.16	0xc79e	No error (0)	rtb.adgrx.com		173.231.178.116	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.243344069 CET	1.1.1.1	192.168.2.16	0x12cc	No error (0)	cm.adgrx.com	rtb.adgrx.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.247266054 CET	1.1.1.1	192.168.2.16	0xb856	No error (0)	cdn-ima.33across.com	cdn-ima.33across.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.247911930 CET	1.1.1.1	192.168.2.16	0xeb91	No error (0)	cdn-ima.33across.com	cdn-ima.33across.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.264977932 CET	1.1.1.1	192.168.2.16	0x60b9	No error (0)	cdn.id5-sync.com		172.67.38.106	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.264977932 CET	1.1.1.1	192.168.2.16	0x60b9	No error (0)	cdn.id5-sync.com		104.22.53.86	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.264977932 CET	1.1.1.1	192.168.2.16	0x60b9	No error (0)	cdn.id5-sync.com		104.22.52.86	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.266128063 CET	1.1.1.1	192.168.2.16	0x3dc2	No error (0)	cdn.id5-sync.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:32.381999969 CET	1.1.1.1	192.168.2.16	0x9e0f	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.382656097 CET	1.1.1.1	192.168.2.16	0xc5a	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.410166979 CET	1.1.1.1	192.168.2.16	0x84c1	No error (0)	dsp.adfarm1.adition.com		85.114.159.93	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.410166979 CET	1.1.1.1	192.168.2.16	0x84c1	No error (0)	dsp.adfarm1.adition.com		85.114.159.118	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.412687063 CET	1.1.1.1	192.168.2.16	0x9885	No error (0)	ums.acuityplatform.com		69.90.254.78	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.414926052 CET	1.1.1.1	192.168.2.16	0x412b	No error (0)	rbp.mxptint.net		38.68.201.140	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.609195948 CET	1.1.1.1	192.168.2.16	0x1fe0	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.609195948 CET	1.1.1.1	192.168.2.16	0x1fe0	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.609416008 CET	1.1.1.1	192.168.2.16	0x5435	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.609416008 CET	1.1.1.1	192.168.2.16	0x5435	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.751544952 CET	1.1.1.1	192.168.2.16	0xb6f2	No error (0)	33across-match.dotomi.com	bfp.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.773202896 CET	1.1.1.1	192.168.2.16	0x7df7	No error (0)	33across-match.dotomi.com	bfp.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.848984003 CET	1.1.1.1	192.168.2.16	0xf363	No error (0)	sync.spotim.market	sync.unoadsrv.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.848984003 CET	1.1.1.1	192.168.2.16	0xf363	No error (0)	sync.unoadsrv.com	sync-unosync-com.geodns.me		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.848984003 CET	1.1.1.1	192.168.2.16	0xf363	No error (0)	sync-unosync-com.geodns.me		23.227.146.18	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.849917889 CET	1.1.1.1	192.168.2.16	0xc16	No error (0)	sync.spotim.market	sync.unoadsrv.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.849917889 CET	1.1.1.1	192.168.2.16	0xc16	No error (0)	sync.unoadsrv.com	sync-unosync-com.geodns.me		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.850703955 CET	1.1.1.1	192.168.2.16	0x91a2	No error (0)	ads.betweendigital.com	ssp.ads.betweendigital.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.850703955 CET	1.1.1.1	192.168.2.16	0x91a2	No error (0)	ssp.ads.betweendigital.com		172.240.127.128	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.850703955 CET	1.1.1.1	192.168.2.16	0x91a2	No error (0)	ssp.ads.betweendigital.com		172.240.127.130	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.850703955 CET	1.1.1.1	192.168.2.16	0x91a2	No error (0)	ssp.ads.betweendigital.com		172.240.127.129	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.850703955 CET	1.1.1.1	192.168.2.16	0x91a2	No error (0)	ssp.ads.betweendigital.com		96.46.186.63	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.850703955 CET	1.1.1.1	192.168.2.16	0x91a2	No error (0)	ssp.ads.betweendigital.com		96.46.186.59	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.850703955 CET	1.1.1.1	192.168.2.16	0x91a2	No error (0)	ssp.ads.betweendigital.com		96.46.186.57	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.850703955 CET	1.1.1.1	192.168.2.16	0x91a2	No error (0)	ssp.ads.betweendigital.com		172.240.127.131	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.850703955 CET	1.1.1.1	192.168.2.16	0x91a2	No error (0)	ssp.ads.betweendigital.com		96.46.186.61	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:32.850956917 CET	1.1.1.1	192.168.2.16	0xcce4	No error (0)	ads.betweendigital.com	ssp.ads.betweendigital.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:32.971740961 CET	1.1.1.1	192.168.2.16	0xd076	No error (0)	s0.2mdn.net		142.250.217.230	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.254703999 CET	1.1.1.1	192.168.2.16	0xef2f	No error (0)	sync.crwdcntrl.net		34.225.234.246	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.254703999 CET	1.1.1.1	192.168.2.16	0xef2f	No error (0)	sync.crwdcntrl.net		52.206.155.140	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.254703999 CET	1.1.1.1	192.168.2.16	0xef2f	No error (0)	sync.crwdcntrl.net		3.208.124.249	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.254703999 CET	1.1.1.1	192.168.2.16	0xef2f	No error (0)	sync.crwdcntrl.net		44.211.9.18	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.254703999 CET	1.1.1.1	192.168.2.16	0xef2f	No error (0)	sync.crwdcntrl.net		44.208.253.113	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.254703999 CET	1.1.1.1	192.168.2.16	0xef2f	No error (0)	sync.crwdcntrl.net		44.193.54.186	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.254703999 CET	1.1.1.1	192.168.2.16	0xef2f	No error (0)	sync.crwdcntrl.net		44.220.113.151	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.254703999 CET	1.1.1.1	192.168.2.16	0xef2f	No error (0)	sync.crwdcntrl.net		174.129.88.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.256947994 CET	1.1.1.1	192.168.2.16	0x3cad	No error (0)	d.turn.com	d.turn.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.257087946 CET	1.1.1.1	192.168.2.16	0xefcd	No error (0)	d.turn.com	d.turn.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.260410070 CET	1.1.1.1	192.168.2.16	0x4351	No error (0)	cm.ctnsnet.com		35.186.193.173	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.266021013 CET	1.1.1.1	192.168.2.16	0x922e	No error (0)	cdn.indexww.com		172.64.149.180	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.266021013 CET	1.1.1.1	192.168.2.16	0x922e	No error (0)	cdn.indexww.com		104.18.38.76	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.266120911 CET	1.1.1.1	192.168.2.16	0xaac3	No error (0)	cdn.indexww.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:33.277904987 CET	1.1.1.1	192.168.2.16	0xe698	No error (0)	casale-match.dotomi.com	bfp.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.280759096 CET	1.1.1.1	192.168.2.16	0xdc1a	No error (0)	casale-match.dotomi.com	bfp.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.379225969 CET	1.1.1.1	192.168.2.16	0x6c50	No error (0)	a.sportradarserving.com	zagreb.geo.iponweb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.379225969 CET	1.1.1.1	192.168.2.16	0x6c50	No error (0)	zagreb.geo.iponweb.net	pool-use.zagreb.iponweb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.379225969 CET	1.1.1.1	192.168.2.16	0x6c50	No error (0)	pool-use.zagreb.iponweb.net		35.211.233.246	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.379344940 CET	1.1.1.1	192.168.2.16	0x5784	No error (0)	a.sportradarserving.com	zagreb.geo.iponweb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.379344940 CET	1.1.1.1	192.168.2.16	0x5784	No error (0)	zagreb.geo.iponweb.net	pool-use.zagreb.iponweb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.392327070 CET	1.1.1.1	192.168.2.16	0x3c63	No error (0)	image4.pubmatic.com	image4-v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.392327070 CET	1.1.1.1	192.168.2.16	0x3c63	No error (0)	image4-v2.pubmnet.com	spug-njrpb.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.392327070 CET	1.1.1.1	192.168.2.16	0x3c63	No error (0)	spug-njrpb.pubmnet.com		162.248.18.34	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:33.393713951 CET	1.1.1.1	192.168.2.16	0xbb94	No error (0)	image4.pubmatic.com	image4-v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.393713951 CET	1.1.1.1	192.168.2.16	0xbb94	No error (0)	image4-v2.pubmnet.com	spug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.728671074 CET	1.1.1.1	192.168.2.16	0xa480	No error (0)	capi.connatix.com	capi.connatix.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.729355097 CET	1.1.1.1	192.168.2.16	0xc454	No error (0)	capi.connatix.com	capi.connatix.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.769093037 CET	1.1.1.1	192.168.2.16	0x169	No error (0)	rubicon-match.dotomi.com	bfp.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:33.786103010 CET	1.1.1.1	192.168.2.16	0x912b	No error (0)	rubicon-match.dotomi.com	bfp.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.087351084 CET	1.1.1.1	192.168.2.16	0x9e0f	No error (0)	pm.w55c.net	cdn.w55c.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.087351084 CET	1.1.1.1	192.168.2.16	0x9e0f	No error (0)	cdn.w55c.net		54.157.11.141	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.087351084 CET	1.1.1.1	192.168.2.16	0x9e0f	No error (0)	cdn.w55c.net		52.4.73.182	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.087351084 CET	1.1.1.1	192.168.2.16	0x9e0f	No error (0)	cdn.w55c.net		54.198.122.161	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.087351084 CET	1.1.1.1	192.168.2.16	0x9e0f	No error (0)	cdn.w55c.net		54.210.243.216	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.087351084 CET	1.1.1.1	192.168.2.16	0x9e0f	No error (0)	cdn.w55c.net		52.86.237.52	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.087351084 CET	1.1.1.1	192.168.2.16	0x9e0f	No error (0)	cdn.w55c.net		54.163.159.203	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.087351084 CET	1.1.1.1	192.168.2.16	0x9e0f	No error (0)	cdn.w55c.net		52.73.178.71	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.087351084 CET	1.1.1.1	192.168.2.16	0x9e0f	No error (0)	cdn.w55c.net		54.209.121.65	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.087625027 CET	1.1.1.1	192.168.2.16	0xe597	No error (0)	pm.w55c.net	cdn.w55c.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.208501101 CET	1.1.1.1	192.168.2.16	0xba3a	No error (0)	cs.minutemedia-prebid.com	cs.digbearings.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.224246979 CET	1.1.1.1	192.168.2.16	0xf9ac	No error (0)	cs.minutemedia-prebid.com	cs.digbearings.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.224246979 CET	1.1.1.1	192.168.2.16	0xf9ac	No error (0)	cs.digbearings.com		52.0.247.215	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.224246979 CET	1.1.1.1	192.168.2.16	0xf9ac	No error (0)	cs.digbearings.com		3.84.70.71	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.224246979 CET	1.1.1.1	192.168.2.16	0xf9ac	No error (0)	cs.digbearings.com		52.22.211.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.224246979 CET	1.1.1.1	192.168.2.16	0xf9ac	No error (0)	cs.digbearings.com		3.233.88.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.305027962 CET	1.1.1.1	192.168.2.16	0x298e	No error (0)	lexicon.33across.com		35.244.193.51	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.337125063 CET	1.1.1.1	192.168.2.16	0xf03a	No error (0)	beacon.lynx.cognitivlabs.com	lynx-prod-beacon-alb-498367235.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.337363005 CET	1.1.1.1	192.168.2.16	0xce1d	No error (0)	beacon.lynx.cognitivlabs.com	lynx-prod-beacon-alb-498367235.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.337363005 CET	1.1.1.1	192.168.2.16	0xce1d	No error (0)	lynx-prod-beacon-alb-498367235.us-east-1.elb.amazonaws.com		18.209.128.131	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.337363005 CET	1.1.1.1	192.168.2.16	0xce1d	No error (0)	lynx-prod-beacon-alb-498367235.us-east-1.elb.amazonaws.com		3.213.9.240	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.337363005 CET	1.1.1.1	192.168.2.16	0xce1d	No error (0)	lynx-prod-beacon-alb-498367235.us-east-1.elb.amazonaws.com		44.199.51.202	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.337363005 CET	1.1.1.1	192.168.2.16	0xce1d	No error (0)	lynx-prod-beacon-alb-498367235.us-east-1.elb.amazonaws.com		54.81.68.127	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371088028 CET	1.1.1.1	192.168.2.16	0x25a9	No error (0)	cs.yellowblue.io		3.233.88.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371088028 CET	1.1.1.1	192.168.2.16	0x25a9	No error (0)	cs.yellowblue.io		52.0.247.215	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371088028 CET	1.1.1.1	192.168.2.16	0x25a9	No error (0)	cs.yellowblue.io		52.22.211.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371088028 CET	1.1.1.1	192.168.2.16	0x25a9	No error (0)	cs.yellowblue.io		3.84.70.71	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371963978 CET	1.1.1.1	192.168.2.16	0x3dfc	No error (0)	ads.yieldmo.com	rw.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371963978 CET	1.1.1.1	192.168.2.16	0x3dfc	No error (0)	rw.yieldmo.com	us-east-1.world.rw.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371963978 CET	1.1.1.1	192.168.2.16	0x3dfc	No error (0)	us-east-1.world.rw.yieldmo.com	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371963978 CET	1.1.1.1	192.168.2.16	0x3dfc	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		107.20.203.46	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371963978 CET	1.1.1.1	192.168.2.16	0x3dfc	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		34.199.146.203	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371963978 CET	1.1.1.1	192.168.2.16	0x3dfc	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		107.23.32.236	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371963978 CET	1.1.1.1	192.168.2.16	0x3dfc	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		34.194.96.30	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371963978 CET	1.1.1.1	192.168.2.16	0x3dfc	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		35.175.88.165	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371963978 CET	1.1.1.1	192.168.2.16	0x3dfc	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		34.232.164.211	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371963978 CET	1.1.1.1	192.168.2.16	0x3dfc	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		54.197.181.200	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.371963978 CET	1.1.1.1	192.168.2.16	0x3dfc	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		52.71.216.182	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.372181892 CET	1.1.1.1	192.168.2.16	0xd861	No error (0)	ads.yieldmo.com	rw.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.372181892 CET	1.1.1.1	192.168.2.16	0xd861	No error (0)	rw.yieldmo.com	us-east-1.world.rw.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.372181892 CET	1.1.1.1	192.168.2.16	0xd861	No error (0)	us-east-1.world.rw.yieldmo.com	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.432739019 CET	1.1.1.1	192.168.2.16	0xbcfe	No error (0)	s.seedtag.com		34.149.50.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.450042009 CET	1.1.1.1	192.168.2.16	0xcdd5	No error (0)	s2s.t13.io		34.107.140.113	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.591636896 CET	1.1.1.1	192.168.2.16	0x38fc	No error (0)	id.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.622678995 CET	1.1.1.1	192.168.2.16	0xc72f	No error (0)	e.serverbid.com	x.serverbid.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.622678995 CET	1.1.1.1	192.168.2.16	0xc72f	No error (0)	x.serverbid.com	exchange.consumabletv.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.622678995 CET	1.1.1.1	192.168.2.16	0xc72f	No error (0)	exchange.consumabletv.com	cx.serverbid.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.622713089 CET	1.1.1.1	192.168.2.16	0x638	No error (0)	e.serverbid.com	x.serverbid.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.622713089 CET	1.1.1.1	192.168.2.16	0x638	No error (0)	x.serverbid.com	exchange.consumabletv.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.622713089 CET	1.1.1.1	192.168.2.16	0x638	No error (0)	exchange.consumabletv.com	cx.serverbid.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.622713089 CET	1.1.1.1	192.168.2.16	0x638	No error (0)	cx.serverbid.com		159.89.246.130	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.716135025 CET	1.1.1.1	192.168.2.16	0x5425	No error (0)	synchroscript.deliveryengine.adswizz.com		13.32.87.73	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.716135025 CET	1.1.1.1	192.168.2.16	0x5425	No error (0)	synchroscript.deliveryengine.adswizz.com		13.32.87.20	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.716135025 CET	1.1.1.1	192.168.2.16	0x5425	No error (0)	synchroscript.deliveryengine.adswizz.com		13.32.87.86	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.716135025 CET	1.1.1.1	192.168.2.16	0x5425	No error (0)	synchroscript.deliveryengine.adswizz.com		13.32.87.104	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.719913960 CET	1.1.1.1	192.168.2.16	0xc4a7	No error (0)	idsync.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.722001076 CET	1.1.1.1	192.168.2.16	0x88e5	No error (0)	bcp.crwdcntrl.net		174.129.88.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.722001076 CET	1.1.1.1	192.168.2.16	0x88e5	No error (0)	bcp.crwdcntrl.net		44.220.113.151	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.722001076 CET	1.1.1.1	192.168.2.16	0x88e5	No error (0)	bcp.crwdcntrl.net		3.208.124.249	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.722001076 CET	1.1.1.1	192.168.2.16	0x88e5	No error (0)	bcp.crwdcntrl.net		44.211.9.18	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.722001076 CET	1.1.1.1	192.168.2.16	0x88e5	No error (0)	bcp.crwdcntrl.net		34.225.234.246	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.722001076 CET	1.1.1.1	192.168.2.16	0x88e5	No error (0)	bcp.crwdcntrl.net		52.206.155.140	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.722001076 CET	1.1.1.1	192.168.2.16	0x88e5	No error (0)	bcp.crwdcntrl.net		44.193.54.186	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.722001076 CET	1.1.1.1	192.168.2.16	0x88e5	No error (0)	bcp.crwdcntrl.net		54.209.94.68	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:34.745106936 CET	1.1.1.1	192.168.2.16	0x85be	No error (0)	prebid-match.dotomi.com	bfp.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:34.745152950 CET	1.1.1.1	192.168.2.16	0x5ed6	No error (0)	prebid-match.dotomi.com	bfp.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.117696047 CET	1.1.1.1	192.168.2.16	0x5504	No error (0)	match.sync.ad.cpe.dotomi.com	convex-rr.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.128401041 CET	1.1.1.1	192.168.2.16	0x2c24	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.305356979 CET	1.1.1.1	192.168.2.16	0x241f	No error (0)	sync.targeting.unrulymedia.com	sync.1rx.io		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.305356979 CET	1.1.1.1	192.168.2.16	0x241f	No error (0)	sync.1rx.io		69.194.240.13	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.306449890 CET	1.1.1.1	192.168.2.16	0x5008	No error (0)	sync.targeting.unrulymedia.com	sync.1rx.io		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.402518988 CET	1.1.1.1	192.168.2.16	0x6a27	No error (0)	match.adsby.bidtheatre.com		64.227.64.62	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.402518988 CET	1.1.1.1	192.168.2.16	0x6a27	No error (0)	match.adsby.bidtheatre.com		188.166.17.21	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.402518988 CET	1.1.1.1	192.168.2.16	0x6a27	No error (0)	match.adsby.bidtheatre.com		134.122.57.34	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.462661028 CET	1.1.1.1	192.168.2.16	0x3285	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.462661028 CET	1.1.1.1	192.168.2.16	0x3285	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.462661028 CET	1.1.1.1	192.168.2.16	0x3285	No error (0)	us-east-eb2.3lift.com		35.71.139.29	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.462661028 CET	1.1.1.1	192.168.2.16	0x3285	No error (0)	us-east-eb2.3lift.com		52.223.22.214	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.463114977 CET	1.1.1.1	192.168.2.16	0x7493	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.463114977 CET	1.1.1.1	192.168.2.16	0x7493	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.474426031 CET	1.1.1.1	192.168.2.16	0x8576	No error (0)	prebid.a-mo.net	dc13-prebid.a-mx.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.474426031 CET	1.1.1.1	192.168.2.16	0x8576	No error (0)	dc13-prebid.a-mx.net		147.28.129.140	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.474426031 CET	1.1.1.1	192.168.2.16	0x8576	No error (0)	dc13-prebid.a-mx.net		147.28.146.89	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.474426031 CET	1.1.1.1	192.168.2.16	0x8576	No error (0)	dc13-prebid.a-mx.net		147.28.129.37	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.476246119 CET	1.1.1.1	192.168.2.16	0xd767	No error (0)	prebid.a-mo.net	dc13-prebid.a-mx.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.476792097 CET	1.1.1.1	192.168.2.16	0x6e5	No error (0)	visitor.omnitagjs.com	visitor-usa02.omnitagjs.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.476792097 CET	1.1.1.1	192.168.2.16	0x6e5	No error (0)	visitor-usa02.omnitagjs.com		195.244.31.10	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.476792097 CET	1.1.1.1	192.168.2.16	0x6e5	No error (0)	visitor-usa02.omnitagjs.com		195.244.31.11	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.477438927 CET	1.1.1.1	192.168.2.16	0x86c8	No error (0)	visitor.omnitagjs.com	visitor-us-west-2.omnitagjs.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:35.505157948 CET	1.1.1.1	192.168.2.16	0xd623	No error (0)	live.rezync.com		18.239.225.91	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.505157948 CET	1.1.1.1	192.168.2.16	0xd623	No error (0)	live.rezync.com		18.239.225.42	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.505157948 CET	1.1.1.1	192.168.2.16	0xd623	No error (0)	live.rezync.com		18.239.225.77	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:35.505157948 CET	1.1.1.1	192.168.2.16	0xd623	No error (0)	live.rezync.com		18.239.225.48	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.010066986 CET	1.1.1.1	192.168.2.16	0x5d7d	No error (0)	usr.undertone.com	evt.undertone.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.010066986 CET	1.1.1.1	192.168.2.16	0x5d7d	No error (0)	evt.undertone.com	d1wsawskf2klzj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.011244059 CET	1.1.1.1	192.168.2.16	0x6a40	No error (0)	usr.undertone.com	evt.undertone.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.011244059 CET	1.1.1.1	192.168.2.16	0x6a40	No error (0)	evt.undertone.com	d1wsawskf2klzj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.011244059 CET	1.1.1.1	192.168.2.16	0x6a40	No error (0)	d1wsawskf2klzj.cloudfront.net		13.32.87.66	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.011244059 CET	1.1.1.1	192.168.2.16	0x6a40	No error (0)	d1wsawskf2klzj.cloudfront.net		13.32.87.97	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.011244059 CET	1.1.1.1	192.168.2.16	0x6a40	No error (0)	d1wsawskf2klzj.cloudfront.net		13.32.87.108	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.011244059 CET	1.1.1.1	192.168.2.16	0x6a40	No error (0)	d1wsawskf2klzj.cloudfront.net		13.32.87.126	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.014525890 CET	1.1.1.1	192.168.2.16	0xacf5	No error (0)	ad.mrtnsvr.com		34.102.163.6	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.015801907 CET	1.1.1.1	192.168.2.16	0x189	No error (0)	gocm.c.appier.net	cm119.appier.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.015801907 CET	1.1.1.1	192.168.2.16	0x189	No error (0)	cm119.appier.org		172.105.220.23	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.016868114 CET	1.1.1.1	192.168.2.16	0xb3fe	No error (0)	gocm.c.appier.net	cm123.appier.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.017740011 CET	1.1.1.1	192.168.2.16	0x9c1f	No error (0)	ipac.ctnsnet.com		35.186.193.173	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.018749952 CET	1.1.1.1	192.168.2.16	0xeeff	No error (0)	core.iprom.net		195.5.165.20	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.018790007 CET	1.1.1.1	192.168.2.16	0x5007	No error (0)	matching.truffle.bid		23.88.86.2	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.018790007 CET	1.1.1.1	192.168.2.16	0x5007	No error (0)	matching.truffle.bid		162.55.120.196	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.019660950 CET	1.1.1.1	192.168.2.16	0x9e6d	No error (0)	px.owneriq.net	wildcard.owneriq.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.019706964 CET	1.1.1.1	192.168.2.16	0xc4b6	No error (0)	px.owneriq.net	wildcard.owneriq.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.020148993 CET	1.1.1.1	192.168.2.16	0x7a97	No error (0)	bpi.rtactivate.com	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.020148993 CET	1.1.1.1	192.168.2.16	0x7a97	No error (0)	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		44.193.120.159	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.020148993 CET	1.1.1.1	192.168.2.16	0x7a97	No error (0)	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		3.93.251.5	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.020148993 CET	1.1.1.1	192.168.2.16	0x7a97	No error (0)	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		34.197.216.192	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.020148993 CET	1.1.1.1	192.168.2.16	0x7a97	No error (0)	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		18.215.67.38	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.020417929 CET	1.1.1.1	192.168.2.16	0x31f6	No error (0)	bpi.rtactivate.com	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.098431110 CET	1.1.1.1	192.168.2.16	0xcd3d	No error (0)	events-ssc.33across.com		34.117.239.71	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.098889112 CET	1.1.1.1	192.168.2.16	0x6417	No error (0)	live.primis.tech	d2wcz8sc48ztgm.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.099483013 CET	1.1.1.1	192.168.2.16	0x50a1	No error (0)	live.primis.tech	d2wcz8sc48ztgm.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.099483013 CET	1.1.1.1	192.168.2.16	0x50a1	No error (0)	d2wcz8sc48ztgm.cloudfront.net		18.64.174.89	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.099483013 CET	1.1.1.1	192.168.2.16	0x50a1	No error (0)	d2wcz8sc48ztgm.cloudfront.net		18.64.174.11	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.099483013 CET	1.1.1.1	192.168.2.16	0x50a1	No error (0)	d2wcz8sc48ztgm.cloudfront.net		18.64.174.35	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.099483013 CET	1.1.1.1	192.168.2.16	0x50a1	No error (0)	d2wcz8sc48ztgm.cloudfront.net		18.64.174.128	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.141318083 CET	1.1.1.1	192.168.2.16	0x115d	No error (0)	sync-km.ads.yieldmo.com	sync.ads.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.141318083 CET	1.1.1.1	192.168.2.16	0x115d	No error (0)	sync.ads.yieldmo.com	syncelb-240036109.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.141318083 CET	1.1.1.1	192.168.2.16	0x115d	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		34.224.234.201	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.141318083 CET	1.1.1.1	192.168.2.16	0x115d	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		23.22.194.15	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.141318083 CET	1.1.1.1	192.168.2.16	0x115d	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		3.225.53.72	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.141318083 CET	1.1.1.1	192.168.2.16	0x115d	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		52.207.106.121	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.141318083 CET	1.1.1.1	192.168.2.16	0x115d	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		3.222.212.19	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.141318083 CET	1.1.1.1	192.168.2.16	0x115d	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		44.219.168.194	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.145256042 CET	1.1.1.1	192.168.2.16	0xc3ff	No error (0)	sync-km.ads.yieldmo.com	sync.ads.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.145256042 CET	1.1.1.1	192.168.2.16	0xc3ff	No error (0)	sync.ads.yieldmo.com	syncelb-240036109.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.550864935 CET	1.1.1.1	192.168.2.16	0xce63	No error (0)	sync.ex.co		34.194.40.200	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.550864935 CET	1.1.1.1	192.168.2.16	0xce63	No error (0)	sync.ex.co		35.170.238.198	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.550864935 CET	1.1.1.1	192.168.2.16	0xce63	No error (0)	sync.ex.co		52.4.176.158	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:36.663180113 CET	1.1.1.1	192.168.2.16	0x2ec0	No error (0)	1f2e7.v.fwmrm.net	g11v.fwgtm.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.693320990 CET	1.1.1.1	192.168.2.16	0x7e5e	No error (0)	1f2e7.v.fwmrm.net	g11v.fwgtm.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.709230900 CET	1.1.1.1	192.168.2.16	0x96a5	No error (0)	sync.outbrain.com	alldcs.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.709230900 CET	1.1.1.1	192.168.2.16	0x96a5	No error (0)	alldcs.outbrain.org	sadc1.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.709846973 CET	1.1.1.1	192.168.2.16	0x9b13	No error (0)	sync.outbrain.com	alldcs.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.709846973 CET	1.1.1.1	192.168.2.16	0x9b13	No error (0)	alldcs.outbrain.org	nydc1.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:36.709846973 CET	1.1.1.1	192.168.2.16	0x9b13	No error (0)	nydc1.outbrain.org		70.42.32.127	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.215693951 CET	1.1.1.1	192.168.2.16	0x1bdc	No error (0)	cm.g.doubleclick.net		142.250.189.130	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.217077017 CET	1.1.1.1	192.168.2.16	0x75fe	No error (0)	rtb-csync.smartadserver.com	rtb-csync-geo.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:37.217077017 CET	1.1.1.1	192.168.2.16	0x75fe	No error (0)	rtb-csync-usw1.smartadserver.com		23.83.76.73	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.217077017 CET	1.1.1.1	192.168.2.16	0x75fe	No error (0)	rtb-csync-usw1.smartadserver.com		23.83.76.74	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.217077017 CET	1.1.1.1	192.168.2.16	0x75fe	No error (0)	rtb-csync-usw1.smartadserver.com		23.83.76.90	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.217077017 CET	1.1.1.1	192.168.2.16	0x75fe	No error (0)	rtb-csync-usw1.smartadserver.com		23.83.76.106	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.217077017 CET	1.1.1.1	192.168.2.16	0x75fe	No error (0)	rtb-csync-usw1.smartadserver.com		23.83.76.89	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.217077017 CET	1.1.1.1	192.168.2.16	0x75fe	No error (0)	rtb-csync-usw1.smartadserver.com		23.83.76.57	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.217077017 CET	1.1.1.1	192.168.2.16	0x75fe	No error (0)	rtb-csync-usw1.smartadserver.com		23.83.76.58	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.217077017 CET	1.1.1.1	192.168.2.16	0x75fe	No error (0)	rtb-csync-usw1.smartadserver.com		23.83.76.105	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.217657089 CET	1.1.1.1	192.168.2.16	0x1cb	No error (0)	rtb-csync.smartadserver.com	rtb-csync-geo.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:37.263586998 CET	1.1.1.1	192.168.2.16	0x8773	No error (0)	s.amazon-adsystem.com		52.46.128.147	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.281002998 CET	1.1.1.1	192.168.2.16	0x9087	No error (0)	analytics.google.com	analytics-alv.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:37.281002998 CET	1.1.1.1	192.168.2.16	0x9087	No error (0)	analytics-alv.google.com		216.239.38.181	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.281002998 CET	1.1.1.1	192.168.2.16	0x9087	No error (0)	analytics-alv.google.com		216.239.34.181	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.281002998 CET	1.1.1.1	192.168.2.16	0x9087	No error (0)	analytics-alv.google.com		216.239.32.181	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.281002998 CET	1.1.1.1	192.168.2.16	0x9087	No error (0)	analytics-alv.google.com		216.239.36.181	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.281069040 CET	1.1.1.1	192.168.2.16	0x6c26	No error (0)	analytics.google.com	analytics-alv.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:37.620066881 CET	1.1.1.1	192.168.2.16	0xcccc	No error (0)	exchange.mediavine.com		34.200.69.89	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.620066881 CET	1.1.1.1	192.168.2.16	0xcccc	No error (0)	exchange.mediavine.com		44.214.247.189	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.620066881 CET	1.1.1.1	192.168.2.16	0xcccc	No error (0)	exchange.mediavine.com		52.22.5.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.620066881 CET	1.1.1.1	192.168.2.16	0xcccc	No error (0)	exchange.mediavine.com		52.203.134.163	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.620066881 CET	1.1.1.1	192.168.2.16	0xcccc	No error (0)	exchange.mediavine.com		3.230.74.156	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.620066881 CET	1.1.1.1	192.168.2.16	0xcccc	No error (0)	exchange.mediavine.com		3.226.96.193	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.621624947 CET	1.1.1.1	192.168.2.16	0x740b	No error (0)	prebid-s2s.media.net		34.107.148.139	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.647844076 CET	1.1.1.1	192.168.2.16	0x759	No error (0)	simage2.pubmatic.com	simage2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:37.647844076 CET	1.1.1.1	192.168.2.16	0x759	No error (0)	simage2v2.pubmnet.com	pug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:37.647844076 CET	1.1.1.1	192.168.2.16	0x759	No error (0)	pug-vac.pubmnet.com		8.28.7.83	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:37.648026943 CET	1.1.1.1	192.168.2.16	0x4390	No error (0)	simage2.pubmatic.com	simage2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:37.648026943 CET	1.1.1.1	192.168.2.16	0x4390	No error (0)	simage2v2.pubmnet.com	pug-njrpb.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.188055992 CET	1.1.1.1	192.168.2.16	0x1c37	No error (0)	sync.aniview.com	syncsc.aniview.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.188055992 CET	1.1.1.1	192.168.2.16	0x1c37	No error (0)	syncsc.aniview.com		96.46.186.182	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.189214945 CET	1.1.1.1	192.168.2.16	0xc62e	No error (0)	sync.aniview.com	syncsc.aniview.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.402437925 CET	1.1.1.1	192.168.2.16	0x3b98	No error (0)	analytics.avcdn.net	analytics.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.402437925 CET	1.1.1.1	192.168.2.16	0x3b98	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.402437925 CET	1.1.1.1	192.168.2.16	0x3b98	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.489551067 CET	1.1.1.1	192.168.2.16	0x34b9	No error (0)	analytics.avcdn.net	analytics.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.489551067 CET	1.1.1.1	192.168.2.16	0x34b9	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.489551067 CET	1.1.1.1	192.168.2.16	0x34b9	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.491219044 CET	1.1.1.1	192.168.2.16	0x4cc8	No error (0)	shepherd.avcdn.net	shepherd.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.491219044 CET	1.1.1.1	192.168.2.16	0x4cc8	No error (0)	shepherd.ff.avast.com	shepherd-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.491219044 CET	1.1.1.1	192.168.2.16	0x4cc8	No error (0)	shepherd-gcp.ff.avast.com		34.160.176.28	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.523817062 CET	1.1.1.1	192.168.2.16	0x9c3b	No error (0)	sync.intentiq.com		65.8.248.118	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.523817062 CET	1.1.1.1	192.168.2.16	0x9c3b	No error (0)	sync.intentiq.com		65.8.248.39	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.523817062 CET	1.1.1.1	192.168.2.16	0x9c3b	No error (0)	sync.intentiq.com		65.8.248.46	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.523817062 CET	1.1.1.1	192.168.2.16	0x9c3b	No error (0)	sync.intentiq.com		65.8.248.42	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.538043976 CET	1.1.1.1	192.168.2.16	0xdcf2	No error (0)	pr-bh.ybp.yahoo.com	ds-pr-bh.ybp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.538996935 CET	1.1.1.1	192.168.2.16	0x372b	No error (0)	pr-bh.ybp.yahoo.com	ds-pr-bh.ybp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.538996935 CET	1.1.1.1	192.168.2.16	0x372b	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		34.233.75.175	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.538996935 CET	1.1.1.1	192.168.2.16	0x372b	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		54.147.3.219	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.538996935 CET	1.1.1.1	192.168.2.16	0x372b	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		44.207.23.148	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.538996935 CET	1.1.1.1	192.168.2.16	0x372b	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		34.199.214.171	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.605532885 CET	1.1.1.1	192.168.2.16	0x7d5b	No error (0)	io.narrative.io		54.156.158.209	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.605532885 CET	1.1.1.1	192.168.2.16	0x7d5b	No error (0)	io.narrative.io		54.234.86.126	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.605532885 CET	1.1.1.1	192.168.2.16	0x7d5b	No error (0)	io.narrative.io		52.54.213.65	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.605532885 CET	1.1.1.1	192.168.2.16	0x7d5b	No error (0)	io.narrative.io		35.169.254.179	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.606117010 CET	1.1.1.1	192.168.2.16	0x96c0	No error (0)	a.audrte.com		34.251.97.118	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.606117010 CET	1.1.1.1	192.168.2.16	0x96c0	No error (0)	a.audrte.com		3.248.68.130	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.606117010 CET	1.1.1.1	192.168.2.16	0x96c0	No error (0)	a.audrte.com		52.16.120.138	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.606117010 CET	1.1.1.1	192.168.2.16	0x96c0	No error (0)	a.audrte.com		52.48.177.163	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.606117010 CET	1.1.1.1	192.168.2.16	0x96c0	No error (0)	a.audrte.com		54.154.2.209	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.606117010 CET	1.1.1.1	192.168.2.16	0x96c0	No error (0)	a.audrte.com		54.246.67.235	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.612205029 CET	1.1.1.1	192.168.2.16	0x298b	No error (0)	sync.richaudience.com		162.55.236.224	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.656429052 CET	1.1.1.1	192.168.2.16	0x15eb	No error (0)	image2.pubmatic.com	image2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.656429052 CET	1.1.1.1	192.168.2.16	0x15eb	No error (0)	image2v2.pubmnet.com	pug-sfo-bc.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.656429052 CET	1.1.1.1	192.168.2.16	0x15eb	No error (0)	pug-sfo-bc.pubmnet.com		104.36.113.107	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.656496048 CET	1.1.1.1	192.168.2.16	0xda3a	No error (0)	image2.pubmatic.com	image2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.656496048 CET	1.1.1.1	192.168.2.16	0xda3a	No error (0)	image2v2.pubmnet.com	pug-sfo-bc.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.796534061 CET	1.1.1.1	192.168.2.16	0xc000	No error (0)	dsum.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.796534061 CET	1.1.1.1	192.168.2.16	0xc000	No error (0)	dsum.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.796850920 CET	1.1.1.1	192.168.2.16	0x316c	No error (0)	dsum.casalemedia.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:38.797733068 CET	1.1.1.1	192.168.2.16	0xec9	No error (0)	us-u.openx.net		34.98.64.218	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.797733068 CET	1.1.1.1	192.168.2.16	0xec9	No error (0)	us-u.openx.net		35.244.159.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.800092936 CET	1.1.1.1	192.168.2.16	0x67fe	No error (0)	ce.lijit.com	ce-ue1.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.800092936 CET	1.1.1.1	192.168.2.16	0x67fe	No error (0)	ce-ue1.lijit.com	vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.800092936 CET	1.1.1.1	192.168.2.16	0x67fe	No error (0)	vap.lijit.com	nase.vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.800092936 CET	1.1.1.1	192.168.2.16	0x67fe	No error (0)	nase.vap.lijit.com		63.251.86.49	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.800092936 CET	1.1.1.1	192.168.2.16	0x67fe	No error (0)	nase.vap.lijit.com		63.251.86.51	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.800092936 CET	1.1.1.1	192.168.2.16	0x67fe	No error (0)	nase.vap.lijit.com		69.175.41.15	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.801109076 CET	1.1.1.1	192.168.2.16	0xd101	No error (0)	ce.lijit.com	ce-ue1.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.801109076 CET	1.1.1.1	192.168.2.16	0xd101	No error (0)	ce-ue1.lijit.com	vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.801109076 CET	1.1.1.1	192.168.2.16	0xd101	No error (0)	vap.lijit.com	nase.vap.lijit.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.801249981 CET	1.1.1.1	192.168.2.16	0x6d6b	No error (0)	dsum-sec.casalemedia.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:38.801505089 CET	1.1.1.1	192.168.2.16	0xeb02	No error (0)	dsum-sec.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.801505089 CET	1.1.1.1	192.168.2.16	0xeb02	No error (0)	dsum-sec.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.810874939 CET	1.1.1.1	192.168.2.16	0x50f	No error (0)	token.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.811408043 CET	1.1.1.1	192.168.2.16	0x6b2a	No error (0)	token.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.813606977 CET	1.1.1.1	192.168.2.16	0xe59f	No error (0)	onetag-sys.com		51.222.39.185	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.813606977 CET	1.1.1.1	192.168.2.16	0xe59f	No error (0)	onetag-sys.com		51.222.239.232	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.813606977 CET	1.1.1.1	192.168.2.16	0xe59f	No error (0)	onetag-sys.com		51.222.39.187	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.813606977 CET	1.1.1.1	192.168.2.16	0xe59f	No error (0)	onetag-sys.com		51.222.39.184	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.813606977 CET	1.1.1.1	192.168.2.16	0xe59f	No error (0)	onetag-sys.com		51.222.239.230	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.813606977 CET	1.1.1.1	192.168.2.16	0xe59f	No error (0)	onetag-sys.com		51.222.39.186	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.816042900 CET	1.1.1.1	192.168.2.16	0xe6ef	No error (0)	aa.agkn.com	d20qwf0wrdtevy.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.816042900 CET	1.1.1.1	192.168.2.16	0xe6ef	No error (0)	d20qwf0wrdtevy.cloudfront.net		18.239.225.41	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.816042900 CET	1.1.1.1	192.168.2.16	0xe6ef	No error (0)	d20qwf0wrdtevy.cloudfront.net		18.239.225.115	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.816042900 CET	1.1.1.1	192.168.2.16	0xe6ef	No error (0)	d20qwf0wrdtevy.cloudfront.net		18.239.225.97	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.816042900 CET	1.1.1.1	192.168.2.16	0xe6ef	No error (0)	d20qwf0wrdtevy.cloudfront.net		18.239.225.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.816090107 CET	1.1.1.1	192.168.2.16	0x1180	No error (0)	aa.agkn.com	d20qwf0wrdtevy.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.821110964 CET	1.1.1.1	192.168.2.16	0x9838	No error (0)	visitor-us-west-2.omnitagjs.com		44.231.162.210	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.821110964 CET	1.1.1.1	192.168.2.16	0x9838	No error (0)	visitor-us-west-2.omnitagjs.com		52.35.73.235	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.821110964 CET	1.1.1.1	192.168.2.16	0x9838	No error (0)	visitor-us-west-2.omnitagjs.com		54.200.95.152	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.821110964 CET	1.1.1.1	192.168.2.16	0x9838	No error (0)	visitor-us-west-2.omnitagjs.com		35.84.246.48	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.821110964 CET	1.1.1.1	192.168.2.16	0x9838	No error (0)	visitor-us-west-2.omnitagjs.com		44.236.142.66	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.821110964 CET	1.1.1.1	192.168.2.16	0x9838	No error (0)	visitor-us-west-2.omnitagjs.com		35.163.115.57	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.821110964 CET	1.1.1.1	192.168.2.16	0x9838	No error (0)	visitor-us-west-2.omnitagjs.com		54.148.50.154	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.821110964 CET	1.1.1.1	192.168.2.16	0x9838	No error (0)	visitor-us-west-2.omnitagjs.com		35.160.171.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.938270092 CET	1.1.1.1	192.168.2.16	0xf3fe	No error (0)	ads.pubmatic.com	pubmatic.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.939507008 CET	1.1.1.1	192.168.2.16	0xd1a8	No error (0)	ads.pubmatic.com	pubmatic.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.944293022 CET	1.1.1.1	192.168.2.16	0xa6df	No error (0)	aax-eu.amazon-adsystem.com		54.239.33.158	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.952472925 CET	1.1.1.1	192.168.2.16	0xe0e7	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.952670097 CET	1.1.1.1	192.168.2.16	0x5985	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.958749056 CET	1.1.1.1	192.168.2.16	0xbe11	No error (0)	match.deepintent.com	m.deepintent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.958749056 CET	1.1.1.1	192.168.2.16	0xbe11	No error (0)	m.deepintent.com		8.18.47.7	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.958749056 CET	1.1.1.1	192.168.2.16	0xbe11	No error (0)	m.deepintent.com		169.197.150.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.958749056 CET	1.1.1.1	192.168.2.16	0xbe11	No error (0)	m.deepintent.com		169.197.150.7	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.958749056 CET	1.1.1.1	192.168.2.16	0xbe11	No error (0)	m.deepintent.com		38.91.45.7	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.959208965 CET	1.1.1.1	192.168.2.16	0xb833	No error (0)	match.deepintent.com	m.deepintent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.963874102 CET	1.1.1.1	192.168.2.16	0xf07f	No error (0)	match.sharethrough.com	match-us-east-1-ecs.sharethrough.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:38.963874102 CET	1.1.1.1	192.168.2.16	0xf07f	No error (0)	match-us-east-1-ecs.sharethrough.com		23.20.118.237	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.963874102 CET	1.1.1.1	192.168.2.16	0xf07f	No error (0)	match-us-east-1-ecs.sharethrough.com		3.226.24.27	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.963874102 CET	1.1.1.1	192.168.2.16	0xf07f	No error (0)	match-us-east-1-ecs.sharethrough.com		54.80.149.98	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.963874102 CET	1.1.1.1	192.168.2.16	0xf07f	No error (0)	match-us-east-1-ecs.sharethrough.com		34.225.212.107	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.963874102 CET	1.1.1.1	192.168.2.16	0xf07f	No error (0)	match-us-east-1-ecs.sharethrough.com		107.20.39.164	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.963874102 CET	1.1.1.1	192.168.2.16	0xf07f	No error (0)	match-us-east-1-ecs.sharethrough.com		34.227.128.134	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.963874102 CET	1.1.1.1	192.168.2.16	0xf07f	No error (0)	match-us-east-1-ecs.sharethrough.com		3.213.124.140	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.963874102 CET	1.1.1.1	192.168.2.16	0xf07f	No error (0)	match-us-east-1-ecs.sharethrough.com		3.91.137.4	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:38.964478016 CET	1.1.1.1	192.168.2.16	0x136c	No error (0)	match.sharethrough.com	match-us-east-1-ecs.sharethrough.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.184453011 CET	1.1.1.1	192.168.2.16	0x1d0f	No error (0)	uipglob.semasio.net	uipglob.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.184717894 CET	1.1.1.1	192.168.2.16	0x9981	No error (0)	uipglob.semasio.net	uipglob.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.184717894 CET	1.1.1.1	192.168.2.16	0x9981	No error (0)	uipus.semasio.net		50.57.31.206	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.207948923 CET	1.1.1.1	192.168.2.16	0x7a01	No error (0)	ad-delivery.net		104.26.3.70	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.207948923 CET	1.1.1.1	192.168.2.16	0x7a01	No error (0)	ad-delivery.net		104.26.2.70	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.207948923 CET	1.1.1.1	192.168.2.16	0x7a01	No error (0)	ad-delivery.net		172.67.69.19	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.208408117 CET	1.1.1.1	192.168.2.16	0xaf6a	No error (0)	ad-delivery.net			65	IN (0x0001)	false
Dec 19, 2023 10:22:39.208550930 CET	1.1.1.1	192.168.2.16	0x29fb	No error (0)	crb.kargo.com		34.199.50.181	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.208550930 CET	1.1.1.1	192.168.2.16	0x29fb	No error (0)	crb.kargo.com		34.224.103.168	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.208550930 CET	1.1.1.1	192.168.2.16	0x29fb	No error (0)	crb.kargo.com		34.230.139.192	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.208550930 CET	1.1.1.1	192.168.2.16	0x29fb	No error (0)	crb.kargo.com		34.195.28.76	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.208550930 CET	1.1.1.1	192.168.2.16	0x29fb	No error (0)	crb.kargo.com		52.1.240.135	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.208550930 CET	1.1.1.1	192.168.2.16	0x29fb	No error (0)	crb.kargo.com		34.234.144.3	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.213109970 CET	1.1.1.1	192.168.2.16	0x814a	No error (0)	odr.mookie1.com	tagr-gcp-odr-use1.mookie1.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.213109970 CET	1.1.1.1	192.168.2.16	0x814a	No error (0)	tagr-gcp-odr-use1.mookie1.com		35.190.90.30	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.214176893 CET	1.1.1.1	192.168.2.16	0x399	No error (0)	odr.mookie1.com	tagr-gcp-odr-use1.mookie1.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.220659971 CET	1.1.1.1	192.168.2.16	0x7877	No error (0)	usersync.gumgum.com		3.213.224.199	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.220659971 CET	1.1.1.1	192.168.2.16	0x7877	No error (0)	usersync.gumgum.com		35.172.99.217	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.220659971 CET	1.1.1.1	192.168.2.16	0x7877	No error (0)	usersync.gumgum.com		54.87.127.173	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.220659971 CET	1.1.1.1	192.168.2.16	0x7877	No error (0)	usersync.gumgum.com		3.214.33.241	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.220659971 CET	1.1.1.1	192.168.2.16	0x7877	No error (0)	usersync.gumgum.com		52.207.45.55	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.221769094 CET	1.1.1.1	192.168.2.16	0x96f	No error (0)	qsearch-a.akamaihd.net	qsearch-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.222529888 CET	1.1.1.1	192.168.2.16	0xa6da	No error (0)	qsearch-a.akamaihd.net	qsearch-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.224133968 CET	1.1.1.1	192.168.2.16	0xa5ae	No error (0)	cs-server-s2s.yellowblue.io		52.0.247.215	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.224133968 CET	1.1.1.1	192.168.2.16	0xa5ae	No error (0)	cs-server-s2s.yellowblue.io		3.233.88.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.224133968 CET	1.1.1.1	192.168.2.16	0xa5ae	No error (0)	cs-server-s2s.yellowblue.io		3.84.70.71	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.224133968 CET	1.1.1.1	192.168.2.16	0xa5ae	No error (0)	cs-server-s2s.yellowblue.io		52.22.211.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.232007027 CET	1.1.1.1	192.168.2.16	0xc864	No error (0)	sync.spotim.market	sync.unoadsrv.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.232007027 CET	1.1.1.1	192.168.2.16	0xc864	No error (0)	sync.unoadsrv.com	sync-unosync-com.geodns.me		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.233267069 CET	1.1.1.1	192.168.2.16	0x80d5	No error (0)	sync.spotim.market	sync.unoadsrv.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.233267069 CET	1.1.1.1	192.168.2.16	0x80d5	No error (0)	sync.unoadsrv.com	sync-unosync-com.geodns.me		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.233267069 CET	1.1.1.1	192.168.2.16	0x80d5	No error (0)	sync-unosync-com.geodns.me		23.227.146.18	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.469084024 CET	1.1.1.1	192.168.2.16	0x3209	No error (0)	image4.pubmatic.com	image4-v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.469084024 CET	1.1.1.1	192.168.2.16	0x3209	No error (0)	image4-v2.pubmnet.com	spug-njrpb.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.469084024 CET	1.1.1.1	192.168.2.16	0x3209	No error (0)	spug-njrpb.pubmnet.com		162.248.18.34	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:39.469166994 CET	1.1.1.1	192.168.2.16	0x104	No error (0)	image4.pubmatic.com	image4-v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.469166994 CET	1.1.1.1	192.168.2.16	0x104	No error (0)	image4-v2.pubmnet.com	spug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.876111031 CET	1.1.1.1	192.168.2.16	0xe508	No error (0)	sync-tm.everesttech.net	sync.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.876111031 CET	1.1.1.1	192.168.2.16	0xe508	No error (0)	sync.tubemogul.com	syncf.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.876111031 CET	1.1.1.1	192.168.2.16	0xe508	No error (0)	syncf.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.876219034 CET	1.1.1.1	192.168.2.16	0x90a	No error (0)	sync-tm.everesttech.net	sync.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.876219034 CET	1.1.1.1	192.168.2.16	0x90a	No error (0)	sync.tubemogul.com	syncf.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:39.876219034 CET	1.1.1.1	192.168.2.16	0x90a	No error (0)	syncf.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:40.225459099 CET	1.1.1.1	192.168.2.16	0x100d	No error (0)	www.google.com		142.250.217.164	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.226289034 CET	1.1.1.1	192.168.2.16	0xfec6	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:40.237092972 CET	1.1.1.1	192.168.2.16	0xa521	No error (0)	ssum-sec.casalemedia.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:40.238010883 CET	1.1.1.1	192.168.2.16	0xf41a	No error (0)	ssum-sec.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.238010883 CET	1.1.1.1	192.168.2.16	0xf41a	No error (0)	ssum-sec.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.238095999 CET	1.1.1.1	192.168.2.16	0xda58	No error (0)	cdn.indexww.com		104.18.38.76	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.238095999 CET	1.1.1.1	192.168.2.16	0xda58	No error (0)	cdn.indexww.com		172.64.149.180	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.239372015 CET	1.1.1.1	192.168.2.16	0x894e	No error (0)	cdn.indexww.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:40.239887953 CET	1.1.1.1	192.168.2.16	0x2a73	No error (0)	s0.2mdn.net		142.250.217.230	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.240744114 CET	1.1.1.1	192.168.2.16	0x3c39	No error (0)	api.btloader.com		130.211.23.194	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.247116089 CET	1.1.1.1	192.168.2.16	0xd5eb	No error (0)	pixel.tapad.com		34.111.113.62	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.253962040 CET	1.1.1.1	192.168.2.16	0x4bdf	No error (0)	e.serverbid.com	x.serverbid.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:40.253962040 CET	1.1.1.1	192.168.2.16	0x4bdf	No error (0)	x.serverbid.com	exchange.consumabletv.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:40.253962040 CET	1.1.1.1	192.168.2.16	0x4bdf	No error (0)	exchange.consumabletv.com	cx.serverbid.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:40.253962040 CET	1.1.1.1	192.168.2.16	0x4bdf	No error (0)	cx.serverbid.com		159.89.246.130	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.254585981 CET	1.1.1.1	192.168.2.16	0x6131	No error (0)	e.serverbid.com	x.serverbid.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:40.254585981 CET	1.1.1.1	192.168.2.16	0x6131	No error (0)	x.serverbid.com	exchange.consumabletv.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:40.254585981 CET	1.1.1.1	192.168.2.16	0x6131	No error (0)	exchange.consumabletv.com	cx.serverbid.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488102913 CET	1.1.1.1	192.168.2.16	0x7955	No error (0)	rtb.gumgum.com		54.221.226.34	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488102913 CET	1.1.1.1	192.168.2.16	0x7955	No error (0)	rtb.gumgum.com		44.197.7.215	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488102913 CET	1.1.1.1	192.168.2.16	0x7955	No error (0)	rtb.gumgum.com		3.213.88.59	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488102913 CET	1.1.1.1	192.168.2.16	0x7955	No error (0)	rtb.gumgum.com		34.193.134.86	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488102913 CET	1.1.1.1	192.168.2.16	0x7955	No error (0)	rtb.gumgum.com		23.21.78.89	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488102913 CET	1.1.1.1	192.168.2.16	0x7955	No error (0)	rtb.gumgum.com		23.23.136.233	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488102913 CET	1.1.1.1	192.168.2.16	0x7955	No error (0)	rtb.gumgum.com		52.201.76.180	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488102913 CET	1.1.1.1	192.168.2.16	0x7955	No error (0)	rtb.gumgum.com		107.22.89.190	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.160.24	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.178.10	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.160.114	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.179.166	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.181.211	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.160.117	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.160.184	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.160.132	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.161.208	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.160.137	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.161.182	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.488404036 CET	1.1.1.1	192.168.2.16	0xa55a	No error (0)	ib.anycast.adnxs.com		68.67.160.26	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:40.489902973 CET	1.1.1.1	192.168.2.16	0x7b60	No error (0)	lexicon.33across.com		35.244.193.51	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.139241934 CET	1.1.1.1	192.168.2.16	0x7a55	No error (0)	cs.minutemedia-prebid.com	cs.digbearings.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.139689922 CET	1.1.1.1	192.168.2.16	0xa9da	No error (0)	cs.minutemedia-prebid.com	cs.digbearings.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.139689922 CET	1.1.1.1	192.168.2.16	0xa9da	No error (0)	cs.digbearings.com		3.84.70.71	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.139689922 CET	1.1.1.1	192.168.2.16	0xa9da	No error (0)	cs.digbearings.com		52.0.247.215	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.139689922 CET	1.1.1.1	192.168.2.16	0xa9da	No error (0)	cs.digbearings.com		3.233.88.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.139689922 CET	1.1.1.1	192.168.2.16	0xa9da	No error (0)	cs.digbearings.com		52.22.211.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.177669048 CET	1.1.1.1	192.168.2.16	0x8f9e	No error (0)	cs.yellowblue.io		3.233.88.120	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.177669048 CET	1.1.1.1	192.168.2.16	0x8f9e	No error (0)	cs.yellowblue.io		52.0.247.215	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.177669048 CET	1.1.1.1	192.168.2.16	0x8f9e	No error (0)	cs.yellowblue.io		52.22.211.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.177669048 CET	1.1.1.1	192.168.2.16	0x8f9e	No error (0)	cs.yellowblue.io		3.84.70.71	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.219927073 CET	1.1.1.1	192.168.2.16	0x79c5	No error (0)	thrtle.com		50.19.110.14	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.219927073 CET	1.1.1.1	192.168.2.16	0x79c5	No error (0)	thrtle.com		54.156.62.74	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.219927073 CET	1.1.1.1	192.168.2.16	0x79c5	No error (0)	thrtle.com		34.235.53.166	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.219927073 CET	1.1.1.1	192.168.2.16	0x79c5	No error (0)	thrtle.com		54.158.15.169	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.219927073 CET	1.1.1.1	192.168.2.16	0x79c5	No error (0)	thrtle.com		52.71.16.59	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.219927073 CET	1.1.1.1	192.168.2.16	0x79c5	No error (0)	thrtle.com		204.236.210.31	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.219927073 CET	1.1.1.1	192.168.2.16	0x79c5	No error (0)	thrtle.com		54.159.245.111	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.219927073 CET	1.1.1.1	192.168.2.16	0x79c5	No error (0)	thrtle.com		44.197.22.251	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.222300053 CET	1.1.1.1	192.168.2.16	0xacbc	No error (0)	ads.yieldmo.com	rw.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.222300053 CET	1.1.1.1	192.168.2.16	0xacbc	No error (0)	rw.yieldmo.com	us-east-1.world.rw.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.222300053 CET	1.1.1.1	192.168.2.16	0xacbc	No error (0)	us-east-1.world.rw.yieldmo.com	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.223561049 CET	1.1.1.1	192.168.2.16	0xc558	No error (0)	ads.yieldmo.com	rw.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.223561049 CET	1.1.1.1	192.168.2.16	0xc558	No error (0)	rw.yieldmo.com	us-east-1.world.rw.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.223561049 CET	1.1.1.1	192.168.2.16	0xc558	No error (0)	us-east-1.world.rw.yieldmo.com	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.223561049 CET	1.1.1.1	192.168.2.16	0xc558	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		3.210.17.75	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.223561049 CET	1.1.1.1	192.168.2.16	0xc558	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		54.198.206.35	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.223561049 CET	1.1.1.1	192.168.2.16	0xc558	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		18.235.42.252	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.223561049 CET	1.1.1.1	192.168.2.16	0xc558	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		107.20.140.143	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.223561049 CET	1.1.1.1	192.168.2.16	0xc558	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		44.207.206.52	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.223561049 CET	1.1.1.1	192.168.2.16	0xc558	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		3.231.199.25	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.223561049 CET	1.1.1.1	192.168.2.16	0xc558	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		3.229.237.215	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.223561049 CET	1.1.1.1	192.168.2.16	0xc558	No error (0)	rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com		35.175.88.165	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.251219988 CET	1.1.1.1	192.168.2.16	0xdc7f	No error (0)	s2s.t13.io		34.107.140.113	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.253535986 CET	1.1.1.1	192.168.2.16	0xc1b3	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.253535986 CET	1.1.1.1	192.168.2.16	0xc1b3	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.254379034 CET	1.1.1.1	192.168.2.16	0x27c5	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.254379034 CET	1.1.1.1	192.168.2.16	0x27c5	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.282453060 CET	1.1.1.1	192.168.2.16	0x6094	No error (0)	match.sync.ad.cpe.dotomi.com	convex-rr.global.dual.dotomi.weighted.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.338392973 CET	1.1.1.1	192.168.2.16	0x6a69	No error (0)	synchroscript.deliveryengine.adswizz.com		13.32.87.73	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.338392973 CET	1.1.1.1	192.168.2.16	0x6a69	No error (0)	synchroscript.deliveryengine.adswizz.com		13.32.87.104	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.338392973 CET	1.1.1.1	192.168.2.16	0x6a69	No error (0)	synchroscript.deliveryengine.adswizz.com		13.32.87.20	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.338392973 CET	1.1.1.1	192.168.2.16	0x6a69	No error (0)	synchroscript.deliveryengine.adswizz.com		13.32.87.86	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.620716095 CET	1.1.1.1	192.168.2.16	0x4e66	No error (0)	sync1.intentiq.com		65.8.248.42	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.620716095 CET	1.1.1.1	192.168.2.16	0x4e66	No error (0)	sync1.intentiq.com		65.8.248.46	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.620716095 CET	1.1.1.1	192.168.2.16	0x4e66	No error (0)	sync1.intentiq.com		65.8.248.39	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.620716095 CET	1.1.1.1	192.168.2.16	0x4e66	No error (0)	sync1.intentiq.com		65.8.248.118	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.907835007 CET	1.1.1.1	192.168.2.16	0xef26	No error (0)	sync-km.ads.yieldmo.com	sync.ads.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.907835007 CET	1.1.1.1	192.168.2.16	0xef26	No error (0)	sync.ads.yieldmo.com	syncelb-240036109.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.907835007 CET	1.1.1.1	192.168.2.16	0xef26	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		44.219.168.194	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.907835007 CET	1.1.1.1	192.168.2.16	0xef26	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		3.225.53.72	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.907835007 CET	1.1.1.1	192.168.2.16	0xef26	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		3.222.212.19	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.907835007 CET	1.1.1.1	192.168.2.16	0xef26	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		52.207.106.121	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.907835007 CET	1.1.1.1	192.168.2.16	0xef26	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		34.224.234.201	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.907835007 CET	1.1.1.1	192.168.2.16	0xef26	No error (0)	syncelb-240036109.us-east-1.elb.amazonaws.com		23.22.194.15	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:41.908333063 CET	1.1.1.1	192.168.2.16	0x1ff	No error (0)	sync-km.ads.yieldmo.com	sync.ads.yieldmo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:41.908333063 CET	1.1.1.1	192.168.2.16	0x1ff	No error (0)	sync.ads.yieldmo.com	syncelb-240036109.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:42.314712048 CET	1.1.1.1	192.168.2.16	0x711a	No error (0)	pippio.com		107.178.254.65	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:42.758162022 CET	1.1.1.1	192.168.2.16	0x3b1d	No error (0)	bpi.rtactivate.com	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:42.758266926 CET	1.1.1.1	192.168.2.16	0x8eac	No error (0)	bpi.rtactivate.com	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:42.758266926 CET	1.1.1.1	192.168.2.16	0x8eac	No error (0)	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		18.215.67.38	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:42.758266926 CET	1.1.1.1	192.168.2.16	0x8eac	No error (0)	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		34.197.216.192	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:42.758266926 CET	1.1.1.1	192.168.2.16	0x8eac	No error (0)	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		44.193.120.159	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:42.758266926 CET	1.1.1.1	192.168.2.16	0x8eac	No error (0)	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com		3.93.251.5	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.015759945 CET	1.1.1.1	192.168.2.16	0x31cd	No error (0)	id.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.098215103 CET	1.1.1.1	192.168.2.16	0x3d2f	No error (0)	usr.undertone.com	evt.undertone.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.098215103 CET	1.1.1.1	192.168.2.16	0x3d2f	No error (0)	evt.undertone.com	d1wsawskf2klzj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.099056005 CET	1.1.1.1	192.168.2.16	0x6300	No error (0)	usr.undertone.com	evt.undertone.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.099056005 CET	1.1.1.1	192.168.2.16	0x6300	No error (0)	evt.undertone.com	d1wsawskf2klzj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.099056005 CET	1.1.1.1	192.168.2.16	0x6300	No error (0)	d1wsawskf2klzj.cloudfront.net		13.32.87.97	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.099056005 CET	1.1.1.1	192.168.2.16	0x6300	No error (0)	d1wsawskf2klzj.cloudfront.net		13.32.87.126	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.099056005 CET	1.1.1.1	192.168.2.16	0x6300	No error (0)	d1wsawskf2klzj.cloudfront.net		13.32.87.108	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.099056005 CET	1.1.1.1	192.168.2.16	0x6300	No error (0)	d1wsawskf2klzj.cloudfront.net		13.32.87.66	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.437412024 CET	1.1.1.1	192.168.2.16	0x2e29	No error (0)	hb.yahoo.net		23.193.106.169	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.437412024 CET	1.1.1.1	192.168.2.16	0x2e29	No error (0)	hb.yahoo.net		23.193.106.189	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.469886065 CET	1.1.1.1	192.168.2.16	0x239a	No error (0)	capi.connatix.com	capi.connatix.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.470276117 CET	1.1.1.1	192.168.2.16	0x94b6	No error (0)	capi.connatix.com	capi.connatix.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.633806944 CET	1.1.1.1	192.168.2.16	0x96e6	No error (0)	sync.ex.co		34.194.40.200	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.633806944 CET	1.1.1.1	192.168.2.16	0x96e6	No error (0)	sync.ex.co		35.170.238.198	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.633806944 CET	1.1.1.1	192.168.2.16	0x96e6	No error (0)	sync.ex.co		52.4.176.158	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.650449991 CET	1.1.1.1	192.168.2.16	0x83ba	No error (0)	sync.outbrain.com	alldcs.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.650449991 CET	1.1.1.1	192.168.2.16	0x83ba	No error (0)	alldcs.outbrain.org	nydc1.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.650449991 CET	1.1.1.1	192.168.2.16	0x83ba	No error (0)	nydc1.outbrain.org		70.42.32.223	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.650881052 CET	1.1.1.1	192.168.2.16	0x17e5	No error (0)	sync.outbrain.com	alldcs.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.650881052 CET	1.1.1.1	192.168.2.16	0x17e5	No error (0)	alldcs.outbrain.org	nydc1.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.684525013 CET	1.1.1.1	192.168.2.16	0x2a	No error (0)	events-ssc.33across.com		34.117.239.71	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.761805058 CET	1.1.1.1	192.168.2.16	0xa628	No error (0)	sync.crwdcntrl.net		44.211.9.18	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.761805058 CET	1.1.1.1	192.168.2.16	0xa628	No error (0)	sync.crwdcntrl.net		34.225.234.246	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.761805058 CET	1.1.1.1	192.168.2.16	0xa628	No error (0)	sync.crwdcntrl.net		54.209.94.68	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.761805058 CET	1.1.1.1	192.168.2.16	0xa628	No error (0)	sync.crwdcntrl.net		52.206.155.140	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.761805058 CET	1.1.1.1	192.168.2.16	0xa628	No error (0)	sync.crwdcntrl.net		44.193.54.186	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.761805058 CET	1.1.1.1	192.168.2.16	0xa628	No error (0)	sync.crwdcntrl.net		44.208.253.113	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.761805058 CET	1.1.1.1	192.168.2.16	0xa628	No error (0)	sync.crwdcntrl.net		52.204.77.239	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.761805058 CET	1.1.1.1	192.168.2.16	0xa628	No error (0)	sync.crwdcntrl.net		174.129.88.64	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.817935944 CET	1.1.1.1	192.168.2.16	0x4dc9	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.843358994 CET	1.1.1.1	192.168.2.16	0xfc7a	No error (0)	sync.aniview.com	syncsc.aniview.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.843358994 CET	1.1.1.1	192.168.2.16	0xfc7a	No error (0)	syncsc.aniview.com		96.46.186.182	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.845063925 CET	1.1.1.1	192.168.2.16	0xa6c7	No error (0)	sync.aniview.com	syncsc.aniview.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:43.849832058 CET	1.1.1.1	192.168.2.16	0xb68	No error (0)	bcp.crwdcntrl.net		44.193.54.186	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.849832058 CET	1.1.1.1	192.168.2.16	0xb68	No error (0)	bcp.crwdcntrl.net		34.225.234.246	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.849832058 CET	1.1.1.1	192.168.2.16	0xb68	No error (0)	bcp.crwdcntrl.net		44.211.9.18	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.849832058 CET	1.1.1.1	192.168.2.16	0xb68	No error (0)	bcp.crwdcntrl.net		3.208.124.249	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.849832058 CET	1.1.1.1	192.168.2.16	0xb68	No error (0)	bcp.crwdcntrl.net		44.220.113.151	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.849832058 CET	1.1.1.1	192.168.2.16	0xb68	No error (0)	bcp.crwdcntrl.net		52.204.77.239	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.849832058 CET	1.1.1.1	192.168.2.16	0xb68	No error (0)	bcp.crwdcntrl.net		54.209.94.68	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:43.849832058 CET	1.1.1.1	192.168.2.16	0xb68	No error (0)	bcp.crwdcntrl.net		52.206.155.140	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.356578112 CET	1.1.1.1	192.168.2.16	0x29	No error (0)	exchange.mediavine.com		52.22.5.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.356578112 CET	1.1.1.1	192.168.2.16	0x29	No error (0)	exchange.mediavine.com		44.214.247.189	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.356578112 CET	1.1.1.1	192.168.2.16	0x29	No error (0)	exchange.mediavine.com		34.200.69.89	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.356578112 CET	1.1.1.1	192.168.2.16	0x29	No error (0)	exchange.mediavine.com		52.203.134.163	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.356578112 CET	1.1.1.1	192.168.2.16	0x29	No error (0)	exchange.mediavine.com		3.230.74.156	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.356578112 CET	1.1.1.1	192.168.2.16	0x29	No error (0)	exchange.mediavine.com		3.226.96.193	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.395416975 CET	1.1.1.1	192.168.2.16	0x6c89	No error (0)	sync.technoratimedia.com	adserver.technoratimedia.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:44.395638943 CET	1.1.1.1	192.168.2.16	0x71fb	No error (0)	sync.technoratimedia.com	adserver.technoratimedia.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:44.395638943 CET	1.1.1.1	192.168.2.16	0x71fb	No error (0)	adserver.technoratimedia.com		193.122.128.135	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.767817020 CET	1.1.1.1	192.168.2.16	0x2ec8	No error (0)	i6.liadm.com	idaas6.cph.liveintent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:44.767817020 CET	1.1.1.1	192.168.2.16	0x2ec8	No error (0)	idaas6.cph.liveintent.com		3.223.167.169	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.767817020 CET	1.1.1.1	192.168.2.16	0x2ec8	No error (0)	idaas6.cph.liveintent.com		34.205.128.181	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.767817020 CET	1.1.1.1	192.168.2.16	0x2ec8	No error (0)	idaas6.cph.liveintent.com		52.6.233.203	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:44.768403053 CET	1.1.1.1	192.168.2.16	0xdbd7	No error (0)	i6.liadm.com	idaas6.cph.liveintent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:46.095211029 CET	1.1.1.1	192.168.2.16	0x4e13	No error (0)	shepherd.avcdn.net	shepherd.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:46.095211029 CET	1.1.1.1	192.168.2.16	0x4e13	No error (0)	shepherd.ff.avast.com	shepherd-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:46.095211029 CET	1.1.1.1	192.168.2.16	0x4e13	No error (0)	shepherd-gcp.ff.avast.com		34.160.176.28	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:46.869148016 CET	1.1.1.1	192.168.2.16	0x4443	No error (0)	home.mcafee.com	home-r53.awsconsumer.mcafee.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:46.869148016 CET	1.1.1.1	192.168.2.16	0x4443	No error (0)	home-r53.awsconsumer.mcafee.com	home.mcafee.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:46.869148016 CET	1.1.1.1	192.168.2.16	0x4443	No error (0)	origin-home.mcafee.com	home-mcafee-prod-r53.awscommon.mcafee.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:46.869148016 CET	1.1.1.1	192.168.2.16	0x4443	No error (0)	home-mcafee-prod-r53.awscommon.mcafee.com	nlb-home-mcafee-7e003388d1151bba.elb.us-west-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:46.869148016 CET	1.1.1.1	192.168.2.16	0x4443	No error (0)	nlb-home-mcafee-7e003388d1151bba.elb.us-west-2.amazonaws.com		44.238.140.201	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:46.869148016 CET	1.1.1.1	192.168.2.16	0x4443	No error (0)	nlb-home-mcafee-7e003388d1151bba.elb.us-west-2.amazonaws.com		52.10.241.80	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:46.869148016 CET	1.1.1.1	192.168.2.16	0x4443	No error (0)	nlb-home-mcafee-7e003388d1151bba.elb.us-west-2.amazonaws.com		44.240.196.74	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.158696890 CET	1.1.1.1	192.168.2.16	0xad85	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.158763885 CET	1.1.1.1	192.168.2.16	0x6c60	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.158893108 CET	1.1.1.1	192.168.2.16	0xa280	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.159888029 CET	1.1.1.1	192.168.2.16	0x46cf	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.180355072 CET	1.1.1.1	192.168.2.16	0xf3cd	No error (0)	sadownload.mcafee.com	sadownload-r53.awsconsumer.mcafee.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.180355072 CET	1.1.1.1	192.168.2.16	0xf3cd	No error (0)	sadownload-r53.awsconsumer.mcafee.com	sadownload.mcafee.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.204502106 CET	1.1.1.1	192.168.2.16	0x5e3e	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.204642057 CET	1.1.1.1	192.168.2.16	0x5041	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.204682112 CET	1.1.1.1	192.168.2.16	0x4fe1	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.205338955 CET	1.1.1.1	192.168.2.16	0x2cb6	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.469230890 CET	1.1.1.1	192.168.2.16	0x8a22	No error (0)	x.dlx.addthis.com	dlx.addthis.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.469676018 CET	1.1.1.1	192.168.2.16	0x365c	No error (0)	x.dlx.addthis.com	dlx.addthis.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.860162973 CET	1.1.1.1	192.168.2.16	0x11c	No error (0)	analytics.apis.mcafee.com	mosaic-nova.apis.mcafee.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:47.860162973 CET	1.1.1.1	192.168.2.16	0x11c	No error (0)	mosaic-nova.apis.mcafee.com		54.149.12.26	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.860162973 CET	1.1.1.1	192.168.2.16	0x11c	No error (0)	mosaic-nova.apis.mcafee.com		44.227.203.172	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.860162973 CET	1.1.1.1	192.168.2.16	0x11c	No error (0)	mosaic-nova.apis.mcafee.com		54.68.232.22	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.860162973 CET	1.1.1.1	192.168.2.16	0x11c	No error (0)	mosaic-nova.apis.mcafee.com		34.209.243.51	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.860162973 CET	1.1.1.1	192.168.2.16	0x11c	No error (0)	mosaic-nova.apis.mcafee.com		52.34.217.174	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.860162973 CET	1.1.1.1	192.168.2.16	0x11c	No error (0)	mosaic-nova.apis.mcafee.com		44.231.52.75	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.860162973 CET	1.1.1.1	192.168.2.16	0x11c	No error (0)	mosaic-nova.apis.mcafee.com		54.201.31.72	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:47.860162973 CET	1.1.1.1	192.168.2.16	0x11c	No error (0)	mosaic-nova.apis.mcafee.com		54.148.233.107	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.022243023 CET	1.1.1.1	192.168.2.16	0xb9be	No error (0)	r.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.022243023 CET	1.1.1.1	192.168.2.16	0xb9be	No error (0)	r.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.022349119 CET	1.1.1.1	192.168.2.16	0x3121	No error (0)	r.casalemedia.com			65	IN (0x0001)	false
Dec 19, 2023 10:22:48.235585928 CET	1.1.1.1	192.168.2.16	0x91db	No error (0)	sync.springserve.com		52.11.223.203	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.235585928 CET	1.1.1.1	192.168.2.16	0x91db	No error (0)	sync.springserve.com		35.167.145.83	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.235585928 CET	1.1.1.1	192.168.2.16	0x91db	No error (0)	sync.springserve.com		52.43.31.22	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.235585928 CET	1.1.1.1	192.168.2.16	0x91db	No error (0)	sync.springserve.com		44.241.12.204	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.235585928 CET	1.1.1.1	192.168.2.16	0x91db	No error (0)	sync.springserve.com		34.221.175.241	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.235585928 CET	1.1.1.1	192.168.2.16	0x91db	No error (0)	sync.springserve.com		34.213.77.235	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.235585928 CET	1.1.1.1	192.168.2.16	0x91db	No error (0)	sync.springserve.com		52.39.193.18	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.235585928 CET	1.1.1.1	192.168.2.16	0x91db	No error (0)	sync.springserve.com		52.27.103.19	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:48.975655079 CET	1.1.1.1	192.168.2.16	0xc6c	No error (0)	dmp.adform.net	track.adformnet.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:48.976596117 CET	1.1.1.1	192.168.2.16	0xc5	No error (0)	dmp.adform.net	track.adformnet.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:49.285121918 CET	1.1.1.1	192.168.2.16	0x3495	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:49.285121918 CET	1.1.1.1	192.168.2.16	0x3495	No error (0)	googlehosted.l.googleusercontent.com		142.250.189.129	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:49.297355890 CET	1.1.1.1	192.168.2.16	0xa95f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:50.364944935 CET	1.1.1.1	192.168.2.16	0x26bc	No error (0)	analytics.avcdn.net	analytics.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:50.364944935 CET	1.1.1.1	192.168.2.16	0x26bc	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:50.364944935 CET	1.1.1.1	192.168.2.16	0x26bc	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:51.244899035 CET	1.1.1.1	192.168.2.16	0xf73d	No error (0)	analytics.avcdn.net	analytics.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:51.244899035 CET	1.1.1.1	192.168.2.16	0xf73d	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:51.244899035 CET	1.1.1.1	192.168.2.16	0xf73d	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:51.414988041 CET	1.1.1.1	192.168.2.16	0xbd98	No error (0)	shepherd.avcdn.net	shepherd.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:51.414988041 CET	1.1.1.1	192.168.2.16	0xbd98	No error (0)	shepherd.ff.avast.com	shepherd-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:51.414988041 CET	1.1.1.1	192.168.2.16	0xbd98	No error (0)	shepherd-gcp.ff.avast.com		34.160.176.28	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:52.473341942 CET	1.1.1.1	192.168.2.16	0x21e	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:52.473341942 CET	1.1.1.1	192.168.2.16	0x21e	No error (0)	www3.l.google.com		172.217.3.78	A (IP address)	IN (0x0001)	false
Dec 19, 2023 10:22:52.474591017 CET	1.1.1.1	192.168.2.16	0x7cd	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:52.627327919 CET	1.1.1.1	192.168.2.16	0xb5da	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:52.627526999 CET	1.1.1.1	192.168.2.16	0x6d76	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:52.628978968 CET	1.1.1.1	192.168.2.16	0x9d1b	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 10:22:52.629040956 CET	1.1.1.1	192.168.2.16	0xdf88	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49735	34.117.223.223	80	6772	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 10:22:10.165446997 CET	175	OUT	POST /cgi-bin/iavsevents.cgi HTTP/1.1 Connection: Keep-Alive Content-Type: iavs4/stats User-Agent: AVG Microstub/2.1 Content-Length: 268 Host: v7event.stats.avast.com
Dec 19, 2023 10:22:10.165496111 CET	268	OUT	Data Raw: 63 6f 6f 6b 69 65 3d 6d 6d 6d 5f 69 72 73 5f 70 70 69 5f 39 30 32 5f 34 35 31 5f 6f 0a 65 64 69 74 69 6f 6e 3d 31 35 0a 65 76 65 6e 74 3d 6d 69 63 72 6f 73 74 75 62 2d 73 74 61 72 74 0a 6d 69 64 65 78 3d 37 32 36 44 36 39 33 38 46 35 39 36 45 42 Data Ascii: cookie=mmm_irs_ppi_902_451_oedition=15event=microstub-startmidex=726D6938F596EB31095491F80CE541D51FBFD7EC8A6C63350874DEA10459EBACstat_session=6d11ded8-8432-4921-bfa3-224b760cd39estatsSendTime=1702977728os=win,10,0,2,19045,0,AMD64exe_ver
Dec 19, 2023 10:22:10.351335049 CET	96	IN	HTTP/1.1 204 No Content Server: nginx Date: Tue, 19 Dec 2023 09:22:10 GMT Via: 1.1 google
Dec 19, 2023 10:22:11.823843956 CET	175	OUT	POST /cgi-bin/iavsevents.cgi HTTP/1.1 Connection: Keep-Alive Content-Type: iavs4/stats User-Agent: AVG Microstub/2.1 Content-Length: 282 Host: v7event.stats.avast.com
Dec 19, 2023 10:22:11.823873043 CET	282	OUT	Data Raw: 63 6f 6f 6b 69 65 3d 6d 6d 6d 5f 69 72 73 5f 70 70 69 5f 39 30 32 5f 34 35 31 5f 6f 0a 65 64 69 74 69 6f 6e 3d 31 35 0a 65 76 65 6e 74 3d 6d 69 63 72 6f 73 74 75 62 2d 64 6f 77 6e 6c 6f 61 64 0a 6d 69 64 65 78 3d 37 32 36 44 36 39 33 38 46 35 39 Data Ascii: cookie=mmm_irs_ppi_902_451_oedition=15event=microstub-downloadmidex=726D6938F596EB31095491F80CE541D51FBFD7EC8A6C63350874DEA10459EBACstat_session=6d11ded8-8432-4921-bfa3-224b760cd39estatsSendTime=1702977760os=win,10,0,2,19045,0,AMD64exe_
Dec 19, 2023 10:22:12.017577887 CET	96	IN	HTTP/1.1 204 No Content Server: nginx Date: Tue, 19 Dec 2023 09:22:11 GMT Via: 1.1 google

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49719	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:20:40 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6mNgY56XXv3hE3S&MD=RF7XvtfV HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-19 09:20:40 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b0d6f84c-aeb9-4082-be93-56132448d17c MS-RequestId: 224a3ff7-3e16-4784-b487-57c8acde5bc1 MS-CV: iFOG4Ho6xUqgzMdy.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:20:39 GMT Connection: close Content-Length: 24490
2023-12-19 09:20:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-12-19 09:20:40 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49722	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:21:17 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6mNgY56XXv3hE3S&MD=RF7XvtfV HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-19 09:21:17 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 73e3dcef-786b-4744-9a10-85018eae88cb MS-RequestId: 9460430e-6a64-41d6-a80c-81091f53c661 MS-CV: 9+alryIsfkmz7pht.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:21:17 GMT Connection: close Content-Length: 25457
2023-12-19 09:21:17 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-12-19 09:21:17 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49723	18.64.171.94	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:21:52 UTC	233	OUT	POST /o HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 137 Host: d2e9lx3tt9d5g4.cloudfront.net
2023-12-19 09:21:52 UTC	137	OUT	Data Raw: 7b 22 70 72 76 22 3a 20 22 30 2e 31 22 2c 22 70 6c 76 22 3a 20 22 31 2e 33 36 2e 33 2e 38 36 39 37 22 2c 22 6c 22 3a 20 22 65 6e 22 2c 22 61 22 3a 20 22 53 6f 66 74 6f 6e 69 63 22 2c 22 69 22 3a 20 22 53 6f 66 74 6f 6e 69 63 5f 44 4c 4d 22 2c 22 73 22 3a 20 22 53 6f 66 74 6f 6e 69 63 5f 32 22 2c 22 75 22 3a 20 22 71 61 6b 2d 66 77 31 22 2c 22 6f 22 3a 20 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 22 7d Data Ascii: {"prv": "0.1","plv": "1.36.3.8697","l": "en","a": "Softonic","i": "Softonic_DLM","s": "Softonic_2","u": "qak-fw1","o": "10.0.19045.2006"}
2023-12-19 09:21:53 UTC	488	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 10992 Connection: close Server: awselb/2.0 Date: Tue, 19 Dec 2023 09:21:53 GMT x-true-request-id: cb9ead00-879d-4179-b913-7252655f62f1 x-robots-tag: none expires: Thu, 01 Jan 1970 00:00:00 GMT cache-control: no-cache X-Cache: Miss from cloudfront Via: 1.1 21b70c4727c36e560b23f2f5f3143daa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: aIwsihTLKP_sSv0YYAsFKYi5yZs4hoc2fGQWj1NbOXZdBaWfjiy5gA==
2023-12-19 09:21:53 UTC	10992	IN	Data Raw: 7b 22 76 22 3a 22 30 2e 31 22 2c 22 6c 22 3a 22 55 53 22 2c 22 69 22 3a 7b 22 63 75 22 3a 22 68 74 74 70 73 3a 2f 2f 67 73 66 2d 66 6c 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2f 64 34 39 2f 30 37 37 2f 61 33 32 38 39 61 65 33 35 39 36 66 32 36 39 30 31 31 66 62 61 38 35 66 33 31 36 33 30 37 34 32 38 35 2f 66 69 6c 65 3f 45 78 70 69 72 65 73 3d 31 37 30 32 33 35 37 30 31 31 26 53 69 67 6e 61 74 75 72 65 3d 34 30 66 65 63 34 66 66 30 62 39 32 30 63 35 34 62 64 61 64 32 63 35 39 66 30 30 38 66 61 30 65 65 33 38 62 30 61 34 36 26 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 26 46 69 6c 65 6e 61 6d 65 3d 66 69 6c 65 22 2c 22 63 74 22 3a 22 43 61 66 66 65 69 6e 65 22 2c 22 63 70 22 3a 22 68 74 74 70 Data Ascii: {"v":"0.1","l":"US","i":{"cu":"https://gsf-fl.softonic.com/d49/077/a3289ae3596f269011fba85f3163074285/file?Expires=1702357011&Signature=40fec4ff0b920c54bdad2c59f008fa0ee38b0a46&url=https://caffeine.softonic.com.br&Filename=file","ct":"Caffeine","cp":"http

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49724	18.64.171.94	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:21:53 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=bc1189d89650fd8ac52e4e43d04954686e91551b047aa47218ac02d253f25f93 User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 283 Host: d2e9lx3tt9d5g4.cloudfront.net
2023-12-19 09:21:53 UTC	283	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 33 31 32 31 39 31 30 32 32 35 32 5c 22 2c 5c 22 33 5c 22 3a 5c 22 53 6f 66 74 6f 6e 69 63 5c 22 2c 5c 22 34 5c 22 3a 5c 22 53 6f 66 74 6f 6e 69 63 5f 44 4c 4d 5c 22 2c 5c 22 35 5c 22 3a 5c 22 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 5c 22 2c 5c 22 32 32 5c 22 3a 5c 22 5c 22 2c 5c 22 36 5c 22 3a 5c 22 31 5c 22 2c 5c 22 37 5c 22 3a 5c 22 31 2e 33 36 2e 33 2e 38 36 39 37 5c 22 2c 5c 22 31 35 Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20231219102252\",\"3\":\"Softonic\",\"4\":\"Softonic_DLM\",\"5\":\"\",\"18\":\"\",\"19\":\"\",\"21\":\"\",\"22\":\"\",\"6\":\"1\",\"7\":\"1.36.3.8697\",\"15
2023-12-19 09:21:54 UTC	426	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Tue, 19 Dec 2023 09:21:54 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE X-Cache: Miss from cloudfront Via: 1.1 3abf9e228643312ffef5c3fbe5348f58.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: mZqyG9_O4ApqtKwGUt8bxZDHrxYQN-lxn0CLJG8Ae9kpbG1Noi3xWQ==
2023-12-19 09:21:54 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49725	18.64.171.94	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:21:54 UTC	147	OUT	GET /f/WebAdvisor/images/880/update2/EN.png HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: d2e9lx3tt9d5g4.cloudfront.net
2023-12-19 09:21:54 UTC	569	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 48005 Connection: close Last-Modified: Tue, 18 Oct 2022 09:03:09 GMT x-amz-meta-cb-modifiedtime: Tue, 18 Oct 2022 08:55:10 GMT x-amz-version-id: l3GTR27ysTx0MKu10tKYFsls5cdZDwbW Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 18 Dec 2023 19:41:45 GMT ETag: "5fd73821f3f097d177009d88dfd33605" X-Cache: Hit from cloudfront Via: 1.1 5888333a47f4bcb4270f45fea45f08bc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: x6UV7hc7ioJ3nYHWxDtKgJc-JVxv7oS7M1rWInJZo3IFmYsGXpOgiQ== Age: 49210
2023-12-19 09:21:54 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 bc 00 00 01 68 08 06 00 00 00 b5 fd 28 e7 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 bb 1a 49 44 41 54 78 5e ed fd 09 b8 6d 57 75 df 89 ee bd cf bd 92 e8 25 c0 20 82 9a 2b 74 05 a2 b1 11 76 c5 c1 46 ed 73 2a c6 4e 25 40 55 b9 82 93 72 81 d2 15 c4 76 80 4a 25 95 7c 69 90 ea bd 72 c5 f5 be 04 14 db 29 57 f2 f2 10 a9 2f 49 d9 49 0a 48 63 1b bf c4 ea c0 5d 70 10 6e b0 40 17 d4 12 0b 83 2d d1 a9 bb f7 9c fd e6 ef 9c fd bf 1a 67 9c 39 d7 5a 7b 9f bd 4f 73 f5 ff dd 6f de bd d6 5c 73 8e 39 c6 98 63 36 7b ed 75 f6 1e 19 63 8c 31 c6 18 63 8c 31 c6 18 63 8c 31 c6 18 63 8c 31 c6 18 63 8c 31 c6 18 63 Data Ascii: PNGIHDRh(sRGBgAMAapHYsIDATx^mWu% +tvFs*N%@UrvJ%\|ir)W/IIHc]pn@-g9Z{Oso\s9c6{uc1c1c1c1c1c
2023-12-19 09:21:54 UTC	16384	IN	Data Raw: d4 57 dc 0d 89 e5 f0 65 4d e7 1a b1 5e ad 2e f2 d1 09 bf 0d 69 23 97 a1 3e c7 5d 77 6c b8 4e 22 96 78 25 0e 6b be 22 4f b1 a2 3e 8a 7a 50 17 9f 90 8f af c8 8f d7 48 94 8f 71 86 ae f4 39 f9 42 e3 46 65 63 4c 20 03 62 79 81 7e e8 5e 6b bf 86 da a1 3c e5 9e 51 12 fd 8b 1c f2 f1 07 c7 f2 27 d4 da 8d fa 0d 69 37 fa 31 fa 82 36 5b 73 48 2c db 37 46 a4 3f 73 0a f5 fb 62 a6 0f da 43 de 47 4b 8a f6 73 47 90 bc cf 94 44 1b f8 4b 3a d2 1e 3a fe 68 49 f3 cc 1f b4 83 fe c4 2b f3 7e 9f 4f b9 c6 06 94 b6 7f ae 24 da fc 62 49 bf 5c 52 0d b5 2f bf 71 ae f6 78 ad f5 0b 50 8e a4 f8 a0 5c d4 3d c7 28 ba 22 3f a3 f6 79 ad d9 85 6c cd 41 c8 cb f3 51 66 e8 d8 88 ed 92 a2 7e b2 87 44 3e e3 20 fa 80 f2 f4 0b d7 bb fa 22 b6 41 7d c5 8d 64 b5 fc db ca 8f ed 72 0c 94 11 e8 22 f9 f2 Data Ascii: WeM^.i#>]wlN"x%k"O>zPHq9BFecL by~^k<Q'i716[sH,7F?sbCGKsGDK::hI+~O$bI\R/qxP\=("?ylAQf~D> "A}dr"
2023-12-19 09:21:55 UTC	15237	IN	Data Raw: b5 fc 56 d9 a1 3a e6 7e 64 30 a2 8f ce a3 6e e8 1c cb 22 3f f6 ad a0 6d 0d ee 98 28 9f fb 75 b7 20 af d6 8f f4 61 1c a4 22 db 9b cb d5 ae 63 a3 fa 4b fe 50 9b 99 9c 8f 7e bc 9b 96 3c 12 32 69 67 08 4c 4e d4 c1 77 35 6a fa e6 71 01 f1 4d 23 09 3d 95 27 5a 36 b5 20 96 72 3c 68 d3 1b c9 3a 92 28 97 75 04 f4 cf f5 a5 67 f6 99 62 2f c7 54 ce d7 79 24 eb 4e 42 ff a8 13 be af e9 4d 5d 8e 63 dc 10 17 b1 2c c7 59 0f 64 e7 58 cd f1 57 83 fa 59 0f 16 9c ac 07 fe e1 3c fb 43 f9 71 2c 67 db 6a fa d6 a8 e9 82 df 34 67 20 03 6a 6d 52 97 b2 b1 2e f3 0d ba 88 5a 3d 21 fd 48 9a c7 72 5c 2b fe 87 a2 8d 5a cd 66 f2 f2 d8 45 ff 5c 36 c7 52 9c 43 6b 76 08 95 89 71 3d 74 c3 ab f9 48 f5 6b b2 00 5d 73 3e 79 b5 38 cc 65 6a f2 60 48 fd cc a2 b1 3f cf 18 cc a0 0f 65 62 7f a1 07 f2 Data Ascii: V:~d0n"?m(u a"cKP~<2igLNw5jqM#='Z6 r<h:(ugb/Ty$NBM]c,YdXWY<Cq,gj4g jmR.Z=!Hr\+ZfE\6RCkvq=tHk]s>y8ej`H?eb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49726	18.64.171.94	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:21:55 UTC	145	OUT	GET /f/AVG_AV/images/1382/Award/zb/EN.png HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: d2e9lx3tt9d5g4.cloudfront.net
2023-12-19 09:21:56 UTC	537	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 46850 Connection: close Date: Tue, 19 Dec 2023 09:21:56 GMT Last-Modified: Wed, 29 Nov 2023 13:00:06 GMT ETag: "ddc88afcdf16b6e00f6181fe6b8ee8c1" x-amz-server-side-encryption: AES256 x-amz-version-id: PKxozkBXqJSCUA.wCMfn5Z6PKDz61v_F Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 84dbb1d289dde64b57ea4df7ce064c9e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: v842QbSmybYZF90f-N3yMLg5jk99dZUvuBlDL8gbRpmFtSj1kmtw5g==
2023-12-19 09:21:56 UTC	12792	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 23 00 00 01 18 08 06 00 00 00 8e 7f f6 42 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 b6 97 49 44 41 54 78 01 ed fd 07 80 1c c7 79 26 0c 3f 3d 61 77 36 cf 22 67 0c 40 90 04 23 16 0c 62 10 25 0c a8 2c 4b 22 28 cb 41 96 6d 2c ec 3b cb df f9 ce 00 2c 5b c1 ff dd 61 71 b2 4f 27 9d bf 03 70 3a ff 77 b2 7d e6 c2 96 2d 59 92 05 50 54 a2 02 31 90 48 51 8c 58 10 04 33 80 41 ce d8 d9 1c 26 f4 57 6f 75 d5 74 75 4f f7 84 dd d9 04 d4 43 36 ba bb ea ad b7 42 cf f6 fb f4 5b c9 80 86 86 46 f9 f8 e2 7a 13 1a 1a e5 e0 33 fb 0c 68 68 68 94 85 00 34 34 34 34 34 34 34 34 a6 10 9a 8c 68 68 54 86 24 34 34 4a 23 Data Ascii: PNGIHDR#BpHYssRGBgAMAaIDATxy&?=aw6"g@#b%,K"(Am,;,[aqO'p:w}-YPT1HQX3A&WoutuOC6B[Fz3hhh44444444hhT$44J#
2023-12-19 09:21:56 UTC	3034	IN	Data Raw: 1e 0c 46 90 a8 fb 68 e8 5f de 84 d1 54 03 83 75 9f 11 34 19 d1 d0 d0 d0 98 e1 90 9e 91 42 0f 89 65 44 1f b8 ef 6e 0c 0d 0d e3 c4 c9 d3 8e d8 40 80 19 1d c3 c3 0c f8 10 11 9e 87 eb 98 ee 44 84 13 28 e6 41 e0 b3 64 84 ec 92 c5 8b f0 e0 ba b7 f3 eb 8f 3e f4 41 bc 78 e0 25 1c 3f 71 2a af 2a 37 94 15 5d 12 06 24 01 a3 c3 64 1e 8c cc e9 5e 0c 3d 79 8a 07 90 d1 26 2f 43 2e 35 ca 89 41 be bb 4c 3d 44 58 6e 30 c3 bc 33 39 4b 1f f3 d4 d4 7f e8 3a ce 2e cc 91 1c 72 17 07 99 17 a3 06 35 b7 cf c5 e8 cb 97 10 64 06 bb f1 63 37 a0 fe 9d 4b f2 5e 0c 02 79 77 c0 8e dc e5 61 04 98 a7 21 74 63 14 35 6b 98 c7 82 64 98 07 62 84 79 26 0c e6 95 68 f8 d5 eb b9 e7 42 52 47 f2 a4 98 43 19 64 cf f4 73 42 91 6f 88 74 8e 7b 28 b2 17 87 39 31 e0 cf 94 c9 05 98 c7 87 ca c4 cb cd ce 46 Data Ascii: Fh_Tu4BeDn@D(Ad>Ax%?q**7]$d^=y&/C.5AL=DXn039K:.r5dc7K^ywa!tc5kdby&hBRGCdsBot{(91F
2023-12-19 09:21:56 UTC	12792	IN	Data Raw: 22 5e 31 d3 94 88 10 26 93 8c d0 57 2c bd 38 77 79 84 d3 cb 35 01 bb 1f 9d 5e aa 7e 2f 83 94 90 a9 36 88 88 50 37 47 a7 4f fc 71 58 33 3a 3a 51 1e b6 c0 ee 06 9a 48 ec 86 d5 7e 54 f6 4d a8 2e da 61 b5 f7 5e 71 74 c0 1e 80 b8 b3 4c 1d 44 94 1e 2d 12 9f 40 a1 7b 5b de 77 f9 a4 49 8a b3 5f 57 02 c5 53 9b a8 bf a3 18 ec f1 29 a5 0c 4d 4a 1c 71 57 19 dc f7 e3 c5 7e 58 cf 0d ae 3c 08 c7 7d d2 74 c2 fa 9b 21 83 9b 80 dd 16 74 76 d7 99 d0 06 fb 37 3b 15 06 b6 03 b6 37 84 8e 18 ec c1 9e 09 0f f9 b8 90 a1 ae 16 d9 d6 95 94 9b da 80 da 75 17 c6 06 f9 ec dd bf f1 38 aa fb ec ab 06 b7 e1 93 1b 8f d9 01 5e 97 9a 88 94 0e 51 c2 35 11 29 21 32 3e 22 42 c1 93 35 66 24 0e eb 05 b3 1d b6 bb 5c 1e 64 a8 e8 0f 9f 5e a2 d2 b8 48 17 3d 85 b9 dd e2 bb 60 bb 70 a5 ee 38 c6 8f 4e Data Ascii: "^1&W,8wy5^~/6P7GOqX3::QH~TM.a^qtLD-@{[wI_WS)MJqW~X<}t!tv7;7u8^Q5)!2>"B5f$\d^H=`p8N
2023-12-19 09:21:56 UTC	3592	IN	Data Raw: d0 de 34 d7 2e 88 84 c4 61 b9 d3 35 11 f1 46 02 76 97 10 81 be 9a 89 98 68 22 a2 31 63 60 cd a2 31 62 b0 1c 20 a2 33 86 96 5a 35 c4 6a ab 46 7e 2e 8d 99 0f b3 ba 67 ac 1d 5b 03 ca 3e 35 86 e3 ec 47 44 fc 50 a9 01 f2 d3 70 ad 76 cd b8 91 cd 89 e7 32 a9 44 84 22 cc 02 a1 69 48 44 38 34 19 99 fe d8 24 ce 49 68 f8 21 09 cb 0b 42 47 0c ba ad 34 66 22 d2 c1 38 9d ac ae 18 41 3f ac 45 55 8d fc 75 8e af 15 6a a8 6b 8c d0 4d 7e f5 55 07 ca 21 22 e3 37 40 f0 d1 70 2d 8f 11 71 a3 26 1c c6 b0 d7 b8 11 4c 24 11 29 bc 9e ae 44 84 a0 c9 c8 f4 47 12 1a 95 20 09 0d 8d 19 08 66 64 da d4 b5 c7 c5 8c 19 fb ad 2d e8 87 e1 9a 30 a3 92 10 ab cb c4 c7 f4 4e 84 01 f2 d1 a9 89 88 13 d9 5c d6 5f 85 fb ee 1a 24 22 84 99 b1 6b af 86 86 86 c6 d5 0e c3 5c e3 20 19 d2 3b 02 ab 6b 46 50 Data Ascii: 4.a5Fvh"1c`1b 3Z5jF~.g[>5GDPpv2D"iHD84$Ih!BG4f"8A?EUujkM~U!"7@p-q&L$)DG fd-0N\_$"k\ ;kFP
2023-12-19 09:21:56 UTC	12792	IN	Data Raw: b1 f1 09 5e 58 27 f2 90 e5 95 63 57 52 ca f1 90 c8 ab 0d e5 cd 0e d9 25 ca 44 a4 86 0c 59 54 d4 81 5e c6 7b 31 71 50 db 53 b6 37 95 a3 45 e4 4d 75 21 62 98 84 b7 41 a5 70 aa ab ec 9a a1 67 17 47 f9 46 9d d2 24 60 3f ff 14 4a 2f 26 e6 6e ab 18 2c b2 b4 15 de bf 89 72 20 9f 59 a7 b8 ae f4 37 a1 82 48 34 b5 83 6c 13 d2 15 87 b3 4b 85 f2 58 ee 91 96 da 3a 2a e2 25 d9 88 29 65 8a 29 b2 f4 ec 36 8b f0 ed b0 bb de bc 48 42 b5 90 80 55 27 fa bd c8 df 7f 5c 94 61 3d 2a 43 0c f6 df 8b fc cd d1 33 a4 7a 78 75 cd 56 1d 86 99 eb 32 85 47 c4 a0 59 bd 26 ad 85 06 bb 8f c3 10 23 49 88 6d 78 90 0e c7 34 df 62 f9 b8 3c 27 4f 3f fb 02 56 ad 5c ce 3d 15 cf bf 70 10 ad d1 16 1c 3f 79 12 b5 35 b5 8c 38 bc 81 05 8c a4 7c e7 7b 8f 63 64 78 84 19 a4 1c 82 cc 20 b5 46 a3 f8 c0 fb Data Ascii: ^X'cWR%DYT^{1qPS7EMu!bApgGF$`?J/&n,r Y7H4lKX:%)e)6HBU'\a=C3zxuV2GY&#Imx4b<'O?V\=p?y58\|{cdx F
2023-12-19 09:21:56 UTC	1848	IN	Data Raw: c1 07 1f c4 04 a3 9c 97 34 bd 3c e3 b0 bf c6 e8 da eb 65 d8 a6 84 d3 97 78 c2 47 1f 19 b9 35 8a be 75 b0 07 7a ee 13 61 9d b0 0c f4 0a 25 9d 57 9e 24 43 24 20 26 ee d7 14 a9 43 bb 72 df 0e 9b 00 1c 57 d2 c7 94 7c e2 b0 0c 2d 19 86 bd a2 4c 5e fa 37 8b 32 b8 3d 18 49 d8 5f e7 04 b5 4d 28 9c ea ba 1d 85 5d 4f 24 ff 08 c6 4e 44 76 c3 ee be 22 b4 c3 49 76 d6 28 65 a0 32 1d 28 ae 2e 3f 60 78 8b 92 3e 09 bb ac 31 45 56 25 17 94 46 76 bf 48 f9 36 d8 1b 1b b6 2b 3a 8a 19 d7 98 92 36 0a 6f 6f 59 27 ec 5d 96 01 bb ad 29 af fd 70 3e fb 35 ae f2 c6 3d ca b1 57 94 3d 26 ee a9 3d 4b b5 93 7c d6 49 71 ef ee 7a a2 e7 b2 13 f6 40 d6 a4 28 e7 7e 11 2f db 26 25 74 f9 75 5d 25 c5 39 0e bb dc 2a da a0 a1 71 8d 61 92 3c 23 36 11 09 b4 ae 82 d1 bc 1c b9 d3 bf 40 60 e1 3d c8 f5 Data Ascii: 4<exG5uza%W$C$ &CrW\|-L^72=I_M(]O$NDv"Iv(e2(.?`x>1EV%FvH6+:6ooY'])p>5=W=&=K\|Iqz@(~/&%tu]%9*qa<#6@`=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49728	199.232.194.133	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:03 UTC	267	OUT	GET /d49/077/a3289ae3596f269011fba85f3163074285/file?Expires=1702357011&Signature=40fec4ff0b920c54bdad2c59f008fa0ee38b0a46&url=https://caffeine.softonic.com.br&Filename=file HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: gsf-fl.softonic.com
2023-12-19 09:22:03 UTC	372	IN	HTTP/1.1 301 Forbidden (expired) Connection: close Content-Length: 0 Retry-After: 0 location: https://caffeine.softonic.com.br x-reason: Forbidden (expired) Accept-Ranges: bytes Date: Tue, 19 Dec 2023 09:22:03 GMT Via: 1.1 varnish X-Served-By: cache-pdk-kpdk1780047-PDK X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1702977724.500941,VS0,VE0 x-fastly-version: 73

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49729	35.227.233.104	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:04 UTC	104	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: caffeine.softonic.com.br
2023-12-19 09:22:04 UTC	1284	IN	HTTP/1.1 200 OK strict-transport-security: max-age=63072000; includeSubDomains; preload x-request-id: 5e636385-79cc-4842-abd9-0e0f9bd467ff vary: user-agent,accept-encoding content-language: pt-BR x-rendered-as: desktop x-detected-as: desktop x-page-id: app x-is-bot: false x-served-by: server-5496778787-5c6mq x-version: 1.6115.0 x-xss-protection: 1 x-frame-options: sameorigin x-content-type-options: nosniff permissions-policy: accelerometer=(), autoplay=(), camera=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=() content-security-policy: upgrade-insecure-requests referrer-policy: strict-origin-when-cross-origin cache-control: no-cache set-cookie: _usr_orgn=direct; Domain=softonic.com.br; Path=/ set-cookie: _swo_pos=37; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:04 GMT; Secure; Domain=softonic.com.br; Path=/ content-type: text/html; charset=utf-8 Content-Length: 322825 accept-ranges: bytes date: Tue, 19 Dec 2023 09:22:04 GMT x-envoy-upstream-service-time: 118 server: istio-envoy Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:04 UTC	1252	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 43 61 66 66 65 69 6e 65 20 2d 20 44 6f 77 6e 6c 6f 61 64 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 Data Ascii: <!DOCTYPE html><html lang="pt-BR"><head><meta charset="utf-8"><meta http-equiv="x-ua-compatible" content="ie=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Caffeine - Download</title><link rel="preconnect" href="https://s
2023-12-19 09:22:04 UTC	1252	IN	Data Raw: 31 36 33 65 63 39 66 35 66 61 2f 33 32 36 31 31 37 37 34 35 36 2f 63 61 66 66 65 69 6e 65 2d 6c 6f 67 6f 2e 70 6e 67 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 53 6f 66 74 6f 6e 69 63 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 72 74 69 63 6c 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 61 72 74 69 63 6c 65 3a 70 75 62 6c 69 73 68 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: 163ec9f5fa/3261177456/caffeine-logo.png"><meta property="og:url" content="https://caffeine.softonic.com.br"><meta property="og:site_name" content="Softonic"><meta property="og:type" content="article"><meta property="article:publisher" content="https://www
2023-12-19 09:22:04 UTC	401	IN	Data Raw: 72 74 79 3d 22 72 76 2d 63 6f 6e 74 65 6e 74 22 20 63 6f 6e 74 65 6e 74 3d 22 72 69 63 68 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 72 76 2d 68 6f 73 74 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 66 61 6c 73 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 72 76 2d 64 69 73 61 62 6c 65 2d 73 6c 6f 74 2d 74 79 70 65 2d 69 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 41 54 46 5f 4f 4f 50 5f 49 6e 74 65 72 73 74 69 74 69 61 6c 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 72 76 2d 70 61 67 65 2d 69 64 22 20 63 6f 6e 74 65 6e 74 3d 22 61 70 70 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 72 76 2d 61 70 70 2d 69 64 22 20 63 6f 6e 74 65 6e 74 3d 22 66 34 36 61 34 64 62 34 2d 39 36 64 34 2d 31 31 65 36 2d 62 32 31 35 2d 30 30 31 36 33 Data Ascii: rty="rv-content" content="rich"><meta property="rv-hosted" content="false"><meta property="rv-disable-slot-type-ids" content="ATF_OOP_Interstitial"><meta property="rv-page-id" content="app"><meta property="rv-app-id" content="f46a4db4-96d4-11e6-b215-00163
2023-12-19 09:22:04 UTC	1252	IN	Data Raw: 69 64 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 6e 64 6f 77 73 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 72 76 2d 63 61 74 65 67 6f 72 79 2d 69 64 22 20 63 6f 6e 74 65 6e 74 3d 22 75 74 69 6c 69 74 69 65 73 2d 74 6f 6f 6c 73 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 72 76 2d 64 65 76 65 6c 6f 70 65 72 2d 73 6c 75 67 22 20 63 6f 6e 74 65 6e 74 3d 22 7a 68 6f 72 6e 73 6f 66 74 77 61 72 65 22 3e 3c 73 63 72 69 70 74 20 63 6c 61 73 73 3d 22 73 63 72 69 70 74 2d 70 61 72 61 6d 73 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 20 6e 61 6d 65 3d 22 65 78 70 65 72 69 6d 65 6e 74 73 22 20 69 64 3d 22 65 78 70 65 72 69 6d 65 6e 74 73 2d 70 61 72 61 6d 73 22 3e 7b 22 65 78 70 65 72 69 6d 65 6e 74 73 22 3a 7b 22 75 73 Data Ascii: id" content="windows"><meta property="rv-category-id" content="utilities-tools"><meta property="rv-developer-slug" content="zhornsoftware"><script class="script-params" type="application/json" name="experiments" id="experiments-params">{"experiments":{"us
2023-12-19 09:22:04 UTC	1252	IN	Data Raw: 79 20 28 74 72 75 65 29 20 6f 72 20 74 6f 20 45 55 20 76 69 73 69 74 6f 72 73 20 6f 6e 6c 79 20 28 66 61 6c 73 65 29 0a 20 20 20 20 77 69 6e 64 6f 77 2e 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 20 20 2f 2f 20 45 6e 61 62 6c 65 20 61 6c 73 6f 20 43 43 50 41 20 66 6f 72 20 43 61 6c 69 66 6f 72 6e 69 61 20 76 69 73 69 74 6f 72 73 0a 20 20 20 20 77 69 6e 64 6f 77 2e 64 69 64 6f 6d 69 43 6f 6e 66 69 67 20 3d 20 7b 0a 20 20 20 20 20 20 72 65 67 75 6c 61 74 69 6f 6e 73 3a 20 7b 0a 20 20 20 20 20 20 20 20 63 63 70 61 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 65 6e 61 62 6c 65 64 3a 20 74 72 75 65 2c 0a 20 20 20 20 20 20 20 20 20 20 6c 73 70 61 3a 20 66 61 6c 73 65 2c 20 2f 2f 20 57 68 65 74 68 65 72 20 79 6f Data Ascii: y (true) or to EU visitors only (false) window.gdprAppliesGlobally = false; // Enable also CCPA for userfornia visitors window.didomiConfig = { regulations: { ccpa: { enabled: true, lspa: false, // Whether yo
2023-12-19 09:22:04 UTC	1252	IN	Data Raw: 2c 63 61 6c 6c 62 61 63 6b 3a 6e 7d 29 7d 7d 74 2e 73 74 75 62 3d 74 72 75 65 3b 66 75 6e 63 74 69 6f 6e 20 69 28 69 29 7b 69 66 28 21 77 69 6e 64 6f 77 5b 6e 5d 7c 7c 77 69 6e 64 6f 77 5b 6e 5d 2e 73 74 75 62 21 3d 3d 74 72 75 65 29 7b 72 65 74 75 72 6e 7d 69 66 28 21 69 2e 64 61 74 61 29 7b 72 65 74 75 72 6e 7d 76 61 72 20 61 3d 74 79 70 65 6f 66 20 69 2e 64 61 74 61 3d 3d 3d 22 73 74 72 69 6e 67 22 3b 76 61 72 20 65 3b 74 72 79 7b 65 3d 61 3f 4a 53 4f 4e 2e 70 61 72 73 65 28 69 2e 64 61 74 61 29 3a 69 2e 64 61 74 61 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 7d 69 66 28 65 5b 72 5d 29 7b 76 61 72 20 6f 3d 65 5b 72 5d 3b 77 69 6e 64 6f 77 5b 6e 5d 28 6f 2e 63 6f 6d 6d 61 6e 64 2c 6f 2e 70 61 72 61 6d 65 74 65 72 2c 66 75 6e 63 74 69 6f 6e 28 65 2c Data Ascii: ,callback:n})}}t.stub=true;function i(i){if(!window[n]\|\|window[n].stub!==true){return}if(!i.data){return}var a=typeof i.data==="string";var e;try{e=a?JSON.parse(i.data):i.data}catch(t){return}if(e[r]){var o=e[r];window[n](o.command,o.parameter,function(e,
2023-12-19 09:22:04 UTC	340	IN	Data Raw: 65 20 3d 20 74 2e 72 65 76 61 6d 70 2e 72 65 67 69 73 74 65 72 45 76 65 6e 74 54 69 6d 65 20 7c 7c 0a 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 71 75 65 75 65 43 6f 6d 6d 61 6e 64 28 27 72 65 67 69 73 74 65 72 45 76 65 6e 74 54 69 6d 65 27 2c 20 61 72 67 75 6d 65 6e 74 73 29 3b 0a 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 74 2e 72 65 76 61 6d 70 2e 64 69 73 70 6c 61 79 53 6c 6f 74 73 20 3d 20 74 2e 72 65 76 61 6d 70 2e 64 69 73 70 6c 61 79 53 6c 6f 74 73 20 7c 7c 0a 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 71 75 65 75 65 43 6f 6d 6d 61 6e 64 28 27 64 69 73 70 6c 61 79 44 65 66 65 72 72 65 64 53 6c 6f 74 73 27 2c 20 61 72 67 75 6d 65 6e 74 73 29 3b 0a 20 20 20 20 20 20 7d 3b 0a Data Ascii: e = t.revamp.registerEventTime \|\| function() { queueCommand('registerEventTime', arguments); }; t.revamp.displaySlots = t.revamp.displaySlots \|\| function () { queueCommand('displayDeferredSlots', arguments); };
2023-12-19 09:22:04 UTC	1252	IN	Data Raw: 6f 6d 6d 61 6e 64 28 27 67 65 74 46 50 56 61 6c 75 65 73 27 2c 20 61 72 67 75 6d 65 6e 74 73 29 3b 0a 20 20 20 20 20 20 7d 3b 0a 20 20 7d 29 28 77 69 6e 64 6f 77 29 3b 0a 20 20 77 69 6e 64 6f 77 2e 72 65 76 61 6d 70 2e 72 65 67 69 73 74 65 72 45 76 65 6e 74 54 69 6d 65 28 5b 27 73 74 61 72 74 4c 6f 61 64 69 6e 67 41 74 27 2c 20 44 61 74 65 2e 6e 6f 77 28 29 5d 29 3b 0a 20 20 77 69 6e 64 6f 77 2e 72 65 76 61 6d 70 2e 67 65 74 46 50 56 61 6c 75 65 73 28 66 75 6e 63 74 69 6f 6e 28 61 64 5f 73 65 73 73 69 6f 6e 5f 69 64 2c 20 70 76 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 Data Ascii: ommand('getFPValues', arguments); }; })(window); window.revamp.registerEventTime(['startLoadingAt', Date.now()]); window.revamp.getFPValues(function(ad_session_id, pv) { window.dataLayer = window.dataLayer \|\| []; window.dataLayer.push(
2023-12-19 09:22:04 UTC	1252	IN	Data Raw: 22 73 63 72 69 70 74 2d 70 61 72 61 6d 73 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 20 6e 61 6d 65 3d 22 72 73 63 70 22 3e 7b 22 61 70 70 50 6c 61 74 66 6f 72 6d 49 64 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 73 65 61 72 63 68 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 73 2f 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 63 6c 61 73 73 3d 22 73 63 72 69 70 74 2d 70 61 72 61 6d 73 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 20 6e 61 6d 65 3d 22 61 64 73 22 3e 7b 22 61 64 73 22 3a 7b 22 73 6c 6f 74 73 22 3a 7b 22 74 6f 70 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 62 61 72 22 3a 5b 7b 22 70 72 6f 76 69 64 65 72 22 3a 22 67 70 74 Data Ascii: "script-params" type="application/json" name="rscp">{"appPlatformId":"windows","searchUrl":"https://www.softonic.com.br/s/"}</script><script class="script-params" type="application/json" name="ads">{"ads":{"slots":{"top-notification-bar":[{"provider":"gpt
2023-12-19 09:22:04 UTC	1252	IN	Data Raw: 22 62 69 64 64 65 72 22 3a 22 6a 75 73 74 70 72 65 6d 69 75 6d 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 7a 6f 6e 65 22 3a 22 31 31 31 37 32 34 22 7d 7d 2c 7b 22 62 69 64 64 65 72 22 3a 22 6d 65 64 69 61 6e 65 74 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 63 69 64 22 3a 22 38 43 55 51 39 4b 4f 37 41 22 2c 22 63 72 69 64 22 3a 33 37 37 36 33 35 35 34 38 7d 7d 2c 7b 22 62 69 64 64 65 72 22 3a 22 70 75 62 6d 61 74 69 63 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 31 35 39 30 34 37 22 2c 22 61 64 53 6c 6f 74 22 3a 22 34 32 39 35 31 33 35 22 7d 7d 2c 7b 22 62 69 64 64 65 72 22 3a 22 72 69 63 68 61 75 64 69 65 6e 63 65 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 70 69 64 22 3a 5b 22 6d 57 35 4f 4f 55 50 44 67 4d 22 2c 22 30 6c 79 39 42 Data Ascii: "bidder":"justpremium","params":{"zone":"111724"}},{"bidder":"medianet","params":{"cid":"8CUQ9KO7A","crid":377635548}},{"bidder":"pubmatic","params":{"publisherId":"159047","adSlot":"4295135"}},{"bidder":"richaudience","params":{"pid":["mW5OOUPDgM","0ly9B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49730	18.64.171.94	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:05 UTC	142	OUT	GET /f/WebAdvisor/files/1248/saBSI.zip HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: d2e9lx3tt9d5g4.cloudfront.net
2023-12-19 09:22:05 UTC	555	IN	HTTP/1.1 200 OK Content-Type: application/zip Content-Length: 511969 Connection: close Last-Modified: Sun, 30 Jul 2023 09:47:50 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: htiTouKtadQKxxksEn6FwuYB7HLtU54U Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 18 Dec 2023 12:30:33 GMT ETag: "cd9c77bc5840af008799985f397fe1c3" X-Cache: Hit from cloudfront Via: 1.1 f67e277293be25b6a5aded0a2d6743ba.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: KUuaU2TGZ4kKKQ1JSKdTRmlPeto3aM_3HEhZIkhoQVJhPG7ZwkweRw== Age: 75093
2023-12-19 09:22:05 UTC	15829	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 07 59 fe 56 2a da 06 40 49 cf 07 00 68 be 11 00 09 00 00 00 73 61 42 53 49 2e 65 78 65 e4 9d 0f 5c 1b d5 1d c0 8f 96 36 69 0b 25 50 4a 03 0d 34 fc 69 1b 68 aa b1 7f 94 55 ea 62 a5 8a 15 6b 5a b1 a2 c3 2d 2a d6 b3 43 1b 2b 55 e6 70 46 db b9 60 a9 cb 5c e7 d8 86 1a 12 54 54 9c 69 c5 4a 5b b4 69 65 14 15 15 b5 db d0 b1 8d 39 e6 4e 65 0e b5 53 dc 98 ee fd de bb 77 f7 2e b9 5c 28 1d ed 3e 9f f5 a3 97 c7 bb df df f7 de dd 7b b9 f7 e5 b8 f8 4a 2f 37 99 e3 b8 78 f4 ff 57 5f 71 5c 3b 47 fe d9 b9 d8 ff 6c 71 1c 37 73 de fe 99 5c db b4 57 b3 db e3 4a 5f cd 2e e3 6f b8 c5 ec da b2 f9 fa 2d 57 df 68 be f6 ea 9b 6e da 5c 6d be e6 3a f3 96 ad 37 99 6f b8 c9 5c 7c c9 a5 e6 1b 37 57 5e 77 5a 62 e2 f4 3c d1 c6 f3 2d 7f fe c3 17 2f ed dc 49 ff Data Ascii: PKYV@IhsaBSI.exe\6i%PJ4ihUbkZ-C+UpF`\TTiJ[ie9NeSw.\(>{J/7xW_q\;Glq7s\WJ_.o-Whn\m:7o\\|7W^wZb<-/I
2023-12-19 09:22:06 UTC	16384	IN	Data Raw: cf 9b f1 ba 0a cf eb c4 71 57 93 b8 5d 24 6e 67 c1 c4 f0 bc 09 7b b4 79 de a1 dd aa 3c ef 35 af c5 e6 79 4d f0 f0 f3 c2 57 a2 f3 bc 65 41 d8 fc 68 29 45 eb bf 60 14 c0 e6 d3 6b d1 f4 ff 11 1c 9c dc 89 f1 bc f0 fd 44 df ee c1 f3 6f 43 be cc f3 7a 62 ce bf 13 c9 f3 ee 0c 6a f3 bc 37 06 b5 79 de 77 7a b4 79 de 76 3c 07 f4 e4 63 dc ab 1b 7d a0 8c db 63 4e cf 13 cd f3 fe f4 69 6d 9e f7 b6 a7 b5 79 de c1 57 d4 79 5e 01 67 3b 4a b2 1d 21 d9 0a 31 67 f0 93 c2 f3 36 ff 52 9b e7 dd fe 4b 6d 9e f7 e3 97 4f 90 e7 cd fd e5 49 e5 79 9b 0b 30 cf eb 2b 08 e3 79 bd 05 84 29 2f 38 19 3c ef e9 4f 69 f3 bc 49 4f 69 f3 bc b5 2f 85 f3 bc 21 7c 6b 3e 5a 40 88 71 92 4b a8 e0 d4 f0 bc eb 5a b5 79 de 33 5a 35 78 de a6 ee 70 9e d7 88 53 b3 92 d4 2c 24 35 63 c1 a9 e1 79 6f 7d 52 9b Data Ascii: qW]$ng{y<5yMWeAh)E`kDoCzbj7ywzyv<c}cNimyWy^g;J!1g6RKmOIy0+y)/8<OiIOi/!\|k>Z@qKZy3Z5xpS,$5cyo}R
2023-12-19 09:22:06 UTC	16384	IN	Data Raw: 91 e2 f0 b1 e5 83 d2 7c 0c c8 8d d3 f2 f4 28 ae 6c 34 ba eb 10 84 54 74 02 10 53 a4 82 fa 24 d4 32 e0 cb 3b 52 0e 3e f3 63 c6 82 90 67 06 b6 22 e4 63 74 69 1c be 32 76 cd 71 a3 21 9a e8 d0 04 64 e8 d3 49 68 04 57 ef f6 14 c1 7f bb 95 3e 61 92 4b 04 9c 66 f6 bc 32 06 24 e6 b5 47 38 6e eb 87 57 ea 05 1a 83 be de ef 33 78 d8 df 2d 9a 28 c7 dd 16 fa 18 00 1b f4 0b b4 44 dd 9e 80 a4 d0 dd 66 5e fe 97 9f f7 57 6e e0 e5 3f d9 d7 77 f9 12 39 7b 58 5d ec b3 91 42 21 b0 bd 64 0a 82 c0 23 44 e7 24 05 72 cc ec 13 fa 2e c4 87 3a 1f 81 4b e4 46 39 cf 02 54 68 be 08 df b2 47 fd 4b 60 bf 49 a6 bd f1 68 e3 62 af a2 51 60 7e 1c b5 eb 98 df ab 61 f1 dc aa df 92 f5 ed bd 82 d0 86 b0 23 e3 3f 79 bb 16 f8 a6 aa 33 7e d3 a4 49 80 48 82 04 ac 52 a5 42 9d 68 ab 16 8a b3 2c 55 5b Data Ascii: \|(l4TtS$2;R>cg"cti2vq!dIhW>aKf2$G8nW3x-(Df^Wn?w9{X]B!d#D$r.:KF9ThGK`IhbQ`~a#?y3~IHRBh,U[
2023-12-19 09:22:06 UTC	15363	IN	Data Raw: 77 93 00 f7 ea fb 23 e0 6e 8c 07 ee c0 fd 03 ae c4 70 e1 b0 3b 40 0e 70 57 cc 2b 16 b0 fc 78 ad 50 6c 27 03 71 41 f2 52 72 57 58 2e ee c8 bf d8 34 14 ec f2 05 ec 82 ab a2 b0 13 3e 39 0e 82 dc 93 a8 0a 97 a1 a7 a3 aa 15 8e 8b 59 bb a8 47 cd d4 4b f0 3f 79 89 10 13 b0 38 c2 53 1a f0 97 4e 10 a5 88 88 20 a9 70 de 8c 77 b3 1c 03 5f 55 ee 82 9d 81 ee b4 55 c9 59 d0 72 21 70 82 98 30 6c 89 bb 16 7e d7 53 e2 5e 58 ed 74 59 33 5b d8 4e 69 89 29 90 96 98 c1 71 94 ee 16 12 85 33 70 a7 f8 1d 17 b4 54 68 17 81 ff b0 dc c7 ff b6 26 02 0e 41 0f f5 9d c7 a1 a4 6d f5 f4 2e fc ae d3 65 ce 6c 31 7f 2c 9b c8 93 4d d4 aa 66 ad 92 50 1e 1a a3 1f d1 18 1b ef 2b 17 7b 94 8a 4a 51 a1 2e cb 54 60 13 5b 30 64 3b c2 e4 81 41 61 cd 92 2a 9a 8e a0 0d b2 8c c8 6b 04 4f 62 05 79 d8 68 Data Ascii: w#np;@pW+xPl'qARrWX.4>9YGK?y8SN pw_UUYr!p0l~S^XtY3[Ni)q3pTh&Am.el1,MfP+{JQ.T`[0d;Aa*kObyh
2023-12-19 09:22:06 UTC	16384	IN	Data Raw: f9 29 22 47 be f6 34 1a c4 d2 92 1f 9d 27 c8 51 5f c0 c9 91 d0 45 1e e6 99 8b f7 96 99 b8 a0 62 c7 89 30 f9 ca 9c 34 50 62 40 51 a5 4b 29 0b 97 52 96 cb 35 92 fc c6 40 12 d9 16 2b 98 20 68 f2 c5 28 1e fd ae bf d8 77 97 6a 24 19 63 23 92 24 9f 63 88 e8 3b 14 59 51 51 05 4f 3a 43 51 05 59 59 1a b5 09 02 50 06 4d 94 1b 13 d5 da af 13 49 52 51 c0 63 0b 9a 42 54 b1 81 2a 0b af 3c 13 aa 4c 78 5b a3 ca d4 8b 23 a9 b2 e7 a2 98 54 a9 21 aa bc ba 16 54 b9 29 4c 95 e1 9c 82 79 da 53 d3 93 21 aa dc 98 24 a8 f2 ee 14 4e 95 41 5d df b4 12 55 92 a2 a8 92 77 16 54 49 e2 54 f9 7e 46 0c aa bc 60 fd f7 a8 e2 b3 12 55 ee 71 18 a8 52 6f 8d 41 95 9b 1c 7d a8 92 64 a0 ca fe f4 7e a8 32 98 a8 32 fe 4c a8 f2 d0 41 8d 2a cd e3 22 a9 92 73 61 4c aa 7c 8f a8 92 ff 04 a8 b2 32 4c 95 Data Ascii: )"G4'Q_Eb04Pb@QK)R5@+ h(wj$c#$c;YQQO:CQYYPMIRQcBT<Lx[#T!T)LyS!$NA]UwTIT~F`UqRoA}d~22LA"saL\|2L
2023-12-19 09:22:06 UTC	16384	IN	Data Raw: 61 da 11 16 f1 ec f9 9c 60 6d f5 a6 8b a9 a5 7f f6 17 8b a1 7f e2 9b 46 5c d4 ac 31 89 45 4d f4 ec 20 4a ef 78 3d 28 3d e1 98 2e 16 b3 f0 2e 24 a1 1a 51 f2 a0 2e fc 7a 55 98 84 df f5 66 e1 77 57 34 17 7e bd 80 92 10 da 83 16 63 93 1a 82 ef 26 b0 c0 a0 c5 65 3c dc 13 61 f6 f5 b3 c4 8e 06 92 bf 5b d5 3e 92 7b 08 c9 a9 7d 80 e4 7d 06 92 af f7 69 81 e4 91 df e8 48 ce de 68 42 b2 af 19 c9 3f dd 42 8c 3a d9 8f 51 47 5f 0d a3 be d9 89 93 f4 fe 22 95 51 cb 55 46 9d a0 93 f6 64 83 51 09 e2 8f 91 02 13 05 f0 fc a2 ff ad 14 08 16 60 af 2b fa 09 a4 80 73 e1 cf d0 e8 57 94 04 9e 50 8e c2 b3 85 57 94 04 6f 7e 0f 70 bc 67 7e 4c b7 f4 13 f0 07 17 fe 14 dd 52 d3 91 03 ff 74 c1 ff b6 5b 1e 15 60 4b 16 fc 04 dd 72 15 c2 b9 a9 03 2f 3e 44 14 2f 26 ee ed 74 0c db 71 d4 7f 4e Data Ascii: a`mF\1EM Jx=(=..$Q.zUfwW4~c&e<a[>{}}iHhB?B:QG_"QUFdQ`+sWPWo~pg~LRt[`Kr/>D/&tqN
2023-12-19 09:22:06 UTC	16384	IN	Data Raw: 6a 94 b7 24 34 6a 1d 71 c2 61 88 24 bd 8e 80 4a ad 7b 0c 11 41 c8 fc d6 58 df bf d4 d5 e3 1d 27 54 5f 2d e2 c3 80 bd 6f f0 bc e7 38 51 fd 55 c4 2c 03 62 5f 26 6d 07 0c 95 23 a2 03 59 19 4d ad b4 05 e7 d3 3a d0 8d a3 2a d8 0b dc 99 4a d1 28 60 92 ba 63 bf 3f 3f a6 c4 55 b1 98 3f f9 b2 19 1b bd d7 8e d3 55 4d 72 12 ec 58 d3 bf 7e aa b6 e6 24 49 39 b1 05 b7 ae f1 e7 e8 e2 6b 1b e6 b8 e4 08 65 58 f6 5d d7 ad e8 b1 01 7f c0 1b 0e b5 32 5e 67 3d f5 cd 15 ea fc 23 28 c9 bf a6 cf 71 fb c9 b5 89 15 7c ee 34 a1 c6 e5 2f 14 ba 12 55 30 c7 4d 86 b8 d9 dc 72 cc 82 71 83 c6 39 4e 57 12 f9 23 7b c4 1c 50 d9 83 51 69 b4 ce ba 4a 03 1e ec ef c7 c9 a6 af 44 71 28 ac 04 61 6b 69 c6 eb e8 25 f0 80 00 80 d2 32 0e 53 b0 4b 5a 3b 6f c3 76 77 13 91 e8 32 b2 b5 eb 37 5d c5 6a 4e Data Ascii: j$4jqa$J{AX'T_-o8QU,b_&m#YM:*J(`c??U?UMrX~$I9keX]2^g=#(q\|4/U0Mrq9NW#{PQiJDq(aki%2SKZ;ovw27]jN
2023-12-19 09:22:06 UTC	16384	IN	Data Raw: a1 b6 d2 fc 25 3b d1 d6 2e 72 08 5d 9c c4 25 36 d3 9a 61 6f d0 29 83 d3 8b e3 f2 6e 1f c7 17 dd cc fa d6 ba 05 e0 00 10 cd a4 77 15 77 5c ba 4b dd ef 5f 6d ac 86 bf 30 18 29 80 1f 3d 08 7e b4 c3 5f 12 38 36 e8 28 65 2f 4c 46 97 13 d4 d6 6f 13 4b d8 be 03 9a d5 40 44 c1 4f 17 4d cf da cd 55 96 09 f8 82 da d5 91 bd 40 bf 5e e3 55 28 5b 6c 43 eb 2d 34 fd 83 cd c5 6e 58 ad 3f a5 11 7f 3e 0c a7 b8 0d fa 42 94 3f 84 0a c6 62 fb 6f a8 60 9e 1c 7b d9 ae cc 70 b1 e5 5f 8a 86 32 ce 3f 47 e5 55 26 3d 7d df 1c 3d ff cd 43 a1 1b 4e 1d 36 75 d3 ed 12 1b fc 92 94 6a 66 9c b5 90 8d 6a 47 42 61 08 42 3a 8c 01 e0 86 c8 91 d0 3c 5a 35 81 5a 43 4d f6 8e c5 58 09 11 f7 92 62 38 52 d8 6e c8 0e 48 b7 91 8c 35 a1 9d ee ec 7d 5f d8 7a 4e 02 f6 e5 ef b1 df 99 68 12 e9 7d ad 0b 6e Data Ascii: %;.r]%6ao)nww\K_m0)=~_86(e/LFoK@DOMU@^U([lC-4nX?>B?bo`{p_2?GU&=}=CN6ujfjGBaB:<Z5ZCMXb8RnH5}_zNh}n
2023-12-19 09:22:06 UTC	440	IN	Data Raw: 61 05 26 04 1d 2d b6 67 1b 28 69 c9 83 e7 9d c0 e8 15 5a cd 0e aa 8c ce 65 1e 58 9e 8e 9b e7 b1 f9 2e 9a 3d 29 be ea 84 fb e8 11 5a 55 ef 6a 9f 93 79 ca 2b 28 46 6e 11 e7 e1 f3 37 e8 6c 5f d1 02 b4 e0 13 66 00 7a fd 36 e7 4e 72 0b 93 06 b7 30 9e 1b b5 dc 9d 51 2e 61 3e d6 9c 1b 00 b1 f1 b9 21 c5 eb 8e 20 08 d3 06 46 fc 8b ec 11 75 8b 06 af fd bf 33 a1 5d 24 c8 00 ce 56 f2 48 e2 dc aa cd da 8c a8 b7 7e e7 b6 c0 f0 3c a5 4f a4 23 7b 48 22 3b 76 94 8e ec 5e 20 8b 47 20 7b 4c 3b 03 91 c2 6c db f6 ee 3b 46 49 1b 00 46 b5 12 3d 0e 54 07 fb bd 3a aa fd 34 50 06 85 fb d9 b6 bb 12 ee 03 99 80 32 10 27 a4 09 e3 bf 69 ce 6d 00 db b8 76 88 77 e3 91 2b 14 3f c2 82 18 00 9d 80 a9 59 bb a0 e5 6e 06 3b 35 6b eb 78 cc 69 d9 55 db 22 47 2b ae a8 eb 1c 47 6c 4f ef b3 02 db Data Ascii: a&-g(iZeX.=)ZUjy+(Fn7l_fz6Nr0Q.a>! Fu3]$VH~<O#{H";v^ G {L;l;FIF=T:4P2'imvw+?Yn;5kxiU"G+GlO
2023-12-19 09:22:06 UTC	12792	IN	Data Raw: 4e 17 90 32 f0 63 f8 2e 55 fc e6 84 ba df 90 3e ae 24 3d 13 5d b8 e7 10 d9 8f 51 8f 6c d3 72 37 15 c0 c1 6e d0 e0 08 96 9a a4 6e 82 02 f7 59 e3 fa 82 a5 5e 31 54 f3 d2 9f 28 82 cb 06 6d ca 08 0e fb b8 d5 9f ab 0f 76 13 9e 7c 17 d9 ca 17 6a 10 74 57 2a 6f 84 65 10 01 be 08 6e 9c a6 7d 26 ad 7c 0f 25 07 02 f4 26 32 94 c0 0f d6 92 44 71 a3 9f 3f d6 6d 7e 83 de ad 2e 31 b7 05 ad 73 92 db 21 79 89 ed 2f 07 68 7c 5b 21 75 14 80 24 5d db 37 ba a4 a8 40 db 1f 0e ae 13 b6 a4 21 44 da 94 1f 28 a7 95 6f 01 03 86 4a 4f be 7d 09 68 cb b0 b7 fc b9 15 50 6e aa c4 ba 9e cd 71 71 6a 43 5b 80 92 91 da cf 57 25 78 26 53 e0 9d 0f 2f e3 63 e2 d4 47 68 00 d8 01 4e fd 6b f2 64 94 f7 2e da 87 92 7b ac ea 56 ea 7c 15 bc 52 e5 e1 a8 a0 34 fd 3f bc 22 01 db 9e 1e 4d 2f 03 a3 3b 02 Data Ascii: N2c.U>$=]Qlr7nnY^1T(mv\|jtW*oen}&\|%&2Dq?m~.1s!y/h\|[!u$]7@!D(oJO}hPnqqjC[W%x&S/cGhNkd.{V\|R4?"M/;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49731	18.64.171.94	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:06 UTC	136	OUT	GET /f/AVG_AV/files/1319/avg.zip HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: d2e9lx3tt9d5g4.cloudfront.net
2023-12-19 09:22:07 UTC	555	IN	HTTP/1.1 200 OK Content-Type: application/zip Content-Length: 125405 Connection: close Date: Tue, 19 Dec 2023 02:21:26 GMT Last-Modified: Tue, 17 Oct 2023 08:25:24 GMT ETag: "56b0d3e1b154ae65682c167d25ec94a6" x-amz-server-side-encryption: AES256 x-amz-version-id: 7L8o.GLX1Vn.tHqh_TFMmsecTIZweR8e Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 365e59ad1bbb7b57baa147f2406c99bc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: JL_kBbDyQ5t8wu8HXkK0avN-kKsboGr6Aat1dzf9Wh9vKI1uYKWpHw== Age: 25242
2023-12-19 09:22:07 UTC	16384	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 c5 58 51 57 d0 61 0b d8 1f e9 01 00 b8 95 03 00 1c 00 00 00 61 76 67 5f 61 6e 74 69 76 69 72 75 73 5f 66 72 65 65 5f 73 65 74 75 70 2e 65 78 65 e4 5d 7f 7c 54 47 11 7f 97 1c c9 95 1e bc a3 4d 6a da 52 48 2d 56 ea d1 36 10 40 e8 01 0d 81 03 5a 09 bd 10 b8 a0 25 40 2d 8d e7 89 1a 93 3b 40 4b 28 e9 e5 2c cf c7 53 54 50 54 aa 54 ea 47 54 d4 a8 89 a4 48 e8 25 c1 fc 2a 42 42 51 d2 82 36 5a d4 97 26 da b4 a4 e1 80 34 e7 77 66 df fd 08 bf ac 1f fd 4f 5a ee ed db 9d 9d 9d 9d 99 dd 99 9d dd 7d e4 7d 6c bb 94 2c 49 92 19 7f 23 11 49 aa 95 c4 9f 1c e9 df ff c9 34 49 d2 e8 f1 07 47 4b d5 37 fc ee ce 5a d3 e2 df dd b9 cc f3 c9 b2 cc 92 d2 cf 7e a2 f4 b1 4f 67 3e fe d8 67 3e f3 59 5f e6 c7 9f c8 2c f5 7f 26 f3 93 9f c9 9c ff 48 41 e6 a7 3f Data Ascii: PKXQWaavg_antivirus_free_setup.exe]\|TGMjRH-V6@Z%@-;@K(,STPTTGTH%*BBQ6Z&4wfOZ}}l,I#I4IGK7Z~Og>g>Y_,&HA?
2023-12-19 09:22:07 UTC	16384	IN	Data Raw: 5f c5 5d 11 95 f4 c0 f9 6c b9 95 6e 28 fc 02 31 9f 64 47 90 ef f8 94 64 c1 6b 65 cd 4b 08 ba 3e 74 dc f7 1c 45 bd 18 b6 4f cd 38 16 38 67 75 dc 47 8a d6 cd 73 49 f4 71 04 ff 44 58 de b5 06 ce a5 3a ee fb 0d c2 f0 b4 65 0d bc 9b da ea 6e 5f 64 06 46 97 bb dd 3f 7d f3 b9 4e 4a b9 ef 01 2a 28 c5 4c 05 e5 a4 f9 37 28 9b b7 11 e2 d0 76 92 d5 e7 22 c7 57 ef 97 39 2a 46 d1 cb 63 6a f6 db 36 9f eb 05 44 f9 a2 86 94 04 35 6b 8e b2 79 17 67 ad a3 01 9d 6a 0e 34 df 8e 9b 55 d7 ba da cb af 21 c1 1d 57 69 16 b4 14 64 1e 92 fe 15 5a 56 8f aa ca 4a 36 f9 93 73 0a 70 34 b3 e1 fd f0 3d 66 72 fb 2c bf c1 a0 79 13 ef 84 4d 9d e3 be ef 9b 81 6e 49 bf e5 d9 cd 73 73 8a 7d c5 8e e0 1b 88 d8 bc de fa b5 bb 66 cf f7 67 06 ce 17 38 ee 53 f8 9e 79 7b 38 07 f3 89 6a c5 b7 38 3b d5 Data Ascii: _]ln(1dGdkeK>tEO88guGsIqDX:en_dF?}NJ(L7(v"W9Fcj6D5kygj4U!WidZVJ6sp4=fr,yMnIss}fg8Sy{8j8;
2023-12-19 09:22:07 UTC	16384	IN	Data Raw: ee 61 a2 f4 07 a9 51 b2 91 cf 00 7b 1b 60 b4 47 fa 1a de cf b1 15 49 a8 98 cf 20 4e ac 7d 46 12 76 ec 06 2e 91 c3 ee 17 8c 82 a5 57 e5 a5 a0 83 5c 4f 99 44 b3 02 ed 4b 49 c6 48 e3 6b 20 68 dc 90 b7 2c ab 0d d3 d3 0b 6d 39 09 e4 55 1e 31 74 1c 32 87 74 1c 2e a5 e0 50 f5 a0 88 47 1e 1a c3 d0 dc ad 6a 5c 12 b3 be c6 59 2c 63 e3 e6 d8 62 c6 c6 ee a5 58 c2 52 d8 85 e4 26 c8 d0 c7 c9 ad 1d 33 bf e6 f1 af fe 98 79 32 ec 16 e6 80 26 9e 05 c2 26 5b 99 fa 09 a4 03 e3 0d 55 ab f0 36 1b f2 85 52 3e 27 05 1e ba 05 7e 2c 0b ce b2 b2 87 d6 c0 ad 8f 83 12 32 2c c0 80 f2 63 48 fc 21 8a 5b 8f 8e 80 45 6b 64 15 ff 36 71 a4 02 9c 59 a2 a7 10 71 b7 19 31 89 1b c9 32 26 f2 c0 d3 08 a7 02 1c 05 00 cd e9 8a 17 d0 c7 f0 51 51 de 45 1c f1 f7 c0 a4 59 3a 39 64 be ca 5d 01 d5 31 f2 Data Ascii: aQ{`GI N}Fv.W\ODKIHk h,m9U1t2t.PGj\Y,cbXR&3y2&&[U6R>'~,2,cH![Ekd6qYq12&QQEY:9d]1
2023-12-19 09:22:07 UTC	16384	IN	Data Raw: 20 7e 30 de 7f 76 b2 6c 69 d8 67 bf bf 15 a4 3a ed 30 7d 8c 51 70 eb 8f cc 92 78 ef da d4 77 d9 ed fe 16 33 7c b6 83 32 93 27 db 26 1e 1c e8 9d d2 07 6b 4b 09 1c 73 f6 a5 44 ad 31 0d a2 63 16 3b cf c9 47 23 9e 72 0f dc 47 5d 73 a1 8e 85 d5 76 6d 3c 77 e7 33 2a 7a ce a1 0d c9 d4 b9 b2 4d 3e ea 68 09 f7 ef fd b1 40 1c 2d 40 54 48 c7 9e f3 24 bd b6 ea e9 2f a1 37 fc 8f 18 0c 42 85 f0 22 b6 c0 48 a4 41 a1 c3 75 27 c2 e5 d0 6f ba 6d 36 9e 44 b8 a8 9b 67 80 98 15 c8 bb 0f 09 b3 be 3b 06 fb c9 29 99 ae 0b cf 8d 67 cb 73 95 4b f8 a9 d6 eb 3f c2 0f 4f c8 ab e2 ec 84 df ad 21 a4 05 c9 6c ac e3 00 9f 64 ca ce de 5d ca ae b0 83 c7 ea 74 00 d6 92 81 9d c8 29 d5 59 08 33 57 a2 5e 28 60 8e ae ce 25 0f a2 d3 f1 c3 7e c2 dd ac 55 e7 53 c4 5c 87 ae 47 46 0b 82 1c d4 51 f5 Data Ascii: ~0vlig:0}Qpxw3\|2'&kKsD1c;G#rG]svm<w3*zM>h@-@TH$/7B"HAu'om6Dg;)gsK?O!ld]t)Y3W^(`%~US\GFQ
2023-12-19 09:22:07 UTC	16384	IN	Data Raw: 54 01 a5 a4 bd fe 68 af 38 6c b9 90 96 70 34 9d 49 8a 3d 4d fd 31 7f 27 f4 e1 7b 69 3f b6 66 35 5d 63 ac bf 02 e5 cf 0c 52 89 d1 41 aa be 45 d8 35 15 5e 84 1d 0e 3a 8d 69 64 50 ba a8 0a 4a d7 d7 3d 0b c3 be cf 62 9f 87 5a 37 cd 3c 00 62 af 93 e9 b5 43 7f 0f ad ab f9 3b 64 9d 76 4c fa 05 49 3f e2 e8 21 db ff 4c 17 f1 19 a6 06 a9 24 03 42 9e de 08 42 6d 2c b8 79 a7 af 1a 19 f4 ac 0b b4 3f c8 7f e3 68 e1 03 5a 50 d6 a6 e0 07 4b a9 91 a6 2b a6 4a d3 0d 7d f8 7b 2c 13 c5 1f 83 d2 e0 e3 fb da 68 61 4f 37 b2 ab fe 01 fc 1c b3 8b e5 d4 07 b4 8a ab eb a1 5f 1e 84 5d 48 9d fb 52 b0 f6 50 6d cd 99 41 55 af 8f 16 68 a6 54 b0 f4 91 9a bb e0 a7 1b 47 3d c4 51 f7 13 ce 32 c2 a1 21 a3 3d ad 08 e7 b4 a4 11 0f 09 c2 f4 72 bb 3e 57 76 fb 5d fa d4 14 4f 04 81 45 f8 45 b3 12 Data Ascii: Th8lp4I=M1'{i?f5]cRAE5^:idPJ=bZ7<bC;dvLI?!L$BBm,y?hZPK+J}{,haO7_]HRPmAUhTG=Q2!=r>Wv]OEE
2023-12-19 09:22:07 UTC	16384	IN	Data Raw: fe 54 3e f6 72 4e ad 0d 4f 2b 02 2e cc 2b 28 cb 69 36 be 55 3c 46 ea 1b de 79 f1 a1 e1 6f 7f 1d d4 ff ba ba e5 fa 0b fe 8e 7e 5f 1a 7f ba 31 df d4 68 44 49 9d 75 6f de d3 5d 68 e7 f8 d5 4d 1a fd 3b cd 47 a9 07 e9 93 db fd d9 d9 e5 db 48 db f6 3e df 74 fc a1 4d 64 fc fb 13 8e ac 6b 7c a7 ff 3c 8f 0e 8a 26 a9 fa 7e cd f4 4d ad a9 83 9d 5b 07 6c b6 8d 34 36 7f f4 f5 a9 85 6d bf 38 3e 2a 61 71 87 5e 6b 2e 4d 7e ac dd 14 75 25 73 d9 1a e5 b6 a8 47 bb 0f 6e 74 5f 38 60 e0 77 b6 c2 54 af 7d bf 3d 2c 6b 39 24 d2 a3 de 8e 9f 1e 34 1c de d0 29 e8 f2 e4 3f f5 38 fb 7e d3 11 95 2e be ef 09 67 9d 3e 9d b1 33 f3 c3 89 ea a7 3b 1a 8c 53 d7 86 f7 ea bf 39 37 71 df 30 a5 eb c2 9e b3 bb d9 2f 53 24 1b be dc a5 cd 50 de dd df 7a d9 8a db 89 8d f4 f6 8d 56 b4 7f d0 79 42 c3 Data Ascii: T>rNO+.+(i6U<Fyo~_1hDIuo]hM;GH>tMdk\|<&~M[l46m8>*aq^k.M~u%sGnt_8`wT}=,k9$4)?8~.g>3;S97q0/S$PzVyB
2023-12-19 09:22:07 UTC	16384	IN	Data Raw: e6 1b d3 f0 3c 7d f0 ef 4b 12 37 17 6a c9 c5 52 bb df 25 92 72 a7 c5 84 b1 41 c1 bd b1 af 12 b3 33 1a 3a df 08 7d 55 72 8a 34 6c ea 98 ce a0 de af 90 d6 a8 3f 92 56 f0 ed 07 da 13 6e f3 fc dd e5 9d 9e 39 c5 77 27 fb 24 4d b2 49 ed 43 d6 69 3a 64 99 ae 4f 16 e9 86 24 4e 37 26 51 86 19 99 67 8a 00 31 20 21 b3 2c 06 0b 40 ca cb 22 ce 91 92 05 60 39 5d 4a b2 5c 29 59 e7 5a 90 1d da cc 29 57 44 ae b9 a6 e4 91 6b 02 9b 60 44 c3 a6 eb d1 b8 82 be d4 57 7f 18 29 71 31 d4 be cd 54 52 ee bc 02 3a bf 47 e0 df 53 d1 5f b5 c1 bd df 31 d2 d0 3f 41 1a e6 27 49 c3 fa 2c 69 38 83 bb f7 4f a4 35 e2 06 e3 4e da e1 77 1f 68 47 dc e5 f9 bb c8 3b 9e 70 88 53 21 9b 44 0d b2 4e e9 4d b2 d4 01 64 91 36 88 24 e0 2f 4a 37 21 73 f0 37 cb 10 91 19 f8 0b 90 00 8c 3f da 01 10 43 1e 09 Data Ascii: <}K7jR%rA3:}Ur4l?Vn9w'$MICi:dO$N7&Qg1 !,@"`9]J\)YZ)WDk`DW)q1TR:GS_1?A'I,i8O5NwhG;pS!DNMd6$/J7!s7?C
2023-12-19 09:22:07 UTC	10717	IN	Data Raw: 45 cd a0 9e a7 5e a7 de a2 4e 51 37 91 63 37 a0 5b d2 71 f4 00 da aa cc 8c a2 a7 23 2f 5a 87 0c 6f 1b bd 9b 3e 41 9f a3 fd 99 da 4c 3d a6 31 43 33 2a fc 60 2a 93 c1 64 33 33 99 67 c1 c5 6d cc 6e 58 c2 f3 cc 8f 4c 7d f6 7e b6 15 1b 81 ec e3 71 f6 05 44 4b af 40 e2 0f b1 57 d9 db 6c 0d ee 7e ae 3d a7 c1 de 75 e3 32 b9 31 dc 74 6e 3d b7 13 f2 9a c3 97 c0 de 7c c6 7f c5 fb 0b 35 05 46 90 85 01 c2 c3 b0 3a 33 84 bd 88 1a c2 44 52 2c 14 a7 8b 0b 91 21 6e 43 cc 7c 4a fc 0b 5e 19 6b 24 45 48 b2 94 80 8c ec 71 78 97 e5 d0 9b d1 ca 0e 65 81 6a aa ed b5 41 90 cf 1f 21 a1 d1 fa 2a fd 5d fd 43 44 8d 57 61 03 bb 1b 85 88 73 b7 c3 5e 9d 33 88 5d 7e 84 6a 3d b5 20 47 c2 1a 8e 85 ed 78 1f 91 ed 29 f2 5b 32 10 f1 61 3c dd 87 ce 44 0e b2 86 fe 94 7e 8f f9 91 4b 12 87 88 6f Data Ascii: E^NQ7c7[q#/Zo>AL=1C3`d33gmnXL}~qDK@Wl~=u21tn=\|5F:3DR,!nC\|J^k$EHqxejA!*]CDWas^3]~j= Gx)[2a<D~Ko

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49732	18.64.171.94	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:09 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=bc1189d89650fd8ac52e4e43d04954686e91551b047aa47218ac02d253f25f93 User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 385 Host: d2e9lx3tt9d5g4.cloudfront.net
2023-12-19 09:22:09 UTC	385	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 33 31 32 31 39 31 30 32 32 35 32 5c 22 2c 5c 22 33 5c 22 3a 5c 22 53 6f 66 74 6f 6e 69 63 5c 22 2c 5c 22 34 5c 22 3a 5c 22 53 6f 66 74 6f 6e 69 63 5f 44 4c 4d 5c 22 2c 5c 22 35 5c 22 3a 5c 22 57 65 62 41 64 76 69 73 6f 72 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5a 42 5f 57 65 62 41 64 76 69 73 6f 72 5f 53 6f 66 74 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 31 31 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 7c 7c 5c 22 2c 5c 22 32 32 5c 22 3a 5c 22 43 61 66 66 65 69 6e 65 5c Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20231219102252\",\"3\":\"Softonic\",\"4\":\"Softonic_DLM\",\"5\":\"WebAdvisor\",\"18\":\"ZB_WebAdvisor_Soft\",\"19\":\"11\",\"21\":\"\|\|\",\"22\":\"Caffeine\
2023-12-19 09:22:09 UTC	426	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Tue, 19 Dec 2023 09:22:09 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE X-Cache: Miss from cloudfront Via: 1.1 d178845d60baf589ab6db5ec371a50a0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: _rI0S2fForutc_7bMltFmoiOGbjTdEFXvEwJFzb3E7JHB3RZs-moWA==
2023-12-19 09:22:09 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49734	18.64.171.94	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:10 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=bc1189d89650fd8ac52e4e43d04954686e91551b047aa47218ac02d253f25f93 User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 383 Host: d2e9lx3tt9d5g4.cloudfront.net
2023-12-19 09:22:10 UTC	383	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 33 31 32 31 39 31 30 32 32 35 32 5c 22 2c 5c 22 33 5c 22 3a 5c 22 53 6f 66 74 6f 6e 69 63 5c 22 2c 5c 22 34 5c 22 3a 5c 22 53 6f 66 74 6f 6e 69 63 5f 44 4c 4d 5c 22 2c 5c 22 35 5c 22 3a 5c 22 41 56 47 5f 41 56 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5a 42 5f 41 56 47 5f 41 56 5f 41 77 61 72 64 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 31 31 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 7c 7c 5c 22 2c 5c 22 32 32 5c 22 3a 5c 22 43 61 66 66 65 69 6e 65 5c 22 2c 5c 22 36 5c 22 Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20231219102252\",\"3\":\"Softonic\",\"4\":\"Softonic_DLM\",\"5\":\"AVG_AV\",\"18\":\"ZB_AVG_AV_Award\",\"19\":\"11\",\"21\":\"\|\|\",\"22\":\"Caffeine\",\"6\"
2023-12-19 09:22:10 UTC	426	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Tue, 19 Dec 2023 09:22:10 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE X-Cache: Miss from cloudfront Via: 1.1 31d0f5402937d8e69db50160c44f0fc4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: CzXJXtF65QO6tw5ZQrhbelOdH7r4BAZvhhJPsOEJQzRa1LBPS6ux3w==
2023-12-19 09:22:10 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49733	35.167.194.178	443	4612	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:10 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 311 Host: analytics.apis.mcafee.com
2023-12-19 09:22:10 UTC	311	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a 22 57 49 4e 22 2c 22 4f 53 5f 50 6c 61 74 66 6f 72 6d 22 3a 22 36 34 22 2c 22 4f 53 5f 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 31 2e 31 38 38 39 22 2c 22 50 72 6f 64 75 63 74 5f 56 65 72 73 69 6f 6e 22 3a 22 34 2e 31 2e 31 2e 38 31 38 22 2c 22 55 55 49 44 22 3a 22 7b 43 32 36 43 45 32 39 30 2d 42 35 39 37 2d 34 46 44 37 2d 42 34 41 35 2d 37 44 32 39 32 39 30 42 44 39 35 41 7d 22 2c 22 65 61 22 3a 22 50 72 6f 63 65 73 73 22 2c 22 65 63 22 3a 22 42 6f 6f 74 53 74 72 61 70 49 6e 73 74 61 6c 6c 65 72 22 2c 22 65 6c 22 3a 22 53 74 61 72 74 65 64 22 Data Ascii: {"Data":{"Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":"WIN","OS_Platform":"64","OS_Version":"10.0.19041.1889","Product_Version":"4.1.1.818","UUID":"{C26CE290-B597-4FD7-B4A5-7D29290BD95A}","ea":"Process","ec":"BootStrapInstaller","el":"Started"
2023-12-19 09:22:10 UTC	304	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:10 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 133 Connection: close x-amz-id-2: eZV87WDjmhPg9AXn2e0EoSfVZWakK2387CffQ/dR+qQ7cBMTvHUleRYYHKJvcjZZMiynIenbR1C4yWdogwFzBt8DkMq+jfDf x-amzn-RequestId: fb97d960-1d74-d092-a66c-ba624ea52c60
2023-12-19 09:22:10 UTC	133	IN	Data Raw: 7b 22 45 6e 63 72 79 70 74 69 6f 6e 54 79 70 65 22 3a 22 4b 4d 53 22 2c 22 53 65 71 75 65 6e 63 65 4e 75 6d 62 65 72 22 3a 22 34 39 36 34 37 31 36 35 36 32 39 37 38 32 32 38 31 30 34 33 33 35 35 33 30 37 39 36 33 30 39 30 33 32 36 36 37 35 35 32 35 31 36 37 31 37 37 39 35 32 39 31 39 36 30 32 22 2c 22 53 68 61 72 64 49 64 22 3a 22 73 68 61 72 64 49 64 2d 30 30 30 30 30 30 30 30 30 30 30 33 22 7d Data Ascii: {"EncryptionType":"KMS","SequenceNumber":"49647165629782281043355307963090326675525167177952919602","ShardId":"shardId-000000000003"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49738	18.64.171.94	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:10 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=bc1189d89650fd8ac52e4e43d04954686e91551b047aa47218ac02d253f25f93 User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 378 Host: d2e9lx3tt9d5g4.cloudfront.net
2023-12-19 09:22:10 UTC	378	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 33 31 32 31 39 31 30 32 32 35 32 5c 22 2c 5c 22 33 5c 22 3a 5c 22 53 6f 66 74 6f 6e 69 63 5c 22 2c 5c 22 34 5c 22 3a 5c 22 53 6f 66 74 6f 6e 69 63 5f 44 4c 4d 5c 22 2c 5c 22 35 5c 22 3a 5c 22 43 61 66 66 65 69 6e 65 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 31 31 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 7c 7c 5c 22 2c 5c 22 32 32 5c 22 3a 5c 22 43 61 66 66 65 69 6e 65 5c 22 2c 5c 22 36 5c 22 3a 5c 22 33 5c 22 2c 5c 22 37 5c 22 3a Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20231219102252\",\"3\":\"Softonic\",\"4\":\"Softonic_DLM\",\"5\":\"Caffeine\",\"18\":\"\",\"19\":\"11\",\"21\":\"\|\|\",\"22\":\"Caffeine\",\"6\":\"3\",\"7\":
2023-12-19 09:22:10 UTC	426	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Tue, 19 Dec 2023 09:22:10 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE X-Cache: Miss from cloudfront Via: 1.1 84dbb1d289dde64b57ea4df7ce064c9e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: eDzZo6T5esr2-dij_k_G3o-pfacSw5EIrKEWpJeNMbzg6ts53TozWw==
2023-12-19 09:22:10 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49739	35.167.194.178	443	4612	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:11 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 311 Host: analytics.apis.mcafee.com
2023-12-19 09:22:11 UTC	311	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a 22 57 49 4e 22 2c 22 4f 53 5f 50 6c 61 74 66 6f 72 6d 22 3a 22 36 34 22 2c 22 4f 53 5f 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 31 2e 31 38 38 39 22 2c 22 50 72 6f 64 75 63 74 5f 56 65 72 73 69 6f 6e 22 3a 22 34 2e 31 2e 31 2e 38 31 38 22 2c 22 55 55 49 44 22 3a 22 7b 43 32 36 43 45 32 39 30 2d 42 35 39 37 2d 34 46 44 37 2d 42 34 41 35 2d 37 44 32 39 32 39 30 42 44 39 35 41 7d 22 2c 22 65 61 22 3a 22 49 6e 73 74 61 6c 6c 22 2c 22 65 63 22 3a 22 42 6f 6f 74 53 74 72 61 70 49 6e 73 74 61 6c 6c 65 72 22 2c 22 65 6c 22 3a 22 53 74 61 72 74 65 64 22 Data Ascii: {"Data":{"Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":"WIN","OS_Platform":"64","OS_Version":"10.0.19041.1889","Product_Version":"4.1.1.818","UUID":"{C26CE290-B597-4FD7-B4A5-7D29290BD95A}","ea":"Install","ec":"BootStrapInstaller","el":"Started"
2023-12-19 09:22:12 UTC	316	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:11 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 133 Connection: close x-amz-id-2: RCg1EarUk3bLZPoa7rui5OaNQmICnBDtpKb6GYhfcNURhOY4yMd5OBHg8x2qghq28g9EDlDNihH9WMTVxLhNM1OTvHDzitrc5ppm1beWlC0= x-amzn-RequestId: cf766ea7-0e62-0b86-928d-0da471873cc4
2023-12-19 09:22:12 UTC	133	IN	Data Raw: 7b 22 45 6e 63 72 79 70 74 69 6f 6e 54 79 70 65 22 3a 22 4b 4d 53 22 2c 22 53 65 71 75 65 6e 63 65 4e 75 6d 62 65 72 22 3a 22 34 39 36 34 37 31 36 35 36 32 39 37 38 32 32 38 31 30 34 33 33 35 35 33 30 37 39 36 34 31 38 34 34 30 34 35 34 32 32 37 36 34 30 36 36 34 39 37 38 31 34 38 35 36 31 38 22 2c 22 53 68 61 72 64 49 64 22 3a 22 73 68 61 72 64 49 64 2d 30 30 30 30 30 30 30 30 30 30 30 33 22 7d Data Ascii: {"EncryptionType":"KMS","SequenceNumber":"49647165629782281043355307964184404542276406649781485618","ShardId":"shardId-000000000003"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49740	18.64.171.94	443	5924	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:12 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=bc1189d89650fd8ac52e4e43d04954686e91551b047aa47218ac02d253f25f93 User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 313 Host: d2e9lx3tt9d5g4.cloudfront.net
2023-12-19 09:22:12 UTC	313	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 33 31 32 31 39 31 30 32 32 35 32 5c 22 2c 5c 22 33 5c 22 3a 5c 22 53 6f 66 74 6f 6e 69 63 5c 22 2c 5c 22 34 5c 22 3a 5c 22 53 6f 66 74 6f 6e 69 63 5f 44 4c 4d 5c 22 2c 5c 22 35 5c 22 3a 5c 22 72 75 6e 5f 62 75 74 74 6f 6e 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 31 31 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 7c 7c 5c 22 2c 5c 22 32 32 5c 22 3a 5c 22 43 61 66 66 65 69 6e 65 5c 22 2c 5c 22 36 5c 22 3a 5c 22 30 5c 22 2c 5c 22 37 5c Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20231219102252\",\"3\":\"Softonic\",\"4\":\"Softonic_DLM\",\"5\":\"run_button\",\"18\":\"\",\"19\":\"11\",\"21\":\"\|\|\",\"22\":\"Caffeine\",\"6\":\"0\",\"7\
2023-12-19 09:22:12 UTC	426	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Tue, 19 Dec 2023 09:22:12 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE X-Cache: Miss from cloudfront Via: 1.1 72222d8db55e22489ba6bee2262121f2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: HbPxEfl1j-lEQsmgq3W_1c-ee0wm3bb5smHUOl7Jb8pngqnbYIU8cw==
2023-12-19 09:22:12 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49743	34.117.223.223	443	5284	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:12 UTC	139	OUT	POST /v4/receive/json/25 HTTP/1.1 Connection: Keep-Alive User-Agent: Icarus Http/1.0 Content-Length: 1154 Host: analytics.avcdn.net
2023-12-19 09:22:12 UTC	1154	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 32 35 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 37 65 66 64 38 37 63 33 2d 38 38 36 61 2d 34 32 63 34 2d 62 35 36 63 2d 31 39 35 30 30 66 30 62 38 38 31 36 22 2c 22 74 69 6d 65 22 3a 31 37 30 32 39 38 33 33 33 33 35 37 37 7d 2c 22 73 65 74 75 70 22 3a 7b 22 63 6f 6d 6d 6f 6e 22 3a 7b 22 6f 70 65 72 61 74 69 6f 6e 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 36 64 31 31 64 65 64 38 2d 38 34 33 32 2d 34 39 32 31 2d 62 66 61 33 2d 32 32 34 62 37 36 30 63 64 33 39 65 22 2c 22 73 74 61 67 65 22 3a 22 73 66 78 2d 73 74 61 72 74 22 2c 22 74 69 74 6c 65 22 3a 22 22 7d 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 6d 61 Data Ascii: {"record":[{"event":{"type":25,"subtype":1,"request_id":"7efd87c3-886a-42c4-b56c-19500f0b8816","time":1702983333577},"setup":{"common":{"operation":"install","session_id":"6d11ded8-8432-4921-bfa3-224b760cd39e","stage":"sfx-start","title":""},"config":{"ma
2023-12-19 09:22:13 UTC	216	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:12 GMT Content-Type: application/json Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:13 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49746	34.117.223.223	443	5284	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:13 UTC	139	OUT	POST /v4/receive/json/25 HTTP/1.1 Connection: Keep-Alive User-Agent: Icarus Http/1.0 Content-Length: 1185 Host: analytics.avcdn.net
2023-12-19 09:22:13 UTC	1185	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 32 35 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 33 37 34 66 30 35 62 33 2d 30 61 37 39 2d 34 32 62 36 2d 38 39 64 63 2d 61 33 31 62 35 32 31 30 38 32 32 64 22 2c 22 74 69 6d 65 22 3a 31 37 30 32 39 38 33 33 33 33 36 31 32 7d 2c 22 73 65 74 75 70 22 3a 7b 22 63 6f 6d 6d 6f 6e 22 3a 7b 22 6f 70 65 72 61 74 69 6f 6e 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 36 64 31 31 64 65 64 38 2d 38 34 33 32 2d 34 39 32 31 2d 62 66 61 33 2d 32 32 34 62 37 36 30 63 64 33 39 65 22 2c 22 73 74 61 67 65 22 3a 22 73 66 78 2d 70 72 65 70 61 72 69 6e 67 22 2c 22 74 69 74 6c 65 22 3a 22 22 7d 2c 22 63 6f 6e 66 69 67 22 3a Data Ascii: {"record":[{"event":{"type":25,"subtype":1,"request_id":"374f05b3-0a79-42b6-89dc-a31b5210822d","time":1702983333612},"setup":{"common":{"operation":"install","session_id":"6d11ded8-8432-4921-bfa3-224b760cd39e","stage":"sfx-preparing","title":""},"config":
2023-12-19 09:22:13 UTC	216	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:13 GMT Content-Type: application/json Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:13 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49750	192.178.50.45	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:14 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:14 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-12-19 09:22:15 UTC	1627	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Dec 2023 09:22:15 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-tcgJC-IPQ6IuULcPkQG7Tg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:15 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-12-19 09:22:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49751	192.178.50.46	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:14 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:15 UTC	731	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-Ty1ozsu5GtRZlAr3NE7k0A' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Dec 2023 09:22:15 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6196 X-Daystart: 4935 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:15 UTC	521	IN	Data Raw: 32 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 39 36 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 39 33 35 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20 Data Ascii: 2c8<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6196" elapsed_seconds="4935"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-12-19 09:22:15 UTC	198	IN	Data Raw: 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 3f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-12-19 09:22:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49753	199.232.194.133	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:14 UTC	830	OUT	GET /d49/077/a3289ae3596f269011fba85f3163074285/file?Expires=1702357011&Signature=40fec4ff0b920c54bdad2c59f008fa0ee38b0a46&url=https://caffeine.softonic.com.br&Filename=file HTTP/1.1 Host: gsf-fl.softonic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:15 UTC	367	IN	HTTP/1.1 301 Forbidden (expired) Connection: close Content-Length: 0 Retry-After: 0 location: https://caffeine.softonic.com.br x-reason: Forbidden (expired) Accept-Ranges: bytes Date: Tue, 19 Dec 2023 09:22:15 GMT Via: 1.1 varnish X-Served-By: cache-gnv1820020-GNV X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1702977735.008373,VS0,VE0 x-fastly-version: 73

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49747	35.167.194.178	443	4612	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:15 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 336 Host: analytics.apis.mcafee.com
2023-12-19 09:22:15 UTC	336	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a 22 57 49 4e 22 2c 22 4f 53 5f 50 6c 61 74 66 6f 72 6d 22 3a 22 36 34 22 2c 22 4f 53 5f 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 31 2e 31 38 38 39 22 2c 22 50 72 6f 64 75 63 74 5f 56 65 72 73 69 6f 6e 22 3a 22 34 2e 31 2e 31 2e 38 31 38 22 2c 22 55 55 49 44 22 3a 22 7b 43 32 36 43 45 32 39 30 2d 42 35 39 37 2d 34 46 44 37 2d 42 34 41 35 2d 37 44 32 39 32 39 30 42 44 39 35 41 7d 22 2c 22 65 61 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 3d 74 72 75 65 22 2c 22 65 63 22 3a 22 49 6e 70 75 74 50 61 72 61 6d 65 74 65 72 73 22 2c 22 65 6c Data Ascii: {"Data":{"Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":"WIN","OS_Platform":"64","OS_Version":"10.0.19041.1889","Product_Version":"4.1.1.818","UUID":"{C26CE290-B597-4FD7-B4A5-7D29290BD95A}","ea":"PaidDistribution=true","ec":"InputParameters","el
2023-12-19 09:22:15 UTC	304	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:15 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 133 Connection: close x-amzn-RequestId: cbd90ab1-34fe-4916-9622-69b6672375ac x-amz-id-2: Fk593L9vSQ1zdb8hsLyXZNLBKXAFxX7F+nf9puAn1PvMyj6wL2+FSC51W6RqgA3o4LIRACKDy19mwEOxXFXUYzZtvAA1FnSp
2023-12-19 09:22:15 UTC	133	IN	Data Raw: 7b 22 45 6e 63 72 79 70 74 69 6f 6e 54 79 70 65 22 3a 22 4b 4d 53 22 2c 22 53 65 71 75 65 6e 63 65 4e 75 6d 62 65 72 22 3a 22 34 39 36 34 37 31 36 35 36 32 39 37 38 32 32 38 31 30 34 33 33 35 35 33 30 37 39 36 37 32 39 30 31 33 34 39 37 32 38 36 36 33 38 39 32 37 34 34 37 39 35 35 38 37 30 36 22 2c 22 53 68 61 72 64 49 64 22 3a 22 73 68 61 72 64 49 64 2d 30 30 30 30 30 30 30 30 30 30 30 33 22 7d Data Ascii: {"EncryptionType":"KMS","SequenceNumber":"49647165629782281043355307967290134972866389274479558706","ShardId":"shardId-000000000003"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49754	35.227.233.104	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:15 UTC	667	OUT	GET / HTTP/1.1 Host: caffeine.softonic.com.br Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:16 UTC	1285	IN	HTTP/1.1 200 OK strict-transport-security: max-age=63072000; includeSubDomains; preload x-request-id: 5455380d-31bf-4158-b435-ccf39fbc451b vary: user-agent,accept-encoding content-language: pt-BR x-rendered-as: desktop x-detected-as: desktop x-page-id: app x-is-bot: false x-served-by: server-5496778787-lhgr9 x-version: 1.6115.0 x-xss-protection: 1 x-frame-options: sameorigin x-content-type-options: nosniff permissions-policy: accelerometer=(), autoplay=(), camera=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=() content-security-policy: upgrade-insecure-requests referrer-policy: strict-origin-when-cross-origin cache-control: no-cache set-cookie: _usr_orgn=direct; Domain=softonic.com.br; Path=/ set-cookie: _swo_pos=341; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:16 GMT; Secure; Domain=softonic.com.br; Path=/ content-type: text/html; charset=utf-8 Content-Length: 322832 accept-ranges: bytes date: Tue, 19 Dec 2023 09:22:16 GMT x-envoy-upstream-service-time: 145 server: istio-envoy Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:16 UTC	1252	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 43 61 66 66 65 69 6e 65 20 2d 20 44 6f 77 6e 6c 6f 61 64 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 Data Ascii: <!DOCTYPE html><html lang="pt-BR"><head><meta charset="utf-8"><meta http-equiv="x-ua-compatible" content="ie=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Caffeine - Download</title><link rel="preconnect" href="https://s
2023-12-19 09:22:16 UTC	1252	IN	Data Raw: 31 36 33 65 63 39 66 35 66 61 2f 33 32 36 31 31 37 37 34 35 36 2f 63 61 66 66 65 69 6e 65 2d 6c 6f 67 6f 2e 70 6e 67 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 53 6f 66 74 6f 6e 69 63 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 72 74 69 63 6c 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 61 72 74 69 63 6c 65 3a 70 75 62 6c 69 73 68 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: 163ec9f5fa/3261177456/caffeine-logo.png"><meta property="og:url" content="https://caffeine.softonic.com.br"><meta property="og:site_name" content="Softonic"><meta property="og:type" content="article"><meta property="article:publisher" content="https://www
2023-12-19 09:22:16 UTC	1252	IN	Data Raw: 72 74 79 3d 22 72 76 2d 63 6f 6e 74 65 6e 74 22 20 63 6f 6e 74 65 6e 74 3d 22 72 69 63 68 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 72 76 2d 68 6f 73 74 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 66 61 6c 73 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 72 76 2d 64 69 73 61 62 6c 65 2d 73 6c 6f 74 2d 74 79 70 65 2d 69 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 41 54 46 5f 4f 4f 50 5f 49 6e 74 65 72 73 74 69 74 69 61 6c 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 72 76 2d 70 61 67 65 2d 69 64 22 20 63 6f 6e 74 65 6e 74 3d 22 61 70 70 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 72 76 2d 61 70 70 2d 69 64 22 20 63 6f 6e 74 65 6e 74 3d 22 66 34 36 61 34 64 62 34 2d 39 36 64 34 2d 31 31 65 36 2d 62 32 31 35 2d 30 30 31 36 33 Data Ascii: rty="rv-content" content="rich"><meta property="rv-hosted" content="false"><meta property="rv-disable-slot-type-ids" content="ATF_OOP_Interstitial"><meta property="rv-page-id" content="app"><meta property="rv-app-id" content="f46a4db4-96d4-11e6-b215-00163
2023-12-19 09:22:16 UTC	1252	IN	Data Raw: 6c 73 65 2c 22 69 73 55 53 22 3a 74 72 75 65 2c 22 69 73 45 78 74 65 72 6e 61 6c 52 65 71 75 65 73 74 22 3a 74 72 75 65 2c 22 6c 6f 63 61 6c 65 22 3a 22 70 74 2d 42 52 22 2c 22 70 61 67 65 49 64 22 3a 22 61 70 70 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 73 22 2c 22 72 65 67 69 6f 6e 22 3a 22 41 22 2c 22 72 6f 6f 74 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 22 73 69 74 65 44 6f 6d 61 69 6e 22 3a 22 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 22 73 74 61 74 69 63 73 42 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 2e 73 66 74 63 64 6e 2e 6e 65 74 22 2c 22 72 65 76 61 6d 70 41 64 73 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 70 6c 61 74 66 6f 72 6d 49 64 22 3a 22 Data Ascii: lse,"isUS":true,"isExternalRequest":true,"locale":"pt-BR","pageId":"app","protocol":"https","region":"A","rootUrl":"https://www.softonic.com.br","siteDomain":"softonic.com.br","staticsBaseUrl":"https://sc.sftcdn.net","revampAdsEnabled":true,"platformId":"
2023-12-19 09:22:16 UTC	1252	IN	Data Raw: 28 21 77 69 6e 64 6f 77 2e 66 72 61 6d 65 73 5b 65 5d 29 7b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 26 26 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 66 69 72 73 74 43 68 69 6c 64 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 3b 6e 2e 6e 61 6d 65 3d 65 3b 6e 2e 74 69 74 6c 65 3d 65 3b 74 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6e 2c 74 2e 66 69 72 73 74 43 68 69 6c 64 29 7d 65 6c 73 65 7b 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 28 65 29 7d 2c 35 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 6e 2c 61 2c 72 2c 65 2c 6f 29 Data Ascii: (!window.frames[e]){if(document.body&&document.body.firstChild){var t=document.body;var n=document.createElement("iframe");n.style.display="none";n.name=e;n.title=e;t.insertBefore(n,t.firstChild)}else{setTimeout(function(){i(e)},5)}}}function e(n,a,r,e,o)
2023-12-19 09:22:16 UTC	1252	IN	Data Raw: 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 0a 20 20 7d 29 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 2c 27 64 61 74 61 4c 61 79 65 72 27 29 0a 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 6d 2e 6a 73 3f 69 64 3d 47 54 4d 2d 35 4c 57 57 48 50 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 0a 20 20 21 28 66 75 6e 63 74 69 6f 6e 28 74 29 20 7b 0a 20 20 20 20 74 2e 72 65 76 61 6d 70 20 3d 20 74 2e 72 65 76 61 6d 70 20 7c 7c 20 7b 7d 3b Data Ascii: ]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'}) })(window,document,'dataLayer')</script><script async src="https://www.googletagmanager.com/gtm.js?id=GTM-5LWWHP"></script><script> !(function(t) { t.revamp = t.revamp \|\| {};
2023-12-19 09:22:16 UTC	1252	IN	Data Raw: 73 79 6e 63 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 72 65 76 61 6d 70 2e 72 65 67 69 73 74 65 72 45 76 65 6e 74 54 69 6d 65 28 5b 27 67 70 74 53 63 72 69 70 74 4c 6f 61 64 65 64 41 74 27 2c 20 44 61 74 65 2e 6e 6f 77 28 29 5d 29 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 74 79 70 65 3d 22 64 69 64 6f 6d 69 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 41 57 2d 36 33 31 33 32 31 30 36 39 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 20 7b 0a 20 20 20 20 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 Data Ascii: sync onload="window.revamp.registerEventTime(['gptScriptLoadedAt', Date.now()])"></script><script async type="didomi/javascript" src="https://www.googletagmanager.com/gtag/js?id=AW-631321069"></script><script> function gtag() { dataLayer.push(argume
2023-12-19 09:22:16 UTC	1252	IN	Data Raw: 22 74 79 70 65 22 3a 22 6e 61 74 69 76 65 5f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 62 61 72 22 2c 22 70 6f 73 22 3a 22 74 6f 70 22 2c 22 61 64 5f 31 70 5f 67 72 6f 75 70 22 3a 22 61 64 5f 31 70 5f 6f 70 74 22 2c 22 61 64 5f 64 79 6e 5f 67 72 6f 75 70 22 3a 22 61 64 5f 31 70 5f 6f 70 74 22 2c 22 61 64 5f 68 22 3a 39 2c 22 43 6f 75 6e 74 72 79 43 6c 75 73 74 65 72 22 3a 22 41 31 22 7d 2c 22 61 64 55 6e 69 74 50 61 74 68 22 3a 22 2f 35 33 30 32 2f 44 65 73 6b 74 6f 70 2f 44 65 73 6b 74 6f 70 2d 57 65 62 2d 50 54 2f 41 70 70 73 2f 50 72 6f 67 72 61 6d 70 61 67 65 2f 41 54 46 5f 4e 6f 74 69 66 69 63 61 74 69 6f 6e 62 61 72 22 7d 2c 22 69 73 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 7d 5d 2c 22 74 6f 70 2d 6c 65 61 64 65 72 62 6f 61 72 64 2d 61 70 70 2d 70 61 67 65 Data Ascii: "type":"native_notificationbar","pos":"top","ad_1p_group":"ad_1p_opt","ad_dyn_group":"ad_1p_opt","ad_h":9,"CountryCluster":"A1"},"adUnitPath":"/5302/Desktop/Desktop-Web-PT/Apps/Programpage/ATF_Notificationbar"},"isEnabled":true}],"top-leaderboard-app-page
2023-12-19 09:22:16 UTC	1252	IN	Data Raw: 22 74 6f 70 22 2c 22 61 64 5f 31 70 5f 67 72 6f 75 70 22 3a 22 61 64 5f 31 70 5f 6f 70 74 22 2c 22 61 64 5f 64 79 6e 5f 67 72 6f 75 70 22 3a 22 61 64 5f 31 70 5f 6f 70 74 22 2c 22 61 64 5f 68 22 3a 39 2c 22 43 6f 75 6e 74 72 79 43 6c 75 73 74 65 72 22 3a 22 41 31 22 7d 7d 2c 22 69 73 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 7d 2c 7b 22 70 72 6f 76 69 64 65 72 22 3a 22 73 74 61 74 69 63 22 2c 22 69 73 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 6f 70 74 69 6f 6e 73 22 3a 7b 22 6f 6e 6c 79 46 6f 72 41 64 42 6c 6f 63 6b 65 72 73 22 3a 74 72 75 65 2c 22 73 6c 6f 74 57 72 61 70 70 65 72 49 64 22 3a 22 74 6f 70 2d 6c 65 61 64 65 72 62 6f 61 72 64 2d 61 70 70 2d 70 61 67 65 2d 64 65 73 6b 74 6f 70 2d 77 72 61 70 70 65 72 22 2c 22 62 6f 64 79 22 3a 22 5c 6e 20 Data Ascii: "top","ad_1p_group":"ad_1p_opt","ad_dyn_group":"ad_1p_opt","ad_h":9,"CountryCluster":"A1"}},"isEnabled":true},{"provider":"static","isEnabled":false,"options":{"onlyForAdBlockers":true,"slotWrapperId":"top-leaderboard-app-page-desktop-wrapper","body":"\n
2023-12-19 09:22:16 UTC	1236	IN	Data Raw: 5f 4d 50 55 5f 46 69 72 73 74 22 2c 22 73 6c 6f 74 57 72 61 70 70 65 72 49 64 22 3a 22 6d 70 75 2d 61 70 70 2d 70 61 67 65 2d 64 65 73 6b 74 6f 70 2d 77 72 61 70 70 65 72 22 2c 22 74 79 70 65 22 3a 22 74 6f 70 5f 64 69 73 70 6c 61 79 5f 6d 70 75 22 2c 22 70 6f 73 22 3a 22 74 6f 70 22 2c 22 68 61 73 42 69 64 73 22 3a 74 72 75 65 2c 22 72 65 66 72 65 73 68 22 3a 33 2c 22 62 69 64 73 22 3a 5b 7b 22 62 69 64 64 65 72 22 3a 22 79 61 68 6f 6f 73 73 70 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 64 63 6e 22 3a 22 38 61 39 36 39 30 61 39 30 31 37 32 37 32 35 30 39 31 66 36 35 35 38 38 66 32 38 32 30 30 65 34 22 2c 22 70 6f 73 22 3a 22 64 65 73 6b 74 6f 70 5f 61 74 66 5f 6d 70 75 5f 66 69 72 73 74 22 7d 7d 2c 7b 22 62 69 64 64 65 72 22 3a 22 61 70 70 6e 65 78 75 73 22 Data Ascii: _MPU_First","slotWrapperId":"mpu-app-page-desktop-wrapper","type":"top_display_mpu","pos":"top","hasBids":true,"refresh":3,"bids":[{"bidder":"yahoossp","params":{"dcn":"8a9690a90172725091f65588f28200e4","pos":"desktop_atf_mpu_first"}},{"bidder":"appnexus"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49760	65.8.178.46	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:16 UTC	599	OUT	GET /a8ff32f4-78c7-4428-825d-0badb488b68b/loader.js?target=softonic.com.br HTTP/1.1 Host: sdk.privacy-center.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:18 UTC	579	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 65728 Connection: close Server: CloudFront Date: Tue, 19 Dec 2023 09:22:17 GMT X-Didomi-Remote-Config-Metadata: multiReg:true;legacyGlobalGdpr:false X-Didomi-Remote-Config-Source: Lambda Cache-Control: max-age=7200, public ETag: "4db1803ad97497712c237d3af5f5b7da" Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 faa43279a53f7a194aba33a9a9e24078.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: gqhIeSAFWAxVQ9uMxfX4-wQdolb5MEhWhOjVnS6g5FAZZwRQn73qJQ==
2023-12-19 09:22:18 UTC	16384	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 77 69 6e 64 6f 77 2e 64 69 64 6f 6d 69 52 65 6d 6f 74 65 43 6f 6e 66 69 67 3d 7b 22 6e 6f 74 69 63 65 73 22 3a 5b 7b 22 6e 6f 74 69 63 65 5f 69 64 22 3a 22 7a 41 54 55 7a 77 58 4d 22 2c 22 64 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 22 77 65 62 22 2c 22 74 61 72 67 65 74 73 22 3a 5b 5d 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 63 6f 6f 6b 69 65 73 22 3a 7b 22 73 74 6f 72 61 67 65 53 6f 75 72 63 65 73 22 3a 7b 22 63 6f 6f 6b 69 65 73 22 3a 66 61 6c 73 65 2c 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 74 72 75 65 7d 7d 2c 22 61 70 70 22 3a 7b 22 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 22 3a 66 61 6c 73 65 2c 22 76 65 6e 64 6f 72 73 22 3a 7b 22 69 61 62 22 3a 7b 22 65 Data Ascii: !function(){try{window.didomiRemoteConfig={"notices":[{"notice_id":"zATUzwXM","default":true,"platform":"web","targets":[],"config":{"cookies":{"storageSources":{"cookies":false,"localStorage":true}},"app":{"gdprAppliesGlobally":false,"vendors":{"iab":{"e
2023-12-19 09:22:18 UTC	16384	IN	Data Raw: 61 72 6b 65 74 5f 72 65 73 65 61 72 63 68 22 2c 22 6d 65 61 73 75 72 65 5f 61 64 5f 70 65 72 66 6f 72 6d 61 6e 63 65 22 2c 22 73 65 6c 65 63 74 5f 62 61 73 69 63 5f 61 64 73 22 5d 2c 22 75 73 65 73 4e 6f 6e 43 6f 6f 6b 69 65 41 63 63 65 73 73 22 3a 66 61 6c 73 65 2c 22 6c 61 6e 67 5f 75 72 6c 73 22 3a 5b 5d 2c 22 6e 61 6d 65 73 70 61 63 65 73 22 3a 7b 22 67 6f 6f 67 6c 65 22 3a 7b 22 69 64 22 3a 34 39 35 2c 22 63 75 72 72 65 6e 74 22 3a 74 72 75 65 7d 7d 7d 2c 7b 22 69 64 22 3a 22 65 76 69 64 6f 6e 2d 61 64 63 68 6f 69 63 65 73 22 2c 22 6e 61 6d 65 22 3a 22 45 76 69 64 6f 6e 22 2c 22 70 6f 6c 69 63 79 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 72 6f 77 6e 70 65 61 6b 2e 63 6f 6d 2f 70 72 69 76 61 63 79 22 2c 22 70 75 72 70 6f 73 65 49 64 73 Data Ascii: arket_research","measure_ad_performance","select_basic_ads"],"usesNonCookieAccess":false,"lang_urls":[],"namespaces":{"google":{"id":495,"current":true}}},{"id":"evidon-adchoices","name":"Evidon","policyUrl":"https://www.crownpeak.com/privacy","purposeIds
2023-12-19 09:22:18 UTC	16384	IN	Data Raw: 69 74 65 64 5f 64 61 74 61 5f 74 6f 5f 73 65 6c 65 63 74 5f 63 6f 6e 74 65 6e 74 22 5d 2c 22 75 73 65 73 4e 6f 6e 43 6f 6f 6b 69 65 41 63 63 65 73 73 22 3a 66 61 6c 73 65 2c 22 6c 61 6e 67 5f 75 72 6c 73 22 3a 5b 7b 22 6c 61 6e 67 49 64 22 3a 22 65 6e 22 2c 22 70 72 69 76 61 63 79 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 6e 69 76 69 65 77 2e 63 6f 6d 2f 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 2f 22 2c 22 6c 65 67 49 6e 74 43 6c 61 69 6d 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 6e 69 76 69 65 77 2e 63 6f 6d 2f 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 2f 22 7d 5d 7d 2c 7b 22 69 64 22 3a 22 61 64 2d 6d 61 6e 22 2c 22 6e 61 6d 65 22 3a 22 41 44 6d 61 6e 20 49 6e 74 65 72 61 63 74 69 76 65 20 53 4c 55 22 2c 22 70 6f 6c 69 63 79 55 72 6c 22 3a Data Ascii: ited_data_to_select_content"],"usesNonCookieAccess":false,"lang_urls":[{"langId":"en","privacy":"https://www.aniview.com/privacy-policy/","legIntClaim":"https://www.aniview.com/privacy-policy/"}]},{"id":"ad-man","name":"ADman Interactive SLU","policyUrl":
2023-12-19 09:22:18 UTC	13518	IN	Data Raw: be d0 ba d0 b0 d0 b7 d1 83 20 d1 86 d1 96 d0 bb d1 8c d0 be d0 b2 d0 b8 d1 85 20 d1 80 d0 b5 d0 ba d0 bb d0 b0 d0 bc d0 bd d0 b8 d1 85 20 d0 be d0 b3 d0 be d0 bb d0 be d1 88 d0 b5 d0 bd d1 8c 22 2c 22 76 69 22 3a 22 4c c6 b0 75 20 74 72 e1 bb af 20 76 c3 a0 20 74 72 75 79 20 63 e1 ba ad 70 20 74 68 c3 b4 6e 67 20 74 69 6e 20 c4 91 e1 bb 8b 61 20 6c c3 bd 20 c4 91 e1 bb 83 20 6d e1 bb a5 63 20 c4 91 c3 ad 63 68 20 71 75 e1 ba a3 6e 67 20 63 c3 a1 6f 20 6e 68 e1 ba af 6d 20 6d e1 bb a5 63 20 74 69 c3 aa 75 22 2c 22 66 69 6c 22 3a 22 49 6d 62 61 6b 61 6e 20 61 74 20 70 61 67 2d 61 63 63 65 73 73 20 73 61 20 69 6d 70 6f 72 6d 61 73 79 6f 6e 20 6e 67 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 20 70 61 72 61 20 73 61 20 6e 61 6b 61 2d 74 61 72 67 65 74 20 6e 61 20 6c Data Ascii: ","vi":"Lu tr v truy cp thng tin a l mc ch qung co nhm mc tiu","fil":"Imbakan at pag-access sa impormasyon ng geolocation para sa naka-target na l
2023-12-19 09:22:18 UTC	3058	IN	Data Raw: 64 20 61 64 73 20 74 68 61 74 20 61 72 65 20 72 65 6c 65 76 61 6e 74 20 74 6f 20 79 6f 75 2e 22 7d 7d 2c 7b 22 69 64 22 3a 22 63 72 65 61 74 65 5f 63 6f 6e 74 65 6e 74 5f 70 72 6f 66 69 6c 65 22 2c 22 6e 61 6d 65 22 3a 7b 22 65 6e 22 3a 22 43 72 65 61 74 65 20 70 72 6f 66 69 6c 65 73 20 74 6f 20 70 65 72 73 6f 6e 61 6c 69 73 65 20 63 6f 6e 74 65 6e 74 20 28 49 41 42 20 54 43 46 20 76 32 2e 32 29 22 7d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 7b 22 65 6e 22 3a 22 41 20 70 72 6f 66 69 6c 65 20 63 61 6e 20 62 65 20 62 75 69 6c 74 20 61 62 6f 75 74 20 79 6f 75 20 61 6e 64 20 79 6f 75 72 20 69 6e 74 65 72 65 73 74 73 20 74 6f 20 73 68 6f 77 20 79 6f 75 20 70 65 72 73 6f 6e 61 6c 69 73 65 64 20 63 6f 6e 74 65 6e 74 20 74 68 61 74 20 69 73 20 72 65 6c 65 76 Data Ascii: d ads that are relevant to you."}},{"id":"create_content_profile","name":{"en":"Create profiles to personalise content (IAB TCF v2.2)"},"description":{"en":"A profile can be built about you and your interests to show you personalised content that is relev

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49767	35.227.233.104	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:17 UTC	590	OUT	GET /revamp/sft-bundle.js?modern=1 HTTP/1.1 Host: softonic.com.br Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://caffeine.softonic.com.br sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:17 UTC	1220	IN	HTTP/1.1 200 OK Content-Length: 334075 server: istio-envoy content-type: application/javascript; charset=utf-8 cache-control: max-age=172500, public, s-maxage=172800, stale-if-error=31536000, stale-while-revalidate=864000 x-publisher-id: softonic etag: "1a77d364ea040b10d58540cbc7704974" x-version: 1.1306.0 x-request-id: 8eb871aa-4742-4c82-a1b7-01b6dd53e4b9 x-envoy-upstream-service-time: 9 accept-ranges: bytes age: 57343 date: Tue, 19 Dec 2023 09:22:17 GMT x-served-by: cache-ams12763-AMS, cache-bfi-krnt7300061-BFI x-cache: HIT, HIT x-cache-hits: 1, 0 x-timer: S1702977737.479186,VS0,VE1 vary: Accept-Encoding,x-device-platform,x-platform-id access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform access-control-allow-origin: * x-country-code: US x-region: FL x-device-platform: Desktop x-browser-name: Chrome x-browser-version: 117.0.0.0 x-platform-id: Windows 10 x-platform-version: NT 10.0 alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 Via: 1.1 google, 1.1 varnish, 1.1 varnish, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:17 UTC	32	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 74 3d 7b 32 31 33 31 Data Ascii: (()=>{"use strict";var e,t={2131
2023-12-19 09:22:17 UTC	1185	IN	Data Raw: 3a 65 3d 3e 7b 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 72 65 74 75 72 6e 28 74 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c 2e 70 72 6f 74 6f 74 79 70 65 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 29 28 65 29 7d 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b Data Ascii: :e=>{function t(e){return(t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}e.exports=function(){
2023-12-19 09:22:17 UTC	1252	IN	Data Raw: 3a 74 2c 73 75 63 63 65 73 73 3a 6e 2c 63 61 6c 6c 49 64 3a 6f 2e 63 61 6c 6c 49 64 7d 7d 3b 65 26 26 65 2e 73 6f 75 72 63 65 26 26 65 2e 73 6f 75 72 63 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 26 26 65 2e 73 6f 75 72 63 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 72 3f 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 69 29 3a 69 2c 22 2a 22 29 7d 29 2c 6f 2e 70 61 72 61 6d 65 74 65 72 29 7d 29 2c 21 31 29 29 7d 7d 2c 38 32 34 39 3a 28 65 2c 74 2c 72 29 3d 3e 7b 72 2e 64 28 74 2c 7b 5a 3a 28 29 3d 3e 68 7d 29 3b 76 61 72 20 6e 3d 72 28 38 38 34 33 29 2c 6f 3d 72 28 36 37 39 38 29 2c 69 3d 72 28 32 35 36 36 29 2c 73 3d 72 28 37 38 37 38 29 2c 63 3d 72 28 36 31 39 36 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 Data Ascii: :t,success:n,callId:o.callId}};e&&e.source&&e.source.postMessage&&e.source.postMessage(r?JSON.stringify(i):i,"*")}),o.parameter)}),!1))}},8249:(e,t,r)=>{r.d(t,{Z:()=>h});var n=r(8843),o=r(6798),i=r(2566),s=r(7878),c=r(6196);function a(e,t,r){void 0===t&&(
2023-12-19 09:22:17 UTC	1252	IN	Data Raw: 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 34 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 34 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 34 5d 3a 34 65 33 2c 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 35 3f 61 72 67 75 6d 65 6e 74 73 5b 35 5d 3a 76 6f 69 64 20 30 3b 70 28 74 68 69 73 2c 22 63 6d 70 73 74 75 62 22 2c 76 6f 69 64 20 30 29 2c 70 28 74 68 69 73 2c 22 75 73 65 72 43 6f 6e 73 65 6e 74 53 75 62 6a 65 63 74 22 2c 76 6f 69 64 20 30 29 2c 70 28 74 68 69 73 2c 22 72 65 67 75 6c 61 74 69 6f 6e 73 53 75 62 6a 65 63 74 22 2c 76 6f 69 64 20 30 29 2c 70 28 74 68 69 73 2c 22 65 76 65 6e 74 73 53 75 62 6a 65 63 74 22 2c 76 6f 69 64 20 30 29 2c 70 28 74 68 69 73 2c 22 66 61 6c 6c 62 61 63 6b 54 69 6d 65 6f 75 74 49 6e 4d 73 22 2c Data Ascii: guments.length>4&&void 0!==arguments[4]?arguments[4]:4e3,i=arguments.length>5?arguments[5]:void 0;p(this,"cmpstub",void 0),p(this,"userConsentSubject",void 0),p(this,"regulationsSubject",void 0),p(this,"eventsSubject",void 0),p(this,"fallbackTimeoutInMs",
2023-12-19 09:22:17 UTC	1252	IN	Data Raw: 3f 65 2e 67 64 70 72 41 70 70 6c 69 65 73 3f 5b 75 2c 6c 5d 2e 69 6e 63 6c 75 64 65 73 28 65 2e 65 76 65 6e 74 53 74 61 74 75 73 29 3f 28 74 68 69 73 2e 74 63 66 4c 61 73 74 45 76 65 6e 74 53 74 61 74 75 73 3d 65 2e 65 76 65 6e 74 53 74 61 74 75 73 2c 74 68 69 73 2e 74 63 44 61 74 61 3d 65 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 53 74 72 69 6e 67 44 65 74 65 63 74 65 64 3d 21 30 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 3d 74 68 69 73 2e 67 65 74 50 75 72 70 6f 73 65 56 61 6c 75 65 28 34 29 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 50 72 6f 66 69 6c 65 3d 74 68 69 73 2e 67 65 74 50 75 72 70 6f 73 65 56 61 6c 75 65 28 33 29 2c 74 68 69 73 2e 64 65 76 69 63 65 41 63 63 65 73 73 3d 74 68 69 73 2e 67 65 74 50 75 72 70 Data Ascii: ?e.gdprApplies?[u,l].includes(e.eventStatus)?(this.tcfLastEventStatus=e.eventStatus,this.tcData=e,this.consentStringDetected=!0,this.personalizedAds=this.getPurposeValue(4),this.personalizedAdsProfile=this.getPurposeValue(3),this.deviceAccess=this.getPurp
2023-12-19 09:22:17 UTC	1252	IN	Data Raw: 69 73 2e 63 6f 6e 73 65 6e 74 53 74 72 69 6e 67 44 65 74 65 63 74 65 64 3d 21 30 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 3d 21 30 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 50 72 6f 66 69 6c 65 3d 21 30 2c 74 68 69 73 2e 64 65 76 69 63 65 41 63 63 65 73 73 3d 21 30 2c 74 68 69 73 2e 65 6d 69 74 43 6f 6e 73 65 6e 74 45 76 65 6e 74 28 29 29 3a 28 74 68 69 73 2e 63 6f 6e 73 65 6e 74 53 74 72 69 6e 67 44 65 74 65 63 74 65 64 3d 21 31 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 3d 21 31 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 50 72 6f 66 69 6c 65 3d 21 31 2c 74 68 69 73 2e 64 65 76 69 63 65 41 63 63 65 73 73 3d 21 30 2c 74 68 69 73 2e 65 6d 69 74 43 6f 6e 73 65 6e 74 45 76 65 Data Ascii: is.consentStringDetected=!0,this.personalizedAds=!0,this.personalizedAdsProfile=!0,this.deviceAccess=!0,this.emitConsentEvent()):(this.consentStringDetected=!1,this.personalizedAds=!1,this.personalizedAdsProfile=!1,this.deviceAccess=!0,this.emitConsentEve
2023-12-19 09:22:17 UTC	1252	IN	Data Raw: 73 2e 67 64 70 72 41 70 70 6c 69 65 73 7d 2c 65 29 29 7d 65 6d 69 74 52 65 67 75 6c 61 74 69 6f 6e 73 28 29 7b 76 61 72 20 65 3d 7b 67 64 70 72 41 70 70 6c 69 65 73 3a 74 68 69 73 2e 67 64 70 72 41 70 70 6c 69 65 73 2c 63 63 70 61 41 70 70 6c 69 65 73 3a 74 68 69 73 2e 63 63 70 61 41 70 70 6c 69 65 73 7d 3b 74 68 69 73 2e 65 76 65 6e 74 73 53 75 62 6a 65 63 74 2e 6e 65 78 74 28 7b 74 79 70 65 3a 68 2e 45 56 45 4e 54 53 2e 52 45 47 55 4c 41 54 49 4f 4e 53 5f 54 4f 5f 41 50 50 4c 59 5f 44 45 54 45 43 54 45 44 2c 70 61 79 6c 6f 61 64 3a 65 7d 29 2c 74 68 69 73 2e 72 65 67 75 6c 61 74 69 6f 6e 73 53 75 62 6a 65 63 74 2e 6e 65 78 74 28 65 29 2c 74 68 69 73 2e 72 65 67 75 6c 61 74 69 6f 6e 73 53 75 62 6a 65 63 74 2e 63 6f 6d 70 6c 65 74 65 28 29 7d 67 65 74 50 Data Ascii: s.gdprApplies},e))}emitRegulations(){var e={gdprApplies:this.gdprApplies,ccpaApplies:this.ccpaApplies};this.eventsSubject.next({type:h.EVENTS.REGULATIONS_TO_APPLY_DETECTED,payload:e}),this.regulationsSubject.next(e),this.regulationsSubject.complete()}getP
2023-12-19 09:22:17 UTC	288	IN	Data Raw: 6e 20 68 28 65 2c 74 29 7b 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6e 3d 6e 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 74 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 29 2c 72 2e 70 75 73 68 2e 61 70 70 6c 79 28 72 2c 6e 29 7d 72 65 74 75 72 6e 20 72 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 Data Ascii: n h(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function b(e,t,r){return t in e?Object.d
2023-12-19 09:22:17 UTC	1252	IN	Data Raw: 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 72 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 79 28 65 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 72 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 72 2c 65 7d 63 6c 61 73 73 20 6d 7b 69 6e 66 6f 28 65 2c 74 29 7b 76 61 72 20 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3a 22 22 3b 74 68 69 73 2e 6c Data Ascii: able:!0,configurable:!0,writable:!0}):e[t]=r,e}function y(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}class m{info(e,t){var r=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"";this.l
2023-12-19 09:22:17 UTC	1190	IN	Data Raw: 64 69 6e 67 3a 20 31 70 78 20 30 20 31 70 78 20 32 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 20 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 20 33 70 78 3b 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 20 33 70 78 22 2c 22 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 66 34 66 34 66 34 3b 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 34 66 34 66 34 3b 20 63 6f 6c 6f 72 3a 20 23 35 34 42 33 37 37 3b 20 70 61 64 64 69 6e 67 3a 20 31 70 78 20 32 70 78 20 31 70 78 20 30 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 20 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 20 33 70 78 3b 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 72 69 67 68 Data Ascii: ding: 1px 0 1px 2px; font-weight: 600; border-top-left-radius: 3px; border-bottom-left-radius: 3px","border: 1px solid #f4f4f4; background: #f4f4f4; color: #54B377; padding: 1px 2px 1px 0; font-weight: 600; border-top-right-radius: 3px; border-bottom-righ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49773	172.217.3.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:17 UTC	712	OUT	GET /pagead/ppub_config?ippd=www.softonic.com.br HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:18 UTC	831	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:18 GMT Expires: Tue, 19 Dec 2023 09:22:18 GMT Cache-Control: private, max-age=3600, stale-while-revalidate=3600 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe Content-Length: 180 X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Tue, 19-Dec-2023 09:37:18 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:18 UTC	180	IN	Data Raw: 5b 5b 22 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 6e 75 6c 6c 2c 22 77 77 77 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 22 35 32 35 35 35 33 38 37 22 2c 22 35 33 30 32 22 5d 5d 2c 5b 5d 2c 5b 5d 2c 5b 33 31 30 37 39 35 32 37 5d 2c 6e 75 6c 6c 2c 5b 5b 22 35 33 30 32 22 2c 5b 5b 22 69 64 35 2d 73 79 6e 63 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 64 35 2d 73 79 6e 63 2e 63 6f 6d 2f 61 70 69 2f 31 2e 30 2f 65 73 70 2e 6a 73 22 5d 5d 5d 5d 2c 6e 75 6c 6c 2c 5b 5d 5d Data Ascii: [["softonic.com.br",null,"www.softonic.com.br",null,null,["52555387","5302"]],[],[],[31079527],null,[["5302",[["id5-sync.com","https://cdn.id5-sync.com/api/1.0/esp.js"]]]],null,[]]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49766	172.217.3.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:18 UTC	644	OUT	GET /tag/js/gpt.js HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:18 UTC	753	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Vary: Accept-Encoding Date: Tue, 19 Dec 2023 09:22:18 GMT Expires: Tue, 19 Dec 2023 09:22:18 GMT Cache-Control: private, max-age=900, stale-while-revalidate=3600 Content-Type: text/javascript; charset=UTF-8 ETag: 56 / 19710 / m202312060101 / config-hash: 17400476758908410755 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe Content-Length: 91532 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:18 UTC	499	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 73 74 74 63 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 69 66 28 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 74 61 67 26 26 67 6f 6f 67 6c 65 74 61 67 2e 65 76 61 6c 53 63 72 69 70 74 73 29 7b 67 6f 6f 67 6c 65 74 61 67 2e 65 76 61 6c 53 63 72 69 70 74 73 28 29 3b 7d 69 66 28 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 74 61 67 26 26 67 6f 6f 67 6c 65 74 61 67 2e 5f 6c 6f 61 64 65 64 5f 29 72 65 74 75 72 6e 3b 76 61 72 20 70 2c 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 2c 62 61 3d 22 66 75 6e Data Ascii: (function(sttc){var window=this;if(window.googletag&&googletag.evalScripts){googletag.evalScripts();}if(window.googletag&&googletag._loaded_)return;var p,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="fun
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 22 29 3b 7d 2c 64 61 3d 63 61 28 74 68 69 73 29 2c 65 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 28 22 78 22 29 2c 74 3d 7b 7d 2c 66 61 3d 7b 7d 2c Data Ascii: "object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},da=ca(this),ea="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),t={},fa={},
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 64 61 5b 62 5b 63 5d 5d 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 62 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 Data Ascii: 8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=da[b[c]];"function"===typeof d&&"function"!=typeof d.prototype[a]&&ba(d.prototype,a,{configurable:!0,writable:!0,value:function(){r
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 7b 76 61 72 20 6f 61 3b 61 3a 7b 76 61 72 20 70 61 3d 7b 61 3a 21 30 7d 2c 71 61 3d 7b 7d 3b 74 72 79 7b 71 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 70 61 3b 6f 61 3d 71 61 2e 61 3b 62 72 65 61 6b 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 6f 61 3d 21 31 7d 6e 61 3d 6f 61 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 3b 69 66 28 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 21 3d 3d 62 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 61 2b 22 20 69 73 20 6e 6f 74 20 65 78 74 65 6e 73 69 62 6c 65 22 29 3b 72 65 74 75 72 6e 20 61 7d 3a 6e 75 6c 6c 7d 76 61 72 20 73 61 3d 6e 61 2c 7a 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6d 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 29 3b 61 2e 70 72 6f 74 Data Ascii: {var oa;a:{var pa={a:!0},qa={};try{qa.__proto__=pa;oa=qa.a;break a}catch(a){}oa=!1}na=oa?function(a,b){a.__proto__=b;if(a.__proto__!==b)throw new TypeError(a+" is not extensible");return a}:null}var sa=na,z=function(a,b){a.prototype=ma(b.prototype);a.prot
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 6e 65 3b 29 68 3d 68 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 68 5b 30 5d 2c 68 5b 31 5d 29 7d 7d 3b 66 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 69 66 28 21 63 28 67 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 57 65 61 6b 4d 61 70 20 6b 65 79 22 29 3b 69 66 28 21 6b 61 28 67 2c 64 29 29 7b 76 61 72 20 6b 3d 6e 65 77 20 62 3b 62 61 28 67 2c 64 2c 7b 76 61 6c 75 65 3a 6b 7d 29 7d 69 66 28 21 6b 61 28 67 2c 64 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 57 65 61 6b 4d 61 70 20 6b 65 79 20 66 61 69 6c 3a 20 22 2b 67 29 3b 67 5b 64 5d 5b 74 68 69 73 2e 67 5d 3d 68 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 66 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 67 Data Ascii: ne;)h=h.value,this.set(h[0],h[1])}};f.prototype.set=function(g,h){if(!c(g))throw Error("Invalid WeakMap key");if(!ka(g,d)){var k=new b;ba(g,d,{value:k})}if(!ka(g,d))throw Error("WeakMap key fail: "+g);g[d][this.g]=h;return this};f.prototype.get=function(g
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 7d 2c 6c 2e 6c 69 73 74 2e 70 75 73 68 28 6c 2e 73 29 2c 74 68 69 73 5b 31 5d 2e 43 2e 6e 65 78 74 3d 6c 2e 73 2c 74 68 69 73 5b 31 5d 2e 43 3d 6c 2e 73 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 68 3d 64 28 74 68 69 73 2c 68 29 3b 72 65 74 75 72 6e 20 68 2e 73 26 26 68 2e 6c 69 73 74 3f 28 68 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 68 2e 69 6e 64 65 78 2c 31 29 2c 68 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 68 2e 69 64 5d 2c 68 2e 73 2e 43 2e 6e 65 78 74 3d 68 2e 73 2e 6e 65 78 74 2c 68 2e 73 2e 6e 65 78 74 2e 43 3d 68 2e 73 2e 43 2c 68 2e 73 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 Data Ascii: },l.list.push(l.s),this[1].C.next=l.s,this[1].C=l.s,this.size++);return this};c.prototype.delete=function(h){h=d(this,h);return h.s&&h.list?(h.list.splice(h.index,1),h.list.length\|\|delete this[0][h.id],h.s.C.next=h.s.next,h.s.next.C=h.s.C,h.s.head=null,th
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 78 74 21 3d 6c 2e 68 65 61 64 3b 29 72 65 74 75 72 6e 20 6c 3d 6c 2e 6e 65 78 74 2c 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 6b 28 6c 29 7d 3b 6c 3d 6e 75 6c 6c 7d 72 65 74 75 72 6e 7b 64 6f 6e 65 3a 21 30 2c 76 61 6c 75 65 3a 76 6f 69 64 20 30 7d 7d 29 7d 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 7b 7d 3b 72 65 74 75 72 6e 20 68 2e 43 3d 68 2e 6e 65 78 74 3d 68 2e 68 65 61 64 3d 68 7d 2c 67 3d 30 3b 72 65 74 75 72 6e 20 63 7d 2c 22 65 73 36 22 29 3b 77 28 22 4d 61 74 68 2e 74 72 75 6e 63 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 3d 4e 75 6d 62 65 72 28 62 29 3b 69 66 28 69 73 4e 61 4e 28 62 29 7c 7c 49 6e 66 69 6e 69 74 79 3d 3d 3d 62 7c 7c 2d 49 6e 66 69 6e 69 Data Ascii: xt!=l.head;)return l=l.next,{done:!1,value:k(l)};l=null}return{done:!0,value:void 0}})},f=function(){var h={};return h.C=h.next=h.head=h},g=0;return c},"es6");w("Math.trunc",function(a){return a?a:function(b){b=Number(b);if(isNaN(b)\|\|Infinity===b\|\|-Infini
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 61 7c 7c 21 75 28 61 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 74 72 69 65 73 22 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 78 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 31 21 3d 64 2e 73 69 7a 65 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 31 21 3d 64 2e 73 69 7a 65 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 32 21 3d 64 2e 73 69 7a 65 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 75 28 64 2c 22 65 6e 74 72 69 65 73 22 29 2e 63 61 6c 6c 28 64 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 Data Ascii: a\|\|!u(a.prototype,"entries")\|\|"function"!=typeof Object.seal)return!1;try{var c=Object.seal({x:4}),d=new a(x([c]));if(!d.has(c)\|\|1!=d.size\|\|d.add(c)!=d\|\|1!=d.size\|\|d.add({x:4})!=d\|\|2!=d.size)return!1;var e=u(d,"entries").call(d),f=e.next();if(f.done\|\|f.va
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 66 20 62 3f 21 31 3a 21 69 73 4e 61 4e 28 62 29 26 26 49 6e 66 69 6e 69 74 79 21 3d 3d 62 26 26 2d 49 6e 66 69 6e 69 74 79 21 3d 3d 62 7d 7d 2c 22 65 73 36 22 29 3b 77 28 22 4e 75 6d 62 65 72 2e 4d 41 58 5f 53 41 46 45 5f 49 4e 54 45 47 45 52 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 31 7d 2c 22 65 73 36 22 29 3b 77 28 22 4e 75 6d 62 65 72 2e 69 73 49 6e 74 65 67 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 75 28 4e 75 6d 62 65 72 2c 22 69 73 46 69 6e 69 74 65 22 29 2e 63 61 6c 6c 28 4e 75 6d 62 65 72 2c 62 29 3f 62 3d 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 62 29 3a 21 31 7d 7d 2c 22 65 73 36 22 29 3b Data Ascii: f b?!1:!isNaN(b)&&Infinity!==b&&-Infinity!==b}},"es6");w("Number.MAX_SAFE_INTEGER",function(){return 9007199254740991},"es6");w("Number.isInteger",function(a){return a?a:function(b){return u(Number,"isFinite").call(Number,b)?b===Math.floor(b):!1}},"es6");
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 29 29 7d 65 6c 73 65 20 66 6f 72 28 66 3d 62 2e 6c 65 6e 67 74 68 2c 67 3d 30 3b 67 3c 66 3b 67 2b 2b 29 65 2e 70 75 73 68 28 63 2e 63 61 6c 6c 28 64 2c 62 5b 67 5d 2c 67 29 29 3b 72 65 74 75 72 6e 20 65 7d 7d 2c 22 65 73 36 22 29 3b 77 28 22 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3b 66 6f 72 28 64 20 69 6e 20 62 29 6b 61 28 62 2c 64 29 26 26 63 2e 70 75 73 68 28 5b 64 2c 62 5b 64 5d 5d 29 3b 72 65 74 75 72 6e 20 63 7d 7d 2c 22 65 73 38 22 29 3b 77 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 Data Ascii: ))}else for(f=b.length,g=0;g<f;g++)e.push(c.call(d,b[g],g));return e}},"es6");w("Object.entries",function(a){return a?a:function(b){var c=[],d;for(d in b)ka(b,d)&&c.push([d,b[d]]);return c}},"es8");w("String.prototype.startsWith",function(a){return a?a:fu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49779	65.8.178.46	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:18 UTC	629	OUT	GET /sdk/987a229737a51fb2573d2ec0820c56d8f62ee315/modern/sdk.987a229737a51fb2573d2ec0820c56d8f62ee315.js HTTP/1.1 Host: sdk.privacy-center.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:18 UTC	592	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 330781 Connection: close Date: Mon, 11 Dec 2023 15:17:41 GMT Last-Modified: Mon, 11 Dec 2023 14:55:24 GMT ETag: "c3e4143204c287d2e1fb876e7696e603-1" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 eca8616127916fa339e7718294322b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: T8B_WgGRRTlGTLX1PX8ADnS0N-z0zmafO-mIfAirhCzBlLcTB5K4hQ== Age: 669878
2023-12-19 09:22:18 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 73 64 6b 2e 39 38 37 61 32 32 39 37 33 37 61 35 31 66 62 32 35 37 33 64 32 65 63 30 38 32 30 63 35 36 64 38 66 36 32 65 65 33 31 35 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 73 2c 69 2c 6e 3d 7b 38 36 31 31 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 76 61 72 20 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 73 3d 30 3b 73 3c 74 2e 6c 65 6e 67 74 68 3b 73 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 73 5d 3b 69 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 69 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 69 2e Data Ascii: /! For license information please see sdk.987a229737a51fb2573d2ec0820c56d8f62ee315.js.LICENSE.txt /!function(){var e,t,s,i,n={86119:function(e,t,s){var i=function(){function e(e,t){for(var s=0;s<t.length;s++){var i=t[s];i.enumerable=i.enumerable\|\|!1,i.
2023-12-19 09:22:18 UTC	16384	IN	Data Raw: 3d 64 2e 7a 2e 76 61 6c 75 65 7c 7c 7b 7d 3b 72 65 74 75 72 6e 21 21 74 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 26 26 21 28 6e 75 6c 6c 3d 3d 28 65 3d 61 2e 63 2e 76 61 6c 75 65 29 7c 7c 21 65 2e 73 70 65 63 69 61 6c 46 65 61 74 75 72 65 73 29 3f 6e 75 6c 6c 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6d 61 70 28 28 65 3d 3e 7b 76 61 72 20 74 2c 73 3b 72 65 74 75 72 6e 28 30 2c 69 2e 5a 29 28 7b 7d 2c 6e 75 6c 6c 3d 3d 28 74 3d 61 2e 63 2e 76 61 6c 75 65 29 7c 7c 6e 75 6c 6c 3d 3d 28 73 3d 74 2e 73 70 65 63 69 61 6c 46 65 61 74 75 72 65 73 29 3f 76 6f 69 64 20 30 3a 73 2e 66 69 6e 64 28 28 74 3d 3e 74 2e 69 64 3d 3d 3d 65 2e 69 64 29 29 2c 7b 69 64 3a 72 2e 47 59 5b 65 2e 69 64 5d 2c 6e 61 6d 65 73 70 61 63 65 3a 22 69 61 62 22 2c 69 73 53 70 65 Data Ascii: =d.z.value\|\|{};return!!t&&Array.isArray(t)&&!(null==(e=a.c.value)\|\|!e.specialFeatures)?null==t?void 0:t.map((e=>{var t,s;return(0,i.Z)({},null==(t=a.c.value)\|\|null==(s=t.specialFeatures)?void 0:s.find((t=>t.id===e.id)),{id:r.GY[e.id],namespace:"iab",isSpe
2023-12-19 09:22:18 UTC	16384	IN	Data Raw: 6e 75 6c 6c 3d 3d 28 73 3d 64 2e 64 65 6e 79 4f 70 74 69 6f 6e 73 29 3f 76 6f 69 64 20 30 3a 73 2e 62 75 74 74 6f 6e 29 7c 7c 6e 75 6c 6c 3d 3d 64 7c 7c 6e 75 6c 6c 3d 3d 28 69 3d 64 2e 64 65 6e 79 4f 70 74 69 6f 6e 73 29 7c 7c 21 69 2e 6c 69 6e 6b 7c 7c 6e 75 6c 6c 21 3d 64 26 26 64 2e 74 79 70 65 3f 6e 75 6c 6c 3d 3d 64 3f 76 6f 69 64 20 30 3a 64 2e 74 79 70 65 3a 22 6f 70 74 69 6e 22 2c 22 63 63 70 61 22 3d 3d 3d 28 6e 75 6c 6c 3d 3d 28 61 3d 72 2e 6e 6f 74 69 63 65 43 6f 6e 66 69 67 2e 76 61 6c 75 65 29 7c 7c 6e 75 6c 6c 3d 3d 28 75 3d 61 2e 72 65 67 75 6c 61 74 69 6f 6e 29 3f 76 6f 69 64 20 30 3a 75 2e 6e 61 6d 65 29 26 26 28 64 2e 74 79 70 65 3d 22 6f 70 74 6f 75 74 22 29 2c 64 2e 70 6f 73 69 74 69 6f 6e 3d 64 2e 70 6f 73 69 74 69 6f 6e 7c 7c 22 74 Data Ascii: null==(s=d.denyOptions)?void 0:s.button)\|\|null==d\|\|null==(i=d.denyOptions)\|\|!i.link\|\|null!=d&&d.type?null==d?void 0:d.type:"optin","ccpa"===(null==(a=r.noticeConfig.value)\|\|null==(u=a.regulation)?void 0:u.name)&&(d.type="optout"),d.position=d.position\|\|"t
2023-12-19 09:22:18 UTC	16384	IN	Data Raw: 7d 2c 65 2e 65 78 70 65 72 69 6d 65 6e 74 2c 7b 63 6f 6e 66 69 67 3a 74 7d 29 7d 29 2c 73 65 74 45 78 70 65 72 69 6d 65 6e 74 47 72 6f 75 70 3a 28 65 2c 74 29 3d 3e 28 7b 65 78 70 65 72 69 6d 65 6e 74 3a 28 30 2c 5f 2e 5a 29 28 7b 7d 2c 65 2e 65 78 70 65 72 69 6d 65 6e 74 2c 7b 67 72 6f 75 70 3a 74 7d 29 7d 29 2c 73 65 74 45 78 70 65 72 69 6d 65 6e 74 49 44 3a 28 65 2c 74 29 3d 3e 28 7b 65 78 70 65 72 69 6d 65 6e 74 3a 28 30 2c 5f 2e 5a 29 28 7b 7d 2c 65 2e 65 78 70 65 72 69 6d 65 6e 74 2c 7b 69 64 3a 74 7d 29 7d 29 2c 73 65 74 45 78 70 65 72 69 6d 65 6e 74 53 69 7a 65 3a 28 65 2c 74 29 3d 3e 28 7b 65 78 70 65 72 69 6d 65 6e 74 3a 28 30 2c 5f 2e 5a 29 28 7b 7d 2c 65 2e 65 78 70 65 72 69 6d 65 6e 74 2c 7b 73 69 7a 65 3a 74 7d 29 7d 29 2c 73 65 74 45 78 70 Data Ascii: },e.experiment,{config:t})}),setExperimentGroup:(e,t)=>({experiment:(0,_.Z)({},e.experiment,{group:t})}),setExperimentID:(e,t)=>({experiment:(0,_.Z)({},e.experiment,{id:t})}),setExperimentSize:(e,t)=>({experiment:(0,_.Z)({},e.experiment,{size:t})}),setExp
2023-12-19 09:22:18 UTC	16384	IN	Data Raw: 20 66 3d 65 3d 3e 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 65 28 2e 2e 2e 61 72 67 75 6d 65 6e 74 73 29 7d 63 61 74 63 68 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 43 61 6c 6c 62 61 63 6b 20 65 72 72 6f 72 20 61 74 20 54 43 46 20 41 50 49 20 65 78 65 63 75 74 69 6f 6e 22 2c 65 29 7d 7d 7d 2c 37 36 31 39 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 76 61 72 20 74 3d 28 22 3b 20 22 2b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 29 2e 73 70 6c 69 74 28 22 3b 20 22 2b 65 2b 22 3d 22 29 3b 72 65 74 75 72 6e 20 32 21 3d 3d 74 2e 6c 65 6e 67 74 68 3f 76 6f 69 64 20 30 3a 74 2e 70 6f 70 28 29 2e 73 70 6c 69 74 28 22 3b 22 29 2e 73 68 69 66 74 28 29 7d 73 Data Ascii: f=e=>function(){try{e(...arguments)}catch(e){console.error("Callback error at TCF API execution",e)}}},76192:function(e,t,s){"use strict";function i(e){var t=("; "+document.cookie).split("; "+e+"=");return 2!==t.length?void 0:t.pop().split(";").shift()}s
2023-12-19 09:22:19 UTC	16384	IN	Data Raw: 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 7d 2c 7b 22 69 64 22 3a 32 33 2c 22 6e 61 6d 65 22 3a 22 73 74 61 63 6b 5f 32 33 5f 6e 61 6d 65 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 73 74 61 63 6b 5f 32 33 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 7d 2c 7b 22 69 64 22 3a 32 34 2c 22 6e 61 6d 65 22 3a 22 73 74 61 63 6b 5f 32 34 5f 6e 61 6d 65 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 73 74 61 63 6b 5f 32 34 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 7d 2c 7b 22 69 64 22 3a 32 35 2c 22 6e 61 6d 65 22 3a 22 73 74 61 63 6b 5f 32 35 5f 6e 61 6d 65 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 73 74 61 63 6b 5f 32 35 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 7d 2c 7b 22 69 64 22 3a 32 36 2c 22 6e 61 6d 65 22 3a 22 73 74 61 63 6b 5f 32 36 5f 6e 61 6d 65 Data Ascii: _description"},{"id":23,"name":"stack_23_name","description":"stack_23_description"},{"id":24,"name":"stack_24_name","description":"stack_24_description"},{"id":25,"name":"stack_25_name","description":"stack_25_description"},{"id":26,"name":"stack_26_name
2023-12-19 09:22:19 UTC	16384	IN	Data Raw: 73 74 72 28 6e 2c 42 5b 78 2e 76 65 72 73 69 6f 6e 5d 29 2c 42 5b 78 2e 76 65 72 73 69 6f 6e 5d 29 29 2c 73 21 3d 3d 72 2e 43 4f 52 45 26 26 28 6e 2b 3d 42 2e 73 65 67 6d 65 6e 74 54 79 70 65 29 3b 76 61 72 20 6f 3d 74 68 69 73 2e 66 69 65 6c 64 53 65 71 75 65 6e 63 65 5b 53 74 72 69 6e 67 28 74 2e 76 65 72 73 69 6f 6e 29 5d 5b 73 5d 2c 61 3d 57 28 29 3b 72 65 74 75 72 6e 20 6f 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 76 61 72 20 73 3d 61 5b 65 5d 2c 72 3d 42 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 72 26 26 74 68 69 73 2e 69 73 50 75 62 6c 69 73 68 65 72 43 75 73 74 6f 6d 28 65 29 26 26 28 72 3d 4e 75 6d 62 65 72 28 74 5b 78 2e 6e 75 6d 43 75 73 74 6f 6d 50 75 72 70 6f 73 65 73 5d 29 29 2c 30 21 3d 3d 72 29 7b 76 61 72 20 6f 3d 69 2e 73 75 62 73 Data Ascii: str(n,B[x.version]),B[x.version])),s!==r.CORE&&(n+=B.segmentType);var o=this.fieldSequence[String(t.version)][s],a=W();return o.forEach((e=>{var s=a[e],r=B[e];if(void 0===r&&this.isPublisherCustom(e)&&(r=Number(t[x.numCustomPurposes])),0!==r){var o=i.subs
2023-12-19 09:22:19 UTC	13232	IN	Data Raw: 6d 70 53 74 61 74 75 73 3d 24 2e 4c 4f 41 44 49 4e 47 2c 74 68 69 73 2e 64 69 73 61 62 6c 65 64 3d 21 31 2c 74 68 69 73 2e 64 69 73 70 6c 61 79 53 74 61 74 75 73 3d 58 2e 48 49 44 44 45 4e 2c 74 68 69 73 2e 65 76 65 6e 74 51 75 65 75 65 2e 63 6c 65 61 72 28 29 2c 74 68 69 73 2e 72 65 73 74 72 69 63 74 69 6f 6e 73 43 61 63 68 65 2e 63 6c 65 61 72 28 29 7d 7d 68 65 2e 61 70 69 56 65 72 73 69 6f 6e 3d 22 32 22 2c 68 65 2e 74 63 66 50 6f 6c 69 63 79 56 65 72 73 69 6f 6e 3d 76 6f 69 64 20 30 2c 68 65 2e 65 76 65 6e 74 51 75 65 75 65 3d 6e 65 77 20 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 65 76 65 6e 74 51 75 65 75 65 3d 6e 65 77 20 4d 61 70 2c 74 68 69 73 2e 71 75 65 75 65 4e 75 6d 62 65 72 3d 30 7d 61 64 64 28 65 29 7b 72 65 Data Ascii: mpStatus=$.LOADING,this.disabled=!1,this.displayStatus=X.HIDDEN,this.eventQueue.clear(),this.restrictionsCache.clear()}}he.apiVersion="2",he.tcfPolicyVersion=void 0,he.eventQueue=new class{constructor(){this.eventQueue=new Map,this.queueNumber=0}add(e){re
2023-12-19 09:22:19 UTC	16384	IN	Data Raw: 65 6c 28 21 31 2c 74 29 2c 74 68 69 73 2e 5f 5f 74 63 66 61 70 69 3d 74 68 69 73 2e 63 6d 70 41 70 69 2e 63 61 6c 6c 52 65 73 70 6f 6e 64 65 72 2c 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 3d 28 65 2c 74 2c 73 2c 69 29 3d 3e 74 68 69 73 2e 68 61 6e 64 6c 65 43 6f 6d 6d 61 6e 64 28 65 2c 69 2c 73 2c 74 2c 21 31 29 2c 65 26 26 28 28 30 2c 58 65 2e 6f 6e 29 28 22 6e 6f 74 69 63 65 2e 73 68 6f 77 6e 22 2c 28 28 29 3d 3e 74 68 69 73 2e 73 65 74 43 6d 70 41 70 69 54 63 4d 6f 64 65 6c 28 21 30 2c 74 68 69 73 2e 73 65 72 76 69 63 65 73 2e 53 74 6f 72 61 67 65 53 65 72 76 69 63 65 2e 67 65 74 43 6f 6e 73 65 6e 74 53 74 72 69 6e 67 46 72 6f 6d 4c 6f 63 61 6c 53 74 6f 72 65 28 29 7c 7c 74 68 69 73 2e 64 65 66 61 75 6c 74 43 6f 6e 73 65 6e 74 53 74 72 69 6e 67 29 Data Ascii: el(!1,t),this.__tcfapi=this.cmpApi.callResponder,window.__tcfapi=(e,t,s,i)=>this.handleCommand(e,i,s,t,!1),e&&((0,Xe.on)("notice.shown",(()=>this.setCmpApiTcModel(!0,this.services.StorageService.getConsentStringFromLocalStore()\|\|this.defaultConsentString)
2023-12-19 09:22:19 UTC	16384	IN	Data Raw: 66 22 3a 5b 33 5d 2c 22 73 66 22 3a 5b 31 5d 7d 2c 7b 22 69 22 3a 32 35 34 2c 22 70 22 3a 5b 31 2c 32 2c 33 2c 34 2c 37 5d 2c 22 73 70 22 3a 5b 31 2c 32 5d 2c 22 66 22 3a 5b 33 5d 2c 22 73 66 22 3a 5b 31 5d 7d 2c 7b 22 69 22 3a 32 35 35 2c 22 70 22 3a 5b 31 2c 33 2c 34 2c 35 2c 36 5d 2c 22 66 70 22 3a 5b 32 2c 37 2c 38 5d 2c 22 73 70 22 3a 5b 32 5d 2c 22 6c 22 3a 5b 32 2c 37 2c 38 5d 7d 2c 7b 22 69 22 3a 32 35 36 2c 22 70 22 3a 5b 31 2c 33 2c 34 5d 2c 22 66 70 22 3a 5b 32 5d 2c 22 73 70 22 3a 5b 31 2c 32 5d 2c 22 6c 22 3a 5b 32 2c 37 2c 39 2c 31 30 5d 2c 22 66 22 3a 5b 31 2c 32 5d 7d 2c 7b 22 69 22 3a 32 35 39 2c 22 70 22 3a 5b 31 2c 32 2c 33 2c 34 2c 37 5d 2c 22 73 70 22 3a 5b 31 2c 32 5d 2c 22 66 22 3a 5b 33 5d 7d 2c 7b 22 69 22 3a 32 36 32 2c 22 70 22 Data Ascii: f":[3],"sf":[1]},{"i":254,"p":[1,2,3,4,7],"sp":[1,2],"f":[3],"sf":[1]},{"i":255,"p":[1,3,4,5,6],"fp":[2,7,8],"sp":[2],"l":[2,7,8]},{"i":256,"p":[1,3,4],"fp":[2],"sp":[1,2],"l":[2,7,9,10],"f":[1,2]},{"i":259,"p":[1,2,3,4,7],"sp":[1,2],"f":[3]},{"i":262,"p"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49778	35.227.233.104	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:18 UTC	581	OUT	GET /revamp/sft-prebid.js HTTP/1.1 Host: softonic.com.br Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://caffeine.softonic.com.br sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:18 UTC	1221	IN	HTTP/1.1 200 OK Content-Length: 353017 server: istio-envoy content-type: application/javascript; charset=utf-8 cache-control: max-age=172500, public, s-maxage=172800, stale-if-error=31536000, stale-while-revalidate=864000 x-publisher-id: softonic etag: "eed89fba9f566c05e48ed29b22879654" x-version: 1.1306.0 x-request-id: cfabdb6c-4ede-414a-9393-f765ed0e8b1c x-envoy-upstream-service-time: 10 accept-ranges: bytes date: Tue, 19 Dec 2023 09:22:18 GMT age: 275 x-served-by: cache-ams21030-AMS, cache-bfi-krnt7300109-BFI x-cache: MISS, HIT x-cache-hits: 0, 1 x-timer: S1702977739.822569,VS0,VE3 vary: Accept-Encoding,x-country-code,x-device-platform access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform access-control-allow-origin: * x-country-code: US x-region: FL x-device-platform: Desktop x-browser-name: Chrome x-browser-version: 117.0.0.0 x-platform-id: Windows 10 x-platform-version: NT 10.0 alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 Via: 1.1 google, 1.1 varnish, 1.1 varnish, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:18 UTC	31	IN	Data Raw: 69 66 28 77 69 6e 64 6f 77 2e 70 62 6a 73 26 26 77 69 6e 64 6f 77 2e 70 62 6a 73 2e 6c 69 62 Data Ascii: if(window.pbjs&&window.pbjs.lib
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 4c 6f 61 64 65 64 29 74 72 79 7b 77 69 6e 64 6f 77 2e 70 62 6a 73 2e 67 65 74 43 6f 6e 66 69 67 28 22 64 65 62 75 67 22 29 26 26 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 41 74 74 65 6d 70 74 65 64 20 74 6f 20 6c 6f 61 64 20 61 20 63 6f 70 79 20 6f 66 20 50 72 65 62 69 64 2e 6a 73 20 74 68 61 74 20 63 6c 61 73 68 65 73 20 77 69 74 68 20 74 68 65 20 65 78 69 73 74 69 6e 67 20 27 70 62 6a 73 27 20 69 6e 73 74 61 6e 63 65 2e 20 4c 6f 61 64 20 61 62 6f 72 74 65 64 2e 22 29 7d 63 61 74 63 68 28 65 29 7b 7d 65 6c 73 65 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 6e 3d 7b 33 35 37 30 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 2e 64 28 6e 2c 7b 50 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 Data Ascii: Loaded)try{window.pbjs.getConfig("debug")&&console.warn("Attempted to load a copy of Prebid.js that clashes with the existing 'pbjs' instance. Load aborted.")}catch(e){}else (function(){!function(){var e,n={35706:function(e,n,t){t.d(n,{Pd:function(){retur
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 63 74 69 6f 6e 20 66 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 6e 75 6c 6c 3b 65 2e 63 6f 6e 66 69 67 26 26 65 2e 63 6f 6e 66 69 67 2e 64 6f 63 75 6d 65 6e 74 52 65 73 6f 6c 76 65 72 26 26 28 72 3d 65 2e 63 6f 6e 66 69 67 2e 64 6f 63 75 6d 65 6e 74 52 65 73 6f 6c 76 65 72 28 6e 2c 64 6f 63 75 6d 65 6e 74 2c 74 29 29 2c 72 7c 7c 28 72 3d 64 6f 63 75 6d 65 6e 74 29 2c 65 2e 64 6f 63 75 6d 65 6e 74 43 6f 6e 74 65 78 74 3d 72 2c 65 2e 72 65 6e 64 65 72 28 6e 2c 65 2e 64 6f 63 75 6d 65 6e 74 43 6f 6e 74 65 78 74 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 76 61 72 20 6e 3d 75 2e 61 64 55 6e 69 74 73 2c 74 3d 28 30 2c 61 2e 73 45 29 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 2e 63 6f 64 65 3d 3d 3d 65 7d 29 29 3b 69 66 28 21 74 Data Ascii: ction f(e,n,t){var r=null;e.config&&e.config.documentResolver&&(r=e.config.documentResolver(n,document,t)),r\|\|(r=document),e.documentContext=r,e.render(n,e.documentContext)}function l(e){var n=u.adUnits,t=(0,a.sE)(n,(function(n){return n.code===e}));if(!t
2023-12-19 09:22:18 UTC	428	IN	Data Raw: 6f 7d 2c 55 45 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 2c 67 30 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 2c 6f 4b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 2c 78 24 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 3b 76 61 72 20 72 3d 22 61 63 63 65 73 73 44 65 76 69 63 65 22 2c 69 3d 22 73 79 6e 63 55 73 65 72 22 2c 6f 3d 22 65 6e 72 69 63 68 55 66 70 64 22 2c 61 3d 22 65 6e 72 69 63 68 45 69 64 73 22 2c 75 3d 22 66 65 74 63 68 42 69 64 73 22 2c 63 3d 22 72 65 70 6f 72 74 41 6e 61 6c 79 74 69 63 73 22 2c 73 3d 22 74 72 61 6e 73 6d 69 74 45 69 64 73 22 2c 64 3d 22 74 72 61 6e 73 6d 69 74 55 66 70 64 22 Data Ascii: o},UE:function(){return u},e:function(){return s},g0:function(){return f},oK:function(){return d},x$:function(){return c}});var r="accessDevice",i="syncUser",o="enrichUfpd",a="enrichEids",u="fetchBids",c="reportAnalytics",s="transmitEids",d="transmitUfpd"
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 39 36 33 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 2e 64 28 6e 2c 7b 55 4c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 2c 58 47 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 2c 5f 55 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 77 75 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 79 32 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 3b 76 61 72 20 72 3d 22 70 72 65 62 69 64 22 2c 69 3d 22 62 69 64 64 65 72 22 2c 6f 3d 22 75 73 65 72 49 64 22 2c 61 3d 22 72 74 64 22 2c 75 3d 22 61 6e 61 6c 79 74 69 63 73 22 7d 2c 31 36 33 31 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 2e 64 28 6e 2c 7b 24 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 Data Ascii: 9633:function(e,n,t){t.d(n,{UL:function(){return i},XG:function(){return a},_U:function(){return u},wu:function(){return r},y2:function(){return o}});var r="prebid",i="bidder",o="userId",a="rtd",u="analytics"},16310:function(e,n,t){t.d(n,{$k:function(){re
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 65 72 61 74 6f 72 22 5d 3b 69 66 28 21 74 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 7c 7c 28 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 29 72 65 74 75 72 6e 20 64 28 65 2c 6e 29 3b 76 61 72 20 74 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 2e 73 6c 69 63 65 28 38 2c 2d 31 29 3b 22 4f 62 6a 65 63 74 22 3d 3d 3d 74 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 26 26 28 74 3d 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 29 3b 69 66 28 22 4d 61 70 22 3d 3d 3d 74 7c 7c 22 53 65 74 22 3d 3d 3d 74 29 72 65 74 75 72 6e 20 41 72 72 61 79 2e 66 72 6f 6d 28 65 29 3b 69 66 28 Data Ascii: erator"];if(!t){if(Array.isArray(e)\|\|(t=function(e,n){if(!e)return;if("string"==typeof e)return d(e,n);var t=Object.prototype.toString.call(e).slice(8,-1);"Object"===t&&e.constructor&&(t=e.constructor.name);if("Map"===t\|\|"Set"===t)return Array.from(e);if(
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 7b 7d 2c 72 75 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 2c 69 29 7b 76 61 72 20 6f 3d 74 26 26 74 5b 72 5d 3b 69 66 28 6d 28 6f 29 26 26 69 28 29 29 7b 76 61 72 20 61 3d 74 68 69 73 2e 67 65 74 28 6f 29 3b 76 6f 69 64 20 30 3d 3d 3d 61 3f 64 65 6c 65 74 65 20 74 5b 72 5d 3a 74 5b 72 5d 3d 61 7d 7d 7d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 70 61 74 68 73 3d 65 2e 70 61 74 68 73 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 73 70 6c 69 74 28 22 2e 22 29 2c 74 3d 6e 2e 70 6f 70 28 29 3b 72 65 74 75 72 6e 5b 6e 2e 6c 65 6e 67 74 68 3e 30 3f 6e 2e 6a 6f 69 6e 28 22 2e 22 29 3a 6e 75 6c 6c 2c 74 5d 7d 29 29 Data Ascii: {},run:function(e,n,t,r,i){var o=t&&t[r];if(m(o)&&i()){var a=this.get(o);void 0===a?delete t[r]:t[r]=a}}},e)}function v(e){return e.forEach((function(e){e.paths=e.paths.map((function(e){var n=e.split("."),t=n.pop();return[n.length>0?n.join("."):null,t]}))
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 6f 72 74 62 32 49 6d 70 2e 65 78 74 2e 74 69 64 22 5d 2c 61 70 70 6c 69 65 73 3a 62 28 63 2e 4a 74 2c 65 29 7d 5d 2e 6d 61 70 28 70 29 7d 66 75 6e 63 74 69 6f 6e 20 77 28 29 7b 76 61 72 20 65 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 30 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3a 75 2e 78 44 3b 72 65 74 75 72 6e 5b 7b 6e 61 6d 65 3a 63 2e 6f 4b 2c 70 61 74 68 73 3a 66 2c 61 70 70 6c 69 65 73 3a 62 28 63 2e 6f 4b 2c 65 29 7d 2c 7b 6e 61 6d 65 3a 63 2e 65 2c 70 61 74 68 73 3a 6c 2c 61 70 70 6c 69 65 73 3a 62 28 63 2e 65 2c 65 29 7d 2c 7b 6e 61 6d 65 3a 63 2e 67 30 2c 70 61 74 68 73 3a 67 2c 61 70 70 6c 69 65 73 3a 62 28 63 2e 67 30 2c 65 29 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e Data Ascii: ortb2Imp.ext.tid"],applies:b(c.Jt,e)}].map(p)}function w(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:u.xD;return[{name:c.oK,paths:f,applies:b(c.oK,e)},{name:c.e,paths:l,applies:b(c.e,e)},{name:c.g0,paths:g,applies:b(c.g0,e),get:function
2023-12-19 09:22:18 UTC	1252	IN	Data Raw: 26 26 65 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 65 2e 6c 65 6e 67 74 68 29 7b 74 26 26 28 65 3d 74 29 3b 76 61 72 20 72 3d 30 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 72 65 74 75 72 6e 7b 73 3a 69 2c 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 3e 3d 65 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 30 7d 3a 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 65 5b 72 2b 2b 5d 7d 7d 2c 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 65 7d 2c 66 3a 69 7d 7d 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 61 74 74 65 6d 70 74 20 74 6f 20 69 74 65 72 61 74 65 20 6e 6f 6e 2d 69 74 65 72 61 62 6c 65 20 69 6e 73 74 61 6e 63 65 2e 5c 6e 49 6e 20 6f 72 64 65 72 20 74 6f 20 62 65 Data Ascii: &&e&&"number"==typeof e.length){t&&(e=t);var r=0,i=function(){};return{s:i,n:function(){return r>=e.length?{done:!0}:{done:!1,value:e[r++]}},e:function(e){throw e},f:i}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be
2023-12-19 09:22:18 UTC	279	IN	Data Raw: 72 6e 20 64 65 6c 65 74 65 20 63 5b 75 5d 7d 29 2c 73 29 2c 21 64 29 7b 76 61 72 20 66 3d 5b 75 5d 3b 6f 26 26 66 2e 70 75 73 68 28 6f 29 2c 28 69 3f 65 2e 6c 6f 67 49 6e 66 6f 3a 65 2e 6c 6f 67 57 61 72 6e 29 2e 61 70 70 6c 79 28 65 2c 66 29 7d 7d 72 65 74 75 72 6e 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 76 61 72 20 6f 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 33 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 33 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 33 5d 3a 31 30 2c 61 3d 74 28 65 29 2c 75 3d 61 2e 66 69 6e 64 49 6e 64 65 78 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 28 30 2c 72 2e 5a 29 28 65 2c 31 29 5b 30 5d 3b 72 65 74 75 72 6e 20 6f 3c 6e 7d 29 29 2c 63 3d 5b 6f 2c 6e 2c 69 5d 3b 72 65 74 75 72 Data Ascii: rn delete c[u]}),s),!d){var f=[u];o&&f.push(o),(i?e.logInfo:e.logWarn).apply(e,f)}}return[function(e,n,i){var o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:10,a=t(e),u=a.findIndex((function(e){var n=(0,r.Z)(e,1)[0];return o<n})),c=[o,n,i];retur

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49781	142.250.189.132	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:18 UTC	825	OUT	GET /adsense/search/ads.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:19 UTC	854	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui" Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} Content-Length: 145912 Date: Tue, 19 Dec 2023 09:22:18 GMT Expires: Tue, 19 Dec 2023 09:22:18 GMT Cache-Control: private, max-age=3600 ETag: "15619041008909029215" X-Content-Type-Options: nosniff Link: <https://www.adsensecustomsearchads.com>; rel="preconnect" Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:19 UTC	398	IN	Data Raw: 69 66 28 21 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 29 7b 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 3d 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 41 6c 74 4c 6f 61 64 65 72 3d 33 3b 76 61 72 20 73 66 66 65 44 61 74 61 5f 3d 7b 73 65 72 76 69 63 65 5f 68 6f 73 74 3a 22 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 68 61 73 68 3a 22 31 35 37 35 34 35 37 32 35 33 37 39 39 37 38 37 34 35 34 35 22 2c 70 61 63 6b 61 67 65 73 3a 22 73 65 61 72 63 68 22 2c 6d 6f 64 75 6c 65 3a 22 61 64 73 22 2c 76 65 72 73 69 6f 6e 3a 22 33 22 2c 6d 3a 7b 63 65 69 3a 22 31 37 33 30 30 30 30 32 2c 31 37 33 30 31 33 38 33 22 2c 61 68 3a Data Ascii: if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"15754572537997874545",packages:"search",module:"ads",version:"3",m:{cei:"17300002,17301383",ah:
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 63 68 47 77 73 52 65 71 75 65 73 74 54 6f 55 73 65 41 64 73 65 6e 73 65 44 6f 6d 61 69 6e 22 3a 74 72 75 65 2c 22 5f 75 73 65 53 65 72 76 65 72 50 72 6f 76 69 64 65 64 44 6f 6d 61 69 6e 22 3a 74 72 75 65 2c 22 5f 77 61 69 74 4f 6e 43 6f 6e 73 65 6e 74 46 6f 72 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 45 6e 68 61 6e 63 65 64 54 61 72 67 65 74 69 6e 67 52 73 6f 6e 63 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 4e 6f 6e 62 6c 6f 63 6b 69 6e 67 53 61 73 43 6f 6f 6b 69 65 22 3a 74 72 75 65 7d 2c 6d 64 70 3a 31 38 30 30 30 30 30 2c 73 73 64 6c 3a 22 59 58 42 77 63 33 42 76 64 43 35 6a 62 32 30 73 59 6d 78 76 5a 33 4e 77 62 33 51 75 59 32 39 74 4c 47 4a 79 4c 6d 4e 76 62 53 78 6a 62 79 35 6a 62 32 30 73 59 32 78 76 Data Ascii: chGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xv
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 2b 22 5f 22 2b 65 2b 2b 2c 66 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 66 2c 67 29 7b 74 68 69 73 2e 50 64 3d 66 3b 62 61 28 74 68 69 73 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 67 7d 29 7d 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 50 64 7d 3b 76 61 72 20 64 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 31 45 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 3e 30 29 2b 22 5f 22 2c 65 3d 30 3b 72 65 74 75 72 6e 20 62 7d 29 3b 0a 66 61 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 Data Ascii: +"_"+e++,f)}function c(f,g){this.Pd=f;ba(this,"description",{configurable:!0,writable:!0,value:g})}if(a)return a;c.prototype.toString=function(){return this.Pd};var d="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",e=0;return b});fa("Symbol.iterator",functi
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 7b 76 61 72 20 6e 61 3b 61 3a 7b 76 61 72 20 6f 61 3d 7b 61 3a 21 30 7d 2c 70 61 3d 7b 7d 3b 74 72 79 7b 70 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 6f 61 3b 6e 61 3d 70 61 2e 61 3b 62 72 65 61 6b 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 6e 61 3d 21 31 7d 6d 61 3d 6e 61 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 3b 69 66 28 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 21 3d 3d 62 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 61 2b 22 20 69 73 20 6e 6f 74 20 65 78 74 65 6e 73 69 62 6c 65 22 29 3b 72 65 74 75 72 6e 20 61 7d 3a 6e 75 6c 6c 7d 76 61 72 20 71 61 3d 6d 61 3b 0a 66 75 6e 63 74 69 6f 6e 20 72 61 28 61 2c 62 29 7b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6c 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 29 3b 61 2e 70 72 Data Ascii: {var na;a:{var oa={a:!0},pa={};try{pa.__proto__=oa;na=pa.a;break a}catch(a){}na=!1}ma=na?function(a,b){a.__proto__=b;if(a.__proto__!==b)throw new TypeError(a+" is not extensible");return a}:null}var qa=ma;function ra(a,b){a.prototype=la(b.prototype);a.pr
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 6e 20 66 75 6e 63 74 69 6f 6e 28 70 29 7b 6b 7c 7c 28 6b 3d 21 30 2c 6c 2e 63 61 6c 6c 28 68 2c 70 29 29 7d 7d 76 61 72 20 68 3d 74 68 69 73 2c 6b 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 67 28 74 68 69 73 2e 72 66 29 2c 72 65 6a 65 63 74 3a 67 28 74 68 69 73 2e 4a 63 29 7d 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 72 66 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 69 66 28 67 3d 3d 3d 74 68 69 73 29 74 68 69 73 2e 4a 63 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 41 20 50 72 6f 6d 69 73 65 20 63 61 6e 6e 6f 74 20 72 65 73 6f 6c 76 65 20 74 6f 20 69 74 73 65 6c 66 22 29 29 3b 65 6c 73 65 20 69 66 28 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 74 68 69 73 2e 41 66 28 67 29 3b 65 6c 73 65 7b 61 3a 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 67 Data Ascii: n function(p){k\|\|(k=!0,l.call(h,p))}}var h=this,k=!1;return{resolve:g(this.rf),reject:g(this.Jc)}};b.prototype.rf=function(g){if(g===this)this.Jc(new TypeError("A Promise cannot resolve to itself"));else if(g instanceof b)this.Af(g);else{a:switch(typeof g
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 6e 3d 74 68 69 73 2e 50 61 3b 72 65 74 75 72 6e 20 6b 28 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4a 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 75 6c 6c 21 3d 74 68 69 73 2e 79 61 29 7b 66 6f 72 28 76 61 72 20 67 3d 0a 30 3b 67 3c 74 68 69 73 2e 79 61 2e 6c 65 6e 67 74 68 3b 2b 2b 67 29 66 2e 64 64 28 74 68 69 73 2e 79 61 5b 67 5d 29 3b 74 68 69 73 2e 79 61 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 63 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 41 66 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 63 63 28 29 3b 67 2e 63 62 28 68 2e 72 65 73 6f 6c 76 65 2c 68 2e 72 65 6a 65 63 74 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 42 66 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 63 Data Ascii: n=this.Pa;return k(g)};b.prototype.Je=function(){if(null!=this.ya){for(var g=0;g<this.ya.length;++g)f.dd(this.ya[g]);this.ya=null}};var f=new c;b.prototype.Af=function(g){var h=this.cc();g.cb(h.resolve,h.reject)};b.prototype.Bf=function(g,h){var k=this.c
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 31 3b 63 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 61 72 67 75 6d 65 6e 74 73 5b 63 5d 3b 69 66 28 64 29 66 6f 72 28 76 61 72 20 65 20 69 6e 20 64 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 64 2c 65 29 26 26 28 61 5b 65 5d 3d 64 5b 65 5d 29 7d 72 65 74 75 72 6e 20 61 7d 3b 66 61 28 22 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7c 7c 74 61 7d 29 3b 0a 66 75 6e 63 74 69 6f 6e 20 75 61 28 61 2c 62 2c 63 29 7b 69 66 28 6e 75 6c 6c 3d 3d 61 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 Data Ascii: on(a,b){for(var c=1;c<arguments.length;c++){var d=arguments[c];if(d)for(var e in d)Object.prototype.hasOwnProperty.call(d,e)&&(a[e]=d[e])}return a};fa("Object.assign",function(a){return a\|\|ta});function ua(a,b,c){if(null==a)throw new TypeError("The 'this
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 3a 62 28 66 2c 61 5b 66 5d 29 2c 64 6f 6e 65 3a 21 31 7d 7d 64 3d 21 30 3b 72 65 74 75 72 6e 7b 64 6f 6e 65 3a 21 30 2c 76 61 6c 75 65 3a 76 6f 69 64 20 30 7d 7d 7d 3b 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 3b 72 65 74 75 72 6e 20 65 7d 66 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 76 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 66 61 28 22 4f 62 6a 65 63 74 2e 76 61 6c 75 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f Data Ascii: :b(f,a[f]),done:!1}}d=!0;return{done:!0,value:void 0}}};e[Symbol.iterator]=function(){return e};return e}fa("Array.prototype.keys",function(a){return a?a:function(){return va(this,function(b){return b})}});fa("Object.values",function(a){return a?a:functio
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 7c 73 65 6c 66 3b 66 75 6e 63 74 69 6f 6e 20 77 61 28 61 29 7b 76 61 72 20 62 3d 74 79 70 65 6f 66 20 61 3b 62 3d 22 6f 62 6a 65 63 74 22 21 3d 62 3f 62 3a 61 3f 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 3f 22 61 72 72 61 79 22 3a 62 3a 22 6e 75 6c 6c 22 3b 72 65 74 75 72 6e 22 61 72 72 61 79 22 3d 3d 62 7c 7c 22 6f 62 6a 65 63 74 22 3d 3d 62 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 7d 66 75 6e 63 74 69 6f 6e 20 78 61 28 61 29 7b 76 61 72 20 62 3d 74 79 70 65 6f 66 20 61 3b 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3d 3d 62 26 26 6e 75 6c 6c 21 3d 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 62 7d 66 75 6e 63 74 69 6f 6e 20 79 61 28 61 2c 62 29 7b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 76 61 72 20 63 3d Data Ascii: \|self;function wa(a){var b=typeof a;b="object"!=b?b:a?Array.isArray(a)?"array":b:"null";return"array"==b\|\|"object"==b&&"number"==typeof a.length}function xa(a){var b=typeof a;return"object"==b&&null!=a\|\|"function"==b}function ya(a,b){a=a.split(".");var c=
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 7d 3b 66 75 6e 63 74 69 6f 6e 20 4e 61 28 29 7b 74 68 69 73 2e 64 61 74 61 3d 48 61 28 22 70 63 22 29 7d 66 75 6e 63 74 69 6f 6e 20 4f 61 28 29 7b 76 61 72 20 61 3d 45 61 3b 61 7c 7c 28 61 3d 6e 65 77 20 4e 61 2c 47 61 28 29 2e 67 64 26 26 28 45 61 3d 61 29 29 3b 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 61 28 61 29 7b 72 65 74 75 72 6e 21 21 61 2e 64 61 74 61 2e 63 67 6e 61 7d 66 75 6e 63 74 69 6f 6e 20 53 61 28 29 7b 74 68 69 73 2e 64 61 74 61 3d 48 61 28 22 64 63 22 29 7d 66 75 6e 63 74 69 6f 6e 20 54 61 28 29 7b 76 61 72 20 61 3d 46 61 3b 61 7c 7c 28 61 3d 6e 65 77 20 53 61 2c 47 61 28 29 2e 67 64 26 26 28 46 61 3d 61 29 29 3b 72 65 74 75 72 6e 20 61 7d 3b 76 61 72 20 55 61 3b 66 75 6e 63 74 69 6f 6e 20 56 61 28 61 29 7b 76 61 72 20 62 Data Ascii: };function Na(){this.data=Ha("pc")}function Oa(){var a=Ea;a\|\|(a=new Na,Ga().gd&&(Ea=a));return a}function Ra(a){return!!a.data.cgna}function Sa(){this.data=Ha("dc")}function Ta(){var a=Fa;a\|\|(a=new Sa,Ga().gd&&(Fa=a));return a};var Ua;function Va(a){var b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49784	35.227.233.104	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:18 UTC	1012	OUT	POST /plausible/api/event HTTP/1.1 Host: caffeine.softonic.com.br Connection: keep-alive Content-Length: 195 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _usr_orgn=direct; _swo_pos=341; session.pv=1; persistent.fpmUserId=75c494bb-9642-443c-9078-46f928a097b4; session.fpmSessionId=f3c99309-04ba-4e51-b2a2-fb42d95561db; _gcl_au=1.1.133230612.1702977737; rv_prebid_position=18; rv_test_position=111; rv_fp_ad_session_id=ca334998-1875-4288-9025-8f913da6a89a; rv_fp_pv=1; rv_google_ppid=a621a63a-2788-4df7-a4b3-b3d6a6693bad
2023-12-19 09:22:18 UTC	195	OUT	Data Raw: 7b 22 6e 22 3a 22 52 65 76 61 6d 70 4c 6f 61 64 65 64 22 2c 22 75 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 72 22 3a 6e 75 6c 6c 2c 22 77 22 3a 31 32 38 30 2c 22 68 22 3a 30 2c 22 70 22 3a 22 7b 5c 22 6c 61 62 65 6c 5c 22 3a 5c 22 6e 2f 61 5c 22 2c 5c 22 76 65 72 73 69 6f 6e 5c 22 3a 5c 22 31 2e 31 33 30 36 2e 30 5c 22 2c 5c 22 6c 6f 67 69 63 5c 22 3a 5c 22 6e 2f 61 5c 22 2c 5c 22 73 65 67 6d 65 6e 74 5c 22 3a 5c 22 6e 2f 61 5f 6e 2f 61 5f 55 53 5c 22 7d 22 7d Data Ascii: {"n":"RevampLoaded","u":"https://caffeine.softonic.com.br/","d":"softonic","r":null,"w":1280,"h":0,"p":"{\"label\":\"n/a\",\"version\":\"1.1306.0\",\"logic\":\"n/a\",\"segment\":\"n/a_n/a_US\"}"}
2023-12-19 09:22:19 UTC	479	IN	HTTP/1.1 202 Accepted access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: cache-control: max-age=0, private, must-revalidate Content-Length: 2 content-type: text/plain; charset=utf-8 date: Tue, 19 Dec 2023 09:22:18 GMT server: istio-envoy x-request-id: 46a333d6-234a-4b56-bd28-ecb35d3962e6 x-envoy-upstream-service-time: 3 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:19 UTC	2	IN	Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49785	35.227.233.104	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:18 UTC	1292	OUT	GET /best-recommended-apps?appId=f46a4db4-96d4-11e6-b215-00163ec9f5fa&categoryId=utilities-tools&pageId=app&developerSlug=zhornsoftware&platformId=windows&locale=pt-BR&programName=Caffeine&browserName=chrome&browserVersion=117.0.0.0&countryCode=US&deviceType=desktop&isEU=false&isuserfornia=false&region=FL&userPlatformId=windows&userPlatformVersion=10.0&placementId=download-intent&position=85 HTTP/1.1 Host: caffeine.softonic.com.br Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _usr_orgn=direct; _swo_pos=341; session.pv=1; persistent.fpmUserId=75c494bb-9642-443c-9078-46f928a097b4; session.fpmSessionId=f3c99309-04ba-4e51-b2a2-fb42d95561db; _gcl_au=1.1.133230612.1702977737; rv_prebid_position=18; rv_test_position=111; rv_fp_ad_session_id=ca334998-1875-4288-9025-8f913da6a89a; rv_fp_pv=1; rv_google_ppid=a621a63a-2788-4df7-a4b3-b3d6a6693bad
2023-12-19 09:22:19 UTC	781	IN	HTTP/1.1 200 OK x-version: 4.431.0 x-server-by: cpi-api x-resource-id: @cpi-api/bestRecommendedApps x-page-id: bestRecommendedApps x-request-id: 68eb8607-676f-4885-9dd5-01d80125c99d vary: Origin, accept-encoding access-control-allow-origin: * cache-control: no-cache,no-store,max-age=0,must-revalidate x-suitable-campaigns-count: 4 x-winner-campaign-id: winzip-compression x-winner-campaign-logic: sov x-country-code: US x-user-platform: windows x-publisher-id: softonic x-publisher-projection-version: 3902 content-type: application/json; charset=utf-8 Content-Length: 6234 date: Tue, 19 Dec 2023 09:22:19 GMT x-envoy-upstream-service-time: 17 server: istio-envoy Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 7b 22 77 69 6e 6e 65 72 43 61 6d 70 61 69 67 6e 22 3a 7b 22 69 64 22 3a 22 77 69 6e 7a 69 70 2d 63 6f 6d 70 72 65 73 73 69 6f 6e 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 6c 6f 67 69 63 22 3a 22 73 6f 76 22 2c 22 63 72 65 61 74 69 76 69 74 79 22 3a 7b 22 74 65 6d 70 6c 61 74 65 49 64 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 74 65 6d 70 6c 61 74 65 53 65 74 74 69 6e 67 73 22 3a 7b 22 64 69 73 63 6c 61 69 6d 65 72 43 6f 6c 6f 72 22 3a 22 23 37 31 37 34 37 61 22 2c 22 74 69 74 6c 65 43 6f 6c 6f 72 22 3a 22 23 31 34 31 34 31 35 22 2c 22 73 75 62 74 69 74 6c 65 43 6f 6c 6f 72 22 3a 22 23 31 34 31 34 31 35 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 23 66 66 66 22 2c 22 63 74 61 42 61 63 6b 67 72 6f 75 Data Ascii: {"winnerCampaign":{"id":"winzip-compression","publisherId":"softonic","logic":"sov","creativity":{"templateId":"default","templateSettings":{"disclaimerColor":"#71747a","titleColor":"#141415","subtitleColor":"#141415","backgroundColor":"#fff","ctaBackgrou
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 22 3a 22 5a 69 70 20 66 69 6c 65 73 20 66 72 6f 6d 20 61 6e 79 20 6c 6f 63 61 74 69 6f 6e 22 2c 22 66 65 61 74 75 72 65 43 22 3a 22 50 72 6f 74 65 63 74 c2 a0 66 69 6c 65 73 20 77 69 74 68 20 62 61 6e 6b 69 6e 67 2d 6c 65 76 65 6c 20 65 6e 63 72 79 70 74 69 6f 6e 22 2c 22 73 75 62 54 69 74 6c 65 22 3a 22 5a 69 70 2c 20 55 6e 7a 69 70 20 61 6e 64 20 53 68 61 72 65 22 2c 22 63 75 73 74 6f 6d 22 3a 7b 22 64 69 73 63 6c 61 69 6d 65 72 4c 69 6e 6b 55 72 6c 22 3a 22 22 2c 22 64 69 73 63 6c 61 69 6d 65 72 4c 69 6e 6b 54 65 78 74 22 3a 22 22 2c 22 6f 70 74 69 6f 6e 61 6c 44 69 73 63 6c 61 69 6d 65 72 22 3a 22 22 7d 7d 2c 22 62 75 69 6c 64 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 77 69 6e 7a 69 70 2e 63 6f 6d 2f 67 6c 2f 6f Data Ascii: ":"Zip files from any location","featureC":"Protectfiles with banking-level encryption","subTitle":"Zip, Unzip and Share","custom":{"disclaimerLinkUrl":"","disclaimerLinkText":"","optionalDisclaimer":""}},"build":{"url":"https://download.winzip.com/gl/o
2023-12-19 09:22:19 UTC	904	IN	Data Raw: 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 72 70 6d 22 3a 37 30 2e 35 38 38 32 34 2c 22 73 6f 76 22 3a 31 30 30 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 66 61 6c 73 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 74 72 75 65 7d 2c 7b 22 69 64 22 3a 22 6e 6f 72 64 2d 76 70 6e 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 72 70 6d 22 3a 31 35 2e 38 34 39 31 33 2c 22 73 6f 76 22 3a 34 30 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 74 72 75 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 Data Ascii: "softonic","iteration":1,"rpm":70.58824,"sov":100,"isGuaranteedMode":false,"hasLimits":false,"isBackup":true},{"id":"nord-vpn","publisherId":"softonic","iteration":1,"rpm":15.84913,"sov":40,"isGuaranteedMode":true,"hasLimits":false,"isBackup":false},{"id"
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 2c 22 72 70 6d 22 3a 31 33 31 2e 37 30 36 32 39 2c 22 73 6f 76 22 3a 22 2d 22 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 74 72 75 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 61 76 61 73 74 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 72 70 6d 22 3a 31 30 36 2e 35 39 38 39 38 2c 22 73 6f 76 22 3a 30 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 74 72 75 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 6f 70 65 72 61 2d 6d 61 63 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 Data Ascii: ,"rpm":131.70629,"sov":"-","isGuaranteedMode":true,"hasLimits":false,"isBackup":false},{"id":"avast","publisherId":"softonic","iteration":1,"rpm":106.59898,"sov":0,"isGuaranteedMode":true,"hasLimits":false,"isBackup":false},{"id":"opera-mac","publisherId"
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 6f 76 22 3a 30 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 66 61 6c 73 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 75 70 67 72 61 64 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 73 6f 76 22 3a 30 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 66 61 6c 73 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 74 72 75 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 6f 70 65 72 61 2d 64 65 76 73 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 73 6f 76 22 3a 30 2c Data Ascii: ov":0,"isGuaranteedMode":false,"hasLimits":false,"isBackup":false},{"id":"upgrad","publisherId":"softonic","iteration":1,"sov":0,"isGuaranteedMode":false,"hasLimits":true,"isBackup":false},{"id":"opera-devs","publisherId":"softonic","iteration":1,"sov":0,
2023-12-19 09:22:19 UTC	322	IN	Data Raw: 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 66 61 6c 73 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 74 72 75 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 6e 6f 72 74 6f 6e 2d 73 65 63 75 72 65 2d 62 72 6f 77 73 65 72 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 72 70 6d 22 3a 31 37 31 2e 33 36 31 37 34 2c 22 73 6f 76 22 3a 22 2d 22 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 66 61 6c 73 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 5d 2c 22 70 6c 61 63 65 6d 65 6e 74 49 64 22 3a 22 64 6f 77 6e 6c 6f 61 64 2d 69 6e 74 65 6e 74 22 2c 22 70 6f 73 69 74 69 Data Ascii: isGuaranteedMode":false,"hasLimits":true,"isBackup":false},{"id":"norton-secure-browser","publisherId":"softonic","iteration":1,"rpm":171.36174,"sov":"-","isGuaranteedMode":false,"hasLimits":false,"isBackup":false}],"placementId":"download-intent","positi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49790	142.250.217.166	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:18 UTC	1165	OUT	GET /activityi;src=12325200;type=invmedia;cat=softo003;ord=6058147887192;auiddc=133230612.1702977737;ps=1;pcor=1728039348;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? HTTP/1.1 Host: 12325200.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:19 UTC	1131	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://12325200.fls.doubleclick.net/activityi;dc_pre=CIrI0bmWm4MDFaa60QQdFz4Btw;src=12325200;type=invmedia;cat=softo003;ord=6058147887192;auiddc=133230612.1702977737;ps=1;pcor=1728039348;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.16	49786	192.178.50.66	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:18 UTC	1202	OUT	GET /td/fls/rul/activityi;fledge=1;src=8876029;type=invmedia;cat=progr0;ord=2316977282064;auiddc=133230612.1702977737;u2=%2Fprogram_page;u3=Caffeine;ps=1;pcor=858286563;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:19 UTC	795	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Tue, 19-Dec-2023 09:37:19 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:19 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2023-12-19 09:22:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49787	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:18 UTC	1175	OUT	GET /td/fls/rul/activityi;fledge=1;src=12325200;type=invmedia;cat=softo003;ord=6058147887192;auiddc=133230612.1702977737;ps=1;pcor=1728039348;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:19 UTC	795	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Tue, 19-Dec-2023 09:37:19 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:19 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2023-12-19 09:22:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49789	142.250.64.166	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:18 UTC	1191	OUT	GET /activityi;src=8876029;type=invmedia;cat=progr0;ord=2316977282064;auiddc=133230612.1702977737;u2=%2Fprogram_page;u3=Caffeine;ps=1;pcor=858286563;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? HTTP/1.1 Host: 8876029.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:19 UTC	1157	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://8876029.fls.doubleclick.net/activityi;dc_pre=CMuD1rmWm4MDFXrMKAUd-d0Afg;src=8876029;type=invmedia;cat=progr0;ord=2316977282064;auiddc=133230612.1702977737;u2=%2Fprogram_page;u3=Caffeine;ps=1;pcor=858286563;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49793	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:19 UTC	490	OUT	GET /pagead/ppub_config?ippd=www.softonic.com.br HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:19 UTC	831	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:19 GMT Expires: Tue, 19 Dec 2023 09:22:19 GMT Cache-Control: private, max-age=3600, stale-while-revalidate=3600 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe Content-Length: 180 X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Tue, 19-Dec-2023 09:37:19 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:19 UTC	180	IN	Data Raw: 5b 5b 22 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 6e 75 6c 6c 2c 22 77 77 77 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 22 35 32 35 35 35 33 38 37 22 2c 22 35 33 30 32 22 5d 5d 2c 5b 5d 2c 5b 5d 2c 5b 33 31 30 37 39 35 32 35 5d 2c 6e 75 6c 6c 2c 5b 5b 22 35 33 30 32 22 2c 5b 5b 22 69 64 35 2d 73 79 6e 63 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 64 35 2d 73 79 6e 63 2e 63 6f 6d 2f 61 70 69 2f 31 2e 30 2f 65 73 70 2e 6a 73 22 5d 5d 5d 5d 2c 6e 75 6c 6c 2c 5b 5d 5d Data Ascii: [["softonic.com.br",null,"www.softonic.com.br",null,null,["52555387","5302"]],[],[],[31079525],null,[["5302",[["id5-sync.com","https://cdn.id5-sync.com/api/1.0/esp.js"]]]],null,[]]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49795	35.227.233.104	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:19 UTC	742	OUT	GET /revamp/sft-bundle.js?modern=1 HTTP/1.1 Host: softonic.com.br Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _usr_orgn=direct; _swo_pos=341; session.pv=1; persistent.fpmUserId=75c494bb-9642-443c-9078-46f928a097b4; session.fpmSessionId=f3c99309-04ba-4e51-b2a2-fb42d95561db; _gcl_au=1.1.133230612.1702977737; rv_prebid_position=18; rv_test_position=111; rv_fp_ad_session_id=ca334998-1875-4288-9025-8f913da6a89a; rv_fp_pv=1; rv_google_ppid=a621a63a-2788-4df7-a4b3-b3d6a6693bad
2023-12-19 09:22:19 UTC	1220	IN	HTTP/1.1 200 OK Content-Length: 334075 server: istio-envoy content-type: application/javascript; charset=utf-8 cache-control: max-age=172500, public, s-maxage=172800, stale-if-error=31536000, stale-while-revalidate=864000 x-publisher-id: softonic etag: "1a77d364ea040b10d58540cbc7704974" x-version: 1.1306.0 x-request-id: 8eb871aa-4742-4c82-a1b7-01b6dd53e4b9 x-envoy-upstream-service-time: 9 accept-ranges: bytes date: Tue, 19 Dec 2023 09:22:19 GMT age: 57345 x-served-by: cache-ams12763-AMS, cache-bfi-krnt7300086-BFI x-cache: HIT, HIT x-cache-hits: 1, 1 x-timer: S1702977739.356674,VS0,VE2 vary: Accept-Encoding,x-device-platform,x-platform-id access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform access-control-allow-origin: * x-country-code: US x-region: FL x-device-platform: Desktop x-browser-name: Chrome x-browser-version: 117.0.0.0 x-platform-id: Windows 10 x-platform-version: NT 10.0 alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 Via: 1.1 google, 1.1 varnish, 1.1 varnish, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 74 3d 7b 32 31 33 31 3a 65 3d 3e 7b 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 72 65 74 75 72 6e 28 74 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c 2e 70 72 6f 74 6f 74 79 70 65 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 Data Ascii: (()=>{"use strict";var e,t={2131:e=>{function t(e){return(t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typ
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 2e 73 6f 75 72 63 65 26 26 65 2e 73 6f 75 72 63 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 26 26 65 2e 73 6f 75 72 63 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 72 3f 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 69 29 3a 69 2c 22 2a 22 29 7d 29 2c 6f 2e 70 61 72 61 6d 65 74 65 72 29 7d 29 2c 21 31 29 29 7d 7d 2c 38 32 34 39 3a 28 65 2c 74 2c 72 29 3d 3e 7b 72 2e 64 28 74 2c 7b 5a 3a 28 29 3d 3e 68 7d 29 3b 76 61 72 20 6e 3d 72 28 38 38 34 33 29 2c 6f 3d 72 28 36 37 39 38 29 2c 69 3d 72 28 32 35 36 36 29 2c 73 3d 72 28 37 38 37 38 29 2c 63 3d 72 28 36 31 39 36 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 6e 2e 7a 29 3b 76 61 72 20 61 3d 28 30 2c 63 2e 48 29 28 65 2c 74 29 3b 72 65 74 75 72 6e 20 66 75 Data Ascii: .source&&e.source.postMessage&&e.source.postMessage(r?JSON.stringify(i):i,"*")}),o.parameter)}),!1))}},8249:(e,t,r)=>{r.d(t,{Z:()=>h});var n=r(8843),o=r(6798),i=r(2566),s=r(7878),c=r(6196);function a(e,t,r){void 0===t&&(t=n.z);var a=(0,c.H)(e,t);return fu
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 73 5b 34 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 34 5d 3a 34 65 33 2c 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 35 3f 61 72 67 75 6d 65 6e 74 73 5b 35 5d 3a 76 6f 69 64 20 30 3b 70 28 74 68 69 73 2c 22 63 6d 70 73 74 75 62 22 2c 76 6f 69 64 20 30 29 2c 70 28 74 68 69 73 2c 22 75 73 65 72 43 6f 6e 73 65 6e 74 53 75 62 6a 65 63 74 22 2c 76 6f 69 64 20 30 29 2c 70 28 74 68 69 73 2c 22 72 65 67 75 6c 61 74 69 6f 6e 73 53 75 62 6a 65 63 74 22 2c 76 6f 69 64 20 30 29 2c 70 28 74 68 69 73 2c 22 65 76 65 6e 74 73 53 75 62 6a 65 63 74 22 2c 76 6f 69 64 20 30 29 2c 70 28 74 68 69 73 2c 22 66 61 6c 6c 62 61 63 6b 54 69 6d 65 6f 75 74 49 6e 4d 73 22 2c 76 6f 69 64 20 30 29 2c 70 28 74 68 69 73 2c 22 70 72 6f 76 69 64 65 72 22 2c 76 6f 69 64 20 30 29 2c 70 Data Ascii: s[4]?arguments[4]:4e3,i=arguments.length>5?arguments[5]:void 0;p(this,"cmpstub",void 0),p(this,"userConsentSubject",void 0),p(this,"regulationsSubject",void 0),p(this,"eventsSubject",void 0),p(this,"fallbackTimeoutInMs",void 0),p(this,"provider",void 0),p
2023-12-19 09:22:19 UTC	340	IN	Data Raw: 6e 74 53 74 61 74 75 73 29 3f 28 74 68 69 73 2e 74 63 66 4c 61 73 74 45 76 65 6e 74 53 74 61 74 75 73 3d 65 2e 65 76 65 6e 74 53 74 61 74 75 73 2c 74 68 69 73 2e 74 63 44 61 74 61 3d 65 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 53 74 72 69 6e 67 44 65 74 65 63 74 65 64 3d 21 30 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 3d 74 68 69 73 2e 67 65 74 50 75 72 70 6f 73 65 56 61 6c 75 65 28 34 29 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 50 72 6f 66 69 6c 65 3d 74 68 69 73 2e 67 65 74 50 75 72 70 6f 73 65 56 61 6c 75 65 28 33 29 2c 74 68 69 73 2e 64 65 76 69 63 65 41 63 63 65 73 73 3d 74 68 69 73 2e 67 65 74 50 75 72 70 6f 73 65 56 61 6c 75 65 28 31 29 2c 74 68 69 73 2e 65 6d 69 74 43 6f 6e 73 65 6e 74 45 76 65 6e 74 28 29 Data Ascii: ntStatus)?(this.tcfLastEventStatus=e.eventStatus,this.tcData=e,this.consentStringDetected=!0,this.personalizedAds=this.getPurposeValue(4),this.personalizedAdsProfile=this.getPurposeValue(3),this.deviceAccess=this.getPurposeValue(1),this.emitConsentEvent()
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 74 65 64 3d 21 31 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 3d 21 30 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 50 72 6f 66 69 6c 65 3d 21 30 2c 74 68 69 73 2e 64 65 76 69 63 65 41 63 63 65 73 73 3d 21 30 2c 74 68 69 73 2e 65 6d 69 74 43 6f 6e 73 65 6e 74 45 76 65 6e 74 28 29 29 3a 28 74 68 69 73 2e 63 6f 6e 73 65 6e 74 53 74 72 69 6e 67 44 65 74 65 63 74 65 64 3d 21 31 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 3d 21 31 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 50 72 6f 66 69 6c 65 3d 21 31 2c 74 68 69 73 2e 64 65 76 69 63 65 41 63 63 65 73 73 3d 21 31 2c 74 68 69 73 2e 65 6d 69 74 43 6f 6e 73 65 6e 74 45 76 65 6e 74 28 29 29 7d 3b 74 68 69 73 2e 77 61 69 74 46 6f 72 47 44 Data Ascii: ted=!1,this.personalizedAds=!0,this.personalizedAdsProfile=!0,this.deviceAccess=!0,this.emitConsentEvent()):(this.consentStringDetected=!1,this.personalizedAds=!1,this.personalizedAdsProfile=!1,this.deviceAccess=!1,this.emitConsentEvent())};this.waitForGD
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 75 73 70 61 70 69 26 26 77 69 6e 64 6f 77 2e 74 6f 70 2e 5f 5f 75 73 70 61 70 69 28 22 67 65 74 55 53 50 44 61 74 61 22 2c 31 2c 73 29 7d 29 29 7d 65 6c 73 65 20 74 68 69 73 2e 63 6f 6e 73 65 6e 74 53 74 72 69 6e 67 44 65 74 65 63 74 65 64 3d 21 31 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 3d 21 30 2c 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 41 64 73 50 72 6f 66 69 6c 65 3d 21 30 2c 74 68 69 73 2e 64 65 76 69 63 65 41 63 63 65 73 73 3d 21 30 2c 74 68 69 73 2e 65 6d 69 74 43 6f 6e 73 65 6e 74 45 76 65 6e 74 28 29 7d 65 6d 69 74 43 6f 6e 73 65 6e 74 45 76 65 6e 74 28 29 7b 76 61 72 20 65 3d 7b 63 6f 6e 73 65 6e 74 53 74 72 69 6e 67 44 65 74 65 63 74 65 64 3a 74 68 69 73 2e 63 6f 6e 73 65 6e 74 53 74 72 69 6e 67 44 65 74 65 63 Data Ascii: uspapi&&window.top.__uspapi("getUSPData",1,s)}))}else this.consentStringDetected=!1,this.personalizedAds=!0,this.personalizedAdsProfile=!0,this.deviceAccess=!0,this.emitConsentEvent()}emitConsentEvent(){var e={consentStringDetected:this.consentStringDetec
2023-12-19 09:22:19 UTC	440	IN	Data Raw: 67 65 73 24 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 75 73 65 72 43 6f 6e 73 65 6e 74 53 75 62 6a 65 63 74 2e 70 69 70 65 28 61 28 32 30 30 29 29 7d 67 65 74 20 72 65 67 75 6c 61 74 69 6f 6e 73 54 6f 42 65 41 70 70 6c 69 65 64 24 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 72 65 67 75 6c 61 74 69 6f 6e 73 53 75 62 6a 65 63 74 2e 61 73 4f 62 73 65 72 76 61 62 6c 65 28 29 7d 67 65 74 20 65 76 65 6e 74 73 24 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 76 65 6e 74 73 53 75 62 6a 65 63 74 2e 61 73 4f 62 73 65 72 76 61 62 6c 65 28 29 7d 77 61 69 74 46 6f 72 47 44 50 52 50 72 6f 76 69 64 65 72 54 6f 42 65 52 65 61 64 79 28 65 29 7b 74 68 69 73 2e 70 72 6f 76 69 64 65 72 3d 3d 3d 76 3f 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 66 63 2e 63 61 6c 6c 62 61 63 Data Ascii: ges$(){return this.userConsentSubject.pipe(a(200))}get regulationsToBeApplied$(){return this.regulationsSubject.asObservable()}get events$(){return this.eventsSubject.asObservable()}waitForGDPRProviderToBeReady(e){this.provider===v?window.googlefc.callbac
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 29 2c 70 28 68 2c 22 45 56 45 4e 54 53 22 2c 7b 55 53 45 52 5f 43 4f 4e 53 45 4e 54 5f 45 4d 49 54 54 45 44 3a 22 63 6f 6e 73 65 6e 74 2e 65 6d 69 74 74 65 64 2e 64 6f 6e 65 22 2c 55 53 45 52 5f 43 4f 4e 53 45 4e 54 5f 41 50 49 5f 54 49 4d 45 44 5f 4f 55 54 3a 22 63 6f 6e 73 65 6e 74 2e 74 69 6d 65 64 2d 6f 75 74 2e 66 61 69 6c 65 64 22 2c 52 45 47 55 4c 41 54 49 4f 4e 53 5f 54 4f 5f 41 50 50 4c 59 5f 44 45 54 45 43 54 45 44 3a 22 72 65 67 75 6c 61 74 69 6f 6e 73 2e 64 65 74 65 63 74 65 64 2e 64 6f 6e 65 22 7d 29 7d 2c 34 33 31 33 3a 28 65 2c 74 2c 72 29 3d 3e 7b 72 2e 64 28 74 2c 7b 77 79 3a 28 29 3d 3e 42 2c 54 4c 3a 28 29 3d 3e 6e 65 2c 76 7a 3a 28 29 3d 3e 5a 2c 4d 53 3a 28 29 3d 3e 51 2c 4e 5a 3a 28 29 3d 3e 71 2c 57 66 3a 28 29 3d 3e 58 2c 51 46 3a Data Ascii: ),p(h,"EVENTS",{USER_CONSENT_EMITTED:"consent.emitted.done",USER_CONSENT_API_TIMED_OUT:"consent.timed-out.failed",REGULATIONS_TO_APPLY_DETECTED:"regulations.detected.done"})},4313:(e,t,r)=>{r.d(t,{wy:()=>B,TL:()=>ne,vz:()=>Z,MS:()=>Q,NZ:()=>q,Wf:()=>X,QF:
2023-12-19 09:22:19 UTC	1252	IN	Data Raw: 74 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 22 2c 22 22 5d 2c 72 29 7d 73 75 63 63 65 73 73 28 65 2c 74 29 7b 76 61 72 20 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3a 22 22 3b 74 68 69 73 2e 6c 6f 67 28 22 25 63 20 5b 44 4f 4e 45 5d 3a 20 25 63 22 2e 63 6f 6e 63 61 74 28 65 2c 22 20 25 63 22 29 2e 63 6f 6e 63 61 74 28 74 29 2c 5b 22 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 20 63 6f 6c 6f 72 3a 20 67 72 65 65 6e 22 2c 22 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 22 2c 22 22 5d 2c 72 29 7d 65 72 72 6f 72 28 65 2c 74 29 7b 76 61 72 20 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 76 6f 69 64 20 30 Data Ascii: t-weight: 600;",""],r)}success(e,t){var r=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"";this.log("%c [DONE]: %c".concat(e," %c").concat(t),["font-weight: 600; color: green","font-weight: 600;",""],r)}error(e,t){var r=arguments.length>2&&void 0
2023-12-19 09:22:19 UTC	312	IN	Data Raw: 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 72 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 72 2c 65 7d 63 6c 61 73 73 20 5f 7b 73 74 61 74 69 63 20 6e 6f 72 6d 61 6c 69 7a 65 44 65 76 69 63 65 54 79 70 65 28 65 29 7b 72 65 74 75 72 6e 20 5f 2e 41 56 41 49 4c 41 42 4c 45 5f 44 45 56 49 43 45 5f 54 59 50 45 53 5b 65 5d 7c 7c 5f 2e 44 45 46 41 55 4c 54 5f 44 45 56 49 43 45 5f 54 59 50 45 7d 73 74 61 74 69 63 20 6e 6f 72 6d 61 6c 69 7a 65 50 6c 61 74 66 6f 72 6d 49 64 28 65 29 7b 76 61 72 20 74 3d 65 2e 69 6e 63 6c 75 64 65 73 28 22 4c 69 6e 75 78 22 29 3f 22 6c 69 6e 75 78 22 3a 65 3b 72 65 74 75 72 6e Data Ascii: bject.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}class _{static normalizeDeviceType(e){return _.AVAILABLE_DEVICE_TYPES[e]\|\|_.DEFAULT_DEVICE_TYPE}static normalizePlatformId(e){var t=e.includes("Linux")?"linux":e;return

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49799	142.250.217.166	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:19 UTC	1199	OUT	GET /activityi;dc_pre=CIrI0bmWm4MDFaa60QQdFz4Btw;src=12325200;type=invmedia;cat=softo003;ord=6058147887192;auiddc=133230612.1702977737;ps=1;pcor=1728039348;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? HTTP/1.1 Host: 12325200.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:19 UTC	837	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:19 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 Pragma: no-cache X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Tue, 19-Dec-2023 09:37:19 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:19 UTC	415	IN	Data Raw: 32 63 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 69 2f 64 63 5f 70 72 65 3d 43 49 72 49 30 62 6d 57 6d 34 4d Data Ascii: 2c7<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><iframe src="https://adservice.google.com/ddm/fls/i/dc_pre=CIrI0bmWm4M
2023-12-19 09:22:19 UTC	303	IN	Data Raw: 6d 61 3d 30 3b 75 61 61 3d 78 38 36 3b 75 61 62 3d 36 34 3b 75 61 66 76 6c 3d 47 6f 6f 67 6c 65 25 32 35 32 30 43 68 72 6f 6d 65 25 33 42 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 25 37 43 4e 6f 74 25 32 35 33 42 41 25 32 35 33 44 42 72 61 6e 64 25 33 42 38 2e 30 2e 30 2e 30 25 37 43 43 68 72 6f 6d 69 75 6d 25 33 42 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 3b 75 61 6d 62 3d 30 3b 75 61 6d 3d 3b 75 61 70 3d 57 69 6e 64 6f 77 73 3b 75 61 70 76 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 25 32 46 22 20 77 69 64 74 68 3d 22 31 22 20 68 65 69 67 68 74 3d 22 31 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 Data Ascii: ma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F" width="1" height="1" frameborder="0
2023-12-19 09:22:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49800	35.227.233.104	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:19 UTC	1012	OUT	POST /plausible/api/event HTTP/1.1 Host: caffeine.softonic.com.br Connection: keep-alive Content-Length: 268 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _usr_orgn=direct; _swo_pos=341; session.pv=1; persistent.fpmUserId=75c494bb-9642-443c-9078-46f928a097b4; session.fpmSessionId=f3c99309-04ba-4e51-b2a2-fb42d95561db; _gcl_au=1.1.133230612.1702977737; rv_prebid_position=18; rv_test_position=111; rv_fp_ad_session_id=ca334998-1875-4288-9025-8f913da6a89a; rv_fp_pv=1; rv_google_ppid=a621a63a-2788-4df7-a4b3-b3d6a6693bad
2023-12-19 09:22:19 UTC	268	OUT	Data Raw: 7b 22 6e 22 3a 22 52 65 71 75 65 73 74 22 2c 22 75 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 72 22 3a 6e 75 6c 6c 2c 22 77 22 3a 31 32 38 30 2c 22 68 22 3a 30 2c 22 70 22 3a 22 7b 5c 22 6c 61 62 65 6c 5c 22 3a 5c 22 77 69 6e 7a 69 70 2d 63 6f 6d 70 72 65 73 73 69 6f 6e 5c 22 2c 5c 22 76 65 72 73 69 6f 6e 5c 22 3a 5c 22 31 2e 31 33 30 36 2e 30 5f 75 6e 64 65 66 69 6e 65 64 5f 75 6e 64 65 66 69 6e 65 64 5c 22 2c 5c 22 6c 6f 67 69 63 5c 22 3a 5c 22 73 6f 76 5c 22 2c 5c 22 73 65 67 6d 65 6e 74 5c 22 3a 5c 22 77 69 6e 7a 69 70 2d 63 6f 6d 70 72 65 73 73 69 6f 6e 5f 73 6f 76 5f 55 53 5c 22 2c 5c 22 73 75 69 74 61 62 6c 65 43 61 6d 70 61 69 67 Data Ascii: {"n":"Request","u":"https://caffeine.softonic.com.br/","d":"softonic","r":null,"w":1280,"h":0,"p":"{\"label\":\"winzip-compression\",\"version\":\"1.1306.0_undefined_undefined\",\"logic\":\"sov\",\"segment\":\"winzip-compression_sov_US\",\"suitableCampaig
2023-12-19 09:22:20 UTC	479	IN	HTTP/1.1 202 Accepted access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: cache-control: max-age=0, private, must-revalidate Content-Length: 2 content-type: text/plain; charset=utf-8 date: Tue, 19 Dec 2023 09:22:18 GMT server: istio-envoy x-request-id: 05a47738-42d5-43b6-97a7-2b0bd3e03501 x-envoy-upstream-service-time: 1 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:20 UTC	2	IN	Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49805	13.226.54.207	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:19 UTC	556	OUT	GET /datadog-rum-v4.js HTTP/1.1 Host: www.datadoghq-browser-agent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	595	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 153156 Connection: close Last-Modified: Mon, 09 Oct 2023 11:26:13 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Tue, 19 Dec 2023 09:22:20 GMT Cache-Control: max-age=14400, s-maxage=60 ETag: "2630b3d7ad4a41fac67742216e506d83" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 639cc143f6b6769351df58109d6b2b18.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C3 X-Amz-Cf-Id: koDGZMEOJsqSTNo4miE2vA4aQ8BRnXUGL6xww25HqRvhanMb-6CJpA== Timing-Allow-Origin: *
2023-12-19 09:22:20 UTC	16384	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 7b 6c 6f 67 3a 22 6c 6f 67 22 2c 64 65 62 75 67 3a 22 64 65 62 75 67 22 2c 69 6e 66 6f 3a 22 69 6e 66 6f 22 2c 77 61 72 6e 3a 22 77 61 72 6e 22 2c 65 72 72 6f 72 3a 22 65 72 72 6f 72 22 7d 2c 65 3d 63 6f 6e 73 6f 6c 65 2c 6e 3d 7b 7d 3b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6e 5b 74 5d 3d 65 5b 74 5d 7d 29 29 3b 76 61 72 20 72 3d 22 44 61 74 61 64 6f 67 20 42 72 6f 77 73 65 72 20 53 44 4b 3a 22 2c 69 3d 7b 64 65 62 75 67 3a 6e 2e 64 65 62 75 67 2e 62 69 6e 64 28 65 2c 72 29 2c 6c 6f 67 3a 6e 2e 6c 6f 67 2e 62 69 6e 64 28 65 2c 72 29 2c 69 6e 66 6f 3a 6e 2e 69 6e 66 6f 2e 62 69 6e 64 28 65 2c 72 Data Ascii: !function(){"use strict";var t={log:"log",debug:"debug",info:"info",warn:"warn",error:"error"},e=console,n={};Object.keys(t).forEach((function(t){n[t]=e[t]}));var r="Datadog Browser SDK:",i={debug:n.debug.bind(e,r),log:n.log.bind(e,r),info:n.info.bind(e,r
2023-12-19 09:22:20 UTC	16384	IN	Data Raw: 6c 65 64 3a 6e 75 6c 6c 21 3d 64 65 3f 64 65 3a 64 65 3d 21 21 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 7c 7c 2f 48 65 61 64 6c 65 73 73 43 68 72 6f 6d 65 2f 2e 74 65 73 74 28 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 2c 70 65 72 73 69 73 74 53 65 73 73 69 6f 6e 3a 28 65 3d 74 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6b 74 28 68 65 2c 62 65 28 74 29 2c 76 65 2c 65 29 7d 29 2c 72 65 74 72 69 65 76 65 53 65 73 73 69 6f 6e 3a 52 65 2c 63 6c 65 61 72 53 65 73 73 69 6f 6e 3a 49 65 28 74 29 7d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 21 78 74 28 68 65 29 29 7b 76 61 72 20 65 3d 78 74 28 53 65 29 2c 6e 3d 78 74 28 54 65 29 2c 72 3d 78 74 28 45 65 29 2c 69 3d 7b 7d 3b 65 26 26 28 69 2e 69 64 3d 65 29 Data Ascii: led:null!=de?de:de=!!window.chrome\|\|/HeadlessChrome/.test(window.navigator.userAgent),persistSession:(e=t,function(t){kt(he,be(t),ve,e)}),retrieveSession:Re,clearSession:Ie(t)};return function(t){if(!xt(he)){var e=xt(Se),n=xt(Te),r=xt(Ee),i={};e&&(i.id=e)
2023-12-19 09:22:20 UTC	16384	IN	Data Raw: 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 5b 65 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 66 6f 72 28 76 61 72 20 6e 3d 31 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 3d 31 29 69 66 28 74 5b 6e 2d 31 5d 3e 74 5b 6e 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 66 75 6e 63 74 69 6f 6e 20 46 6e 28 74 29 7b 76 61 72 20 65 3d 42 6e 28 74 29 3b 69 66 28 65 29 7b 76 61 72 20 6e 3d 65 2e 73 74 61 72 74 54 69 6d 65 2c 72 3d 65 2e 66 65 74 63 68 53 74 61 72 74 2c 69 3d 65 2e 72 65 64 69 72 65 63 74 53 74 61 72 74 2c 6f 3d 65 2e 72 65 64 69 72 65 63 74 45 6e 64 2c 61 3d 65 2e 64 6f 6d 61 69 6e 4c 6f 6f 6b 75 70 53 74 61 72 74 2c 73 3d 65 2e 64 6f 6d 61 69 6e 4c 6f 6f 6b 75 70 45 6e 64 2c 75 3d 65 2e 63 6f 6e 6e 65 63 74 Data Ascii: e<arguments.length;e++)t[e]=arguments[e];for(var n=1;n<t.length;n+=1)if(t[n-1]>t[n])return!1;return!0}function Fn(t){var e=Bn(t);if(e){var n=e.startTime,r=e.fetchStart,i=e.redirectStart,o=e.redirectEnd,a=e.domainLookupStart,s=e.domainLookupEnd,u=e.connect
2023-12-19 09:22:20 UTC	16384	IN	Data Raw: 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 7d 69 66 28 6e 29 72 65 74 75 72 6e 20 74 69 28 51 72 28 6e 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 65 29 2e 74 72 69 6d 28 29 29 29 7d 76 61 72 20 4b 72 2c 57 72 2c 58 72 3d 5b 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 6f 69 64 20 30 3d 3d 3d 4b 72 26 26 28 4b 72 3d 22 6c 61 62 65 6c 73 22 69 6e 20 48 54 4d 4c 49 6e 70 75 74 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 29 3b 72 65 74 75 72 6e 20 4b 72 7d 28 29 29 7b 69 66 28 22 6c 61 62 65 6c 73 22 69 6e 20 74 26 26 74 2e 6c 61 62 65 6c 73 26 26 74 2e 6c 61 62 65 6c 73 2e 6c 65 6e 67 74 68 3e 30 29 72 65 74 75 72 6e 20 65 69 28 74 2e 6c 61 62 65 6c 73 5b 30 5d 2c 65 29 7d 65 6c 73 65 20 Data Ascii: reak}r=r.parentElement}if(n)return ti(Qr(n.getAttribute(e).trim()))}var Kr,Wr,Xr=[function(t,e){if(function(){void 0===Kr&&(Kr="labels"in HTMLInputElement.prototype);return Kr}()){if("labels"in t&&t.labels&&t.labels.length>0)return ei(t.labels[0],e)}else
2023-12-19 09:22:20 UTC	16384	IN	Data Raw: 72 28 29 7d 29 29 2e 73 74 6f 70 2c 63 3d 28 76 6f 69 64 20 30 3d 3d 3d 69 26 26 28 69 3d 77 69 6e 64 6f 77 29 2c 22 68 69 64 64 65 6e 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 3f 6f 3d 30 3a 28 6f 3d 31 2f 30 2c 61 3d 55 74 28 30 2c 69 2c 5b 22 70 61 67 65 68 69 64 65 22 2c 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 70 61 67 65 68 69 64 65 22 21 3d 3d 74 2e 74 79 70 65 26 26 22 68 69 64 64 65 6e 22 21 3d 3d 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 7c 7c 28 6f 3d 74 2e 74 69 6d 65 53 74 61 6d 70 2c 61 28 29 29 7d 29 2c 7b 63 61 70 74 75 72 65 3a 21 30 7d 29 2e 73 74 6f 70 29 2c 7b 67 65 74 20 74 69 6d 65 53 74 61 6d 70 28 29 Data Ascii: r()})).stop,c=(void 0===i&&(i=window),"hidden"===document.visibilityState?o=0:(o=1/0,a=Ut(0,i,["pagehide","visibilitychange"],(function(t){"pagehide"!==t.type&&"hidden"!==document.visibilityState\|\|(o=t.timeStamp,a())}),{capture:!0}).stop),{get timeStamp()
2023-12-19 09:22:20 UTC	1850	IN	Data Raw: 75 63 63 65 73 73 2c 6f 3d 72 2e 6f 6e 46 61 69 6c 75 72 65 3b 65 2e 62 61 6e 64 77 69 64 74 68 4d 6f 6e 69 74 6f 72 2e 61 64 64 28 74 29 2c 6e 28 74 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 65 2e 62 61 6e 64 77 69 64 74 68 4d 6f 6e 69 74 6f 72 2e 72 65 6d 6f 76 65 28 74 29 2c 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 6f 70 61 71 75 65 22 21 3d 3d 74 2e 74 79 70 65 26 26 28 30 3d 3d 3d 74 2e 73 74 61 74 75 73 26 26 21 6e 61 76 69 67 61 74 6f 72 2e 6f 6e 4c 69 6e 65 7c 7c 34 30 38 3d 3d 3d 74 2e 73 74 61 74 75 73 7c 7c 34 32 39 3d 3d 3d 74 2e 73 74 61 74 75 73 7c 7c 28 65 3d 74 2e 73 74 61 74 75 73 2c 65 3e 3d 35 30 30 29 29 3b 76 61 72 20 65 7d 28 6e 29 3f 28 65 2e 74 72 61 6e 73 70 6f 72 74 53 74 61 74 75 73 3d 30 2c 69 28 29 29 3a 28 Data Ascii: uccess,o=r.onFailure;e.bandwidthMonitor.add(t),n(t,(function(n){e.bandwidthMonitor.remove(t),!function(t){return"opaque"!==t.type&&(0===t.status&&!navigator.onLine\|\|408===t.status\|\|429===t.status\|\|(e=t.status,e>=500));var e}(n)?(e.transportStatus=0,i()):(
2023-12-19 09:22:20 UTC	16384	IN	Data Raw: 2c 72 29 3b 46 6f 28 74 2c 6e 2c 72 2e 64 61 74 61 2c 69 29 7d 29 29 29 7d 65 6c 73 65 7b 76 61 72 20 73 3d 65 2e 62 75 69 6c 64 28 22 78 68 72 22 2c 72 29 3b 46 6f 28 74 2c 73 2c 72 2e 64 61 74 61 2c 69 29 7d 7d 28 74 2c 65 2c 6e 2c 72 2c 69 29 7d 3b 72 65 74 75 72 6e 7b 73 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 4e 6f 28 74 2c 69 2c 6f 2c 65 2e 65 6e 64 70 6f 69 6e 74 54 79 70 65 2c 72 29 7d 2c 73 65 6e 64 4f 6e 45 78 69 74 3a 66 75 6e 63 74 69 6f 6e 28 72 29 7b 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 72 29 7b 76 61 72 20 69 3d 21 21 6e 61 76 69 67 61 74 6f 72 2e 73 65 6e 64 42 65 61 63 6f 6e 26 26 72 2e 62 79 74 65 73 43 6f 75 6e 74 3c 6e 3b 69 66 28 69 29 74 72 79 7b 76 61 72 20 6f 3d 65 2e 62 75 69 6c 64 28 22 62 65 61 63 6f 6e 22 2c Data Ascii: ,r);Fo(t,n,r.data,i)})))}else{var s=e.build("xhr",r);Fo(t,s,r.data,i)}}(t,e,n,r,i)};return{send:function(t){No(t,i,o,e.endpointType,r)},sendOnExit:function(r){!function(t,e,n,r){var i=!!navigator.sendBeacon&&r.bytesCount<n;if(i)try{var o=e.build("beacon",
2023-12-19 09:22:20 UTC	16384	IN	Data Raw: 66 28 21 55 61 28 65 29 26 26 21 57 6e 28 65 29 29 72 65 74 75 72 6e 21 31 3b 65 3d 59 6e 28 65 29 7d 72 65 74 75 72 6e 21 30 7d 28 74 2e 74 61 72 67 65 74 29 26 26 43 61 28 74 2e 74 61 72 67 65 74 2c 6e 2e 64 65 66 61 75 6c 74 50 72 69 76 61 63 79 4c 65 76 65 6c 29 21 3d 3d 70 61 2e 48 49 44 44 45 4e 7d 29 29 2c 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 3d 6e 65 77 20 53 65 74 2c 69 3d 6e 65 77 20 4d 61 70 2c 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 61 64 64 65 64 4e 6f 64 65 73 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 2e 61 64 64 28 74 29 7d 29 29 2c 74 2e 72 65 6d 6f 76 65 64 4e 6f 64 65 73 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 2e 68 61 73 28 65 29 Data Ascii: f(!Ua(e)&&!Wn(e))return!1;e=Yn(e)}return!0}(t.target)&&Ca(t.target,n.defaultPrivacyLevel)!==pa.HIDDEN})),o=function(t,e,n){for(var r=new Set,i=new Map,o=function(t){t.addedNodes.forEach((function(t){r.add(t)})),t.removedNodes.forEach((function(e){r.has(e)
2023-12-19 09:22:20 UTC	5608	IN	Data Raw: 72 2b 31 5d 21 3d 3d 73 26 26 28 74 2e 6f 70 74 5f 6c 65 6e 2b 3d 28 73 2d 6c 5b 32 2a 72 2b 31 5d 29 2a 6c 5b 32 2a 72 5d 2c 6c 5b 32 2a 72 2b 31 5d 3d 73 29 2c 6e 2d 2d 29 7d 7d 28 74 2c 65 29 2c 45 28 73 2c 6f 2c 74 2e 62 6c 5f 63 6f 75 6e 74 29 7d 2c 54 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 61 29 7b 76 61 72 20 6e 2c 72 2c 69 3d 2d 31 2c 73 3d 65 5b 31 5d 2c 5f 3d 30 2c 68 3d 37 2c 6c 3d 34 3b 66 6f 72 28 30 3d 3d 3d 73 26 26 28 68 3d 31 33 38 2c 6c 3d 33 29 2c 65 5b 32 2a 28 61 2b 31 29 2b 31 5d 3d 36 35 35 33 35 2c 6e 3d 30 3b 6e 3c 3d 61 3b 6e 2b 2b 29 72 3d 73 2c 73 3d 65 5b 32 2a 28 6e 2b 31 29 2b 31 5d 2c 2b 2b 5f 3c 68 26 26 72 3d 3d 3d 73 7c 7c 28 5f 3c 6c 3f 74 2e 62 6c 5f 74 72 65 65 5b 32 2a 72 5d 2b 3d 5f 3a 30 21 3d 3d 72 3f 28 72 21 Data Ascii: r+1]!==s&&(t.opt_len+=(s-l[2r+1])l[2r],l[2r+1]=s),n--)}}(t,e),E(s,o,t.bl_count)},T=function(t,e,a){var n,r,i=-1,s=e[1],_=0,h=7,l=4;for(0===s&&(h=138,l=3),e[2(a+1)+1]=65535,n=0;n<=a;n++)r=s,s=e[2(n+1)+1],++_<h&&r===s\|\|(_<l?t.bl_tree[2*r]+=_:0!==r?(r!
2023-12-19 09:22:20 UTC	16384	IN	Data Raw: 5d 3d 3d 3d 6c 5b 2b 2b 61 5d 26 26 6c 5b 2b 2b 69 5d 3d 3d 3d 6c 5b 2b 2b 61 5d 26 26 69 3c 75 29 3b 69 66 28 6e 3d 66 74 2d 28 75 2d 69 29 2c 69 3d 75 2d 66 74 2c 6e 3e 73 29 7b 69 66 28 74 2e 6d 61 74 63 68 5f 73 74 61 72 74 3d 65 2c 73 3d 6e 2c 6e 3e 3d 5f 29 62 72 65 61 6b 3b 66 3d 6c 5b 69 2b 73 2d 31 5d 2c 63 3d 6c 5b 69 2b 73 5d 7d 7d 7d 77 68 69 6c 65 28 28 65 3d 64 5b 65 26 6f 5d 29 3e 68 26 26 30 21 3d 2d 2d 72 29 3b 72 65 74 75 72 6e 20 73 3c 3d 74 2e 6c 6f 6f 6b 61 68 65 61 64 3f 73 3a 74 2e 6c 6f 6f 6b 61 68 65 61 64 7d 2c 5a 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 61 2c 6e 2c 72 2c 69 2c 73 2c 5f 2c 68 2c 6c 2c 6f 2c 64 3d 74 2e 77 5f 73 69 7a 65 3b 64 6f 7b 69 66 28 72 3d 74 2e 77 69 6e 64 6f 77 5f 73 69 7a 65 2d 74 2e Data Ascii: ]===l[++a]&&l[++i]===l[++a]&&i<u);if(n=ft-(u-i),i=u-ft,n>s){if(t.match_start=e,s=n,n>=_)break;f=l[i+s-1],c=l[i+s]}}}while((e=d[e&o])>h&&0!=--r);return s<=t.lookahead?s:t.lookahead},Zt=function(t){var e,a,n,r,i,s,_,h,l,o,d=t.w_size;do{if(r=t.window_size-t.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49802	142.250.64.166	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:19 UTC	1265	OUT	GET /activityi;dc_pre=CMuD1rmWm4MDFXrMKAUd-d0Afg;src=8876029;type=invmedia;cat=progr0;ord=2316977282064;auiddc=133230612.1702977737;u2=%2Fprogram_page;u3=Caffeine;ps=1;pcor=858286563;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? HTTP/1.1 Host: 8876029.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2023-12-19 09:22:20 UTC	984	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:20 GMT Expires: Tue, 19 Dec 2023 09:22:20 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: IDE=AHWqTUk4L4qbB727j6vwNvhWA7xr6P_AFvb-ANDTqUule2Thcz5JwFMuUxb74DP0ZjM; expires=Thu, 18-Dec-2025 09:22:20 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:20 UTC	268	IN	Data Raw: 32 38 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4d 75 44 31 72 6d 57 6d 34 4d 44 46 58 Data Ascii: 28a<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CMuD1rmWm4MDFX
2023-12-19 09:22:20 UTC	389	IN	Data Raw: 73 72 63 3d 38 38 37 36 30 32 39 3b 74 79 70 65 3d 69 6e 76 6d 65 64 69 61 3b 63 61 74 3d 70 72 6f 67 72 30 3b 6f 72 64 3d 32 33 31 36 39 37 37 32 38 32 30 36 34 3b 61 75 69 64 64 63 3d 2a 3b 75 32 3d 25 32 46 70 72 6f 67 72 61 6d 5f 70 61 67 65 3b 75 33 3d 43 61 66 66 65 69 6e 65 3b 70 73 3d 31 3b 70 63 6f 72 3d 38 35 38 32 38 36 35 36 33 3b 67 74 6d 3d 34 35 48 65 33 62 74 30 76 36 33 33 35 39 36 37 3b 67 63 64 3d 31 31 6c 31 6c 31 6c 31 6c 31 3b 64 6d 61 3d 30 3b 75 61 61 3d 78 38 36 3b 75 61 62 3d 36 34 3b 75 61 66 76 6c 3d 47 6f 6f 67 6c 65 25 32 35 32 30 43 68 72 6f 6d 65 25 33 42 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 25 37 43 4e 6f 74 25 32 35 33 42 41 25 32 35 33 44 42 72 61 6e 64 25 33 42 38 2e 30 2e 30 2e 30 25 37 43 43 68 72 6f 6d 69 75 6d Data Ascii: src=8876029;type=invmedia;cat=progr0;ord=2316977282064;auiddc=*;u2=%2Fprogram_page;u3=Caffeine;ps=1;pcor=858286563;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium
2023-12-19 09:22:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49803	192.178.50.70	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:19 UTC	1178	OUT	GET /activity;register_conversion=1;src=8876029;type=invmedia;cat=progr0;ord=2316977282064;auiddc=133230612.1702977737;u2=%2Fprogram_page;u3=Caffeine;ps=1;pcor=858286563;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: not-navigation-source, trigger, event-source Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	2353	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:20 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16122196795318167323"}],"aggregatable_trigger_data":[{"filters":{"14":["7903994"]},"key_piece":"0xad472b9bcd9c296f","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xc9442a5fcb6ebfbf","not_filters":{"14":["7903994"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["7903994"]},"key_piece":"0xd4494164f9fa265a","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xe5799ebc19073057","not_filters":{"14":["7903994"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"4454257202265941632","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16122196795318167323","filters":{"14":["7903994"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"16122196795318167323","filters":{"14":["7903994"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"16122196795318167323","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"16122196795318167323","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["8876029"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Thu, 18-Jan-2024 09:22:20 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=CheckForPermission; expires=Tue, 19-Dec-2023 09:37:20 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49804	192.178.50.70	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:19 UTC	1146	OUT	GET /activity;register_conversion=1;src=12325200;type=invmedia;cat=softo003;ord=6058147887192;auiddc=133230612.1702977737;ps=1;pcor=1728039348;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger=navigation-source, event-source Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	2360	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:20 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"14437864426135804514"}],"aggregatable_trigger_data":[{"filters":{"14":["13823878"]},"key_piece":"0xd608a8d828d7d85a","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xcf9f15bf62491986","not_filters":{"14":["13823878"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["13823878"]},"key_piece":"0xae615a7c38c10581","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x3c09a5785611be5e","not_filters":{"14":["13823878"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"5163390644052670726","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"14437864426135804514","filters":{"14":["13823878"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"14437864426135804514","filters":{"14":["13823878"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"14437864426135804514","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"14437864426135804514","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["12325200"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Thu, 18-Jan-2024 09:22:20 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=CheckForPermission; expires=Tue, 19-Dec-2023 09:37:20 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49807	172.217.2.206	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	1268	OUT	GET /afs/ads?psid=3261714721&iab_gdprApplies=false&client=softonic&r=m&hl=pt&cpp=5&rpbu=https%3A%2F%2Fwww.softonic.com.br%2Fs%2F%3Frscp%3Ddsk_rscp_pt_pp%26platformId%3Dwindows&rpqp=q&type=3&rs_tt=c&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301383&format=r4&nocache=9311702977738466&num=0&output=afd_ads&domain_name=caffeine.softonic.com.br&v=3&bsl=8&pac=2&u_his=1&u_tz=60&dt=1702977738467&u_w=1280&u_h=1024&biw=1263&bih=907&psw=1263&psh=6480&frm=0&cl=588056317&uio=wi290-&cont=rscontainer&drt=0&jsid=csa&nfp=1&jsv=588056317&rurl=https%3A%2F%2Fcaffeine.softonic.com.br%2F HTTP/1.1 Host: www.adsensecustomsearchads.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	1720	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fpsid%3D3261714721%26iab_gdprApplies%3Dfalse%26client%3Dsoftonic%26r%3Dm%26hl%3Dpt%26cpp%3D5%26rpbu%3Dhttps%253A%252F%252Fwww.softonic.com.br%252Fs%252F%253Frscp%253Ddsk_rscp_pt_pp%2526platformId%253Dwindows%26rpqp%3Dq%26type%3D3%26rs_tt%3Dc%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301383%26format%3Dr4%26nocache%3D9311702977738466%26num%3D0%26output%3Dafd_ads%26domain_name%3Dcaffeine.softonic.com.br%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D60%26dt%3D1702977738467%26u_w%3D1280%26u_h%3D1024%26biw%3D1263%26bih%3D907%26psw%3D1263%26psh%3D6480%26frm%3D0%26cl%3D588056317%26uio%3Dwi290-%26cont%3Drscontainer%26drt%3D0%26jsid%3Dcsa%26nfp%3D1%26jsv%3D588056317%26rurl%3Dhttps%253A%252F%252Fcaffeine.softonic.com.br%252F&hl=pt&q=EgRmgZjUGMzBhawGIjDYmH_Xf2aM1xdZKz8ZZRlQk2kz51DAs7QUplT8tENUOdH_uo1e7PI4UepJ3ir3LS4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIzMGFrAYQ6ZzS0AISBGaBmNQ Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-OO2Bkq5HW60vTwoUw3cxeA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Date: Tue, 19 Dec 2023 09:22:20 GMT Server: gws Content-Length: 1177 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49810	178.128.135.204	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	622	OUT	POST /hb HTTP/1.1 Host: brightcombid.marphezis.com Connection: keep-alive Content-Length: 872 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	872	OUT	Data Raw: 7b 22 69 64 22 3a 22 33 31 36 35 34 34 34 64 30 66 61 66 38 65 62 22 2c 22 69 6d 70 22 3a 5b 7b 22 69 64 22 3a 22 34 33 62 65 34 64 64 33 63 36 35 32 32 64 22 2c 22 62 61 6e 6e 65 72 22 3a 7b 22 66 6f 72 6d 61 74 22 3a 5b 7b 22 77 22 3a 33 30 30 2c 22 68 22 3a 36 30 30 7d 2c 7b 22 77 22 3a 33 30 30 2c 22 68 22 3a 32 35 30 7d 2c 7b 22 77 22 3a 33 30 30 2c 22 68 22 3a 31 38 30 7d 2c 7b 22 77 22 3a 33 30 30 2c 22 68 22 3a 31 35 30 7d 2c 7b 22 77 22 3a 32 35 30 2c 22 68 22 3a 32 35 30 7d 2c 7b 22 77 22 3a 32 30 30 2c 22 68 22 3a 32 30 30 7d 2c 7b 22 77 22 3a 31 38 30 2c 22 68 22 3a 31 35 30 7d 2c 7b 22 77 22 3a 31 36 30 2c 22 68 22 3a 36 30 30 7d 2c 7b 22 77 22 3a 31 32 30 2c 22 68 22 3a 36 30 30 7d 5d 2c 22 65 78 74 22 3a 7b 22 76 69 65 77 61 62 69 6c 69 74 Data Ascii: {"id":"3165444d0faf8eb","imp":[{"id":"43be4dd3c6522d","banner":{"format":[{"w":300,"h":600},{"w":300,"h":250},{"w":300,"h":180},{"w":300,"h":150},{"w":250,"h":250},{"w":200,"h":200},{"w":180,"h":150},{"w":160,"h":600},{"w":120,"h":600}],"ext":{"viewabilit
2023-12-19 09:22:20 UTC	255	IN	HTTP/1.1 204 No Content date: Tue, 19 Dec 2023 09:22:20 GMT vary: Origin access-control-allow-origin: https://caffeine.softonic.com.br access-control-allow-credentials: true cache-control: no-store pragma: no-cache expires: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49816	104.18.36.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	636	OUT	POST /openrtb/pbjs?s=805152 HTTP/1.1 Host: htlb.casalemedia.com Connection: keep-alive Content-Length: 2449 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	2449	OUT	Data Raw: 7b 22 69 64 22 3a 22 32 34 63 35 32 62 61 36 63 63 34 37 61 61 64 22 2c 22 73 69 74 65 22 3a 7b 22 70 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 22 70 75 62 6c 69 73 68 65 72 22 3a 7b 22 64 6f 6d 61 69 6e 22 3a 22 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 7d 2c 22 6e 61 6d 65 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 63 6f 6e 74 65 78 74 22 3a 35 7d 7d 2c 22 65 78 74 22 3a 7b 22 73 6f 75 72 63 65 22 3a 22 70 72 65 62 69 64 22 2c 22 69 Data Ascii: {"id":"24c52ba6cc47aad","site":{"page":"https://caffeine.softonic.com.br/","domain":"softonic.com.br","publisher":{"domain":"softonic.com.br"},"name":"softonic","content":{"url":"https://caffeine.softonic.com.br/","context":5}},"ext":{"source":"prebid","i
2023-12-19 09:22:20 UTC	898	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:20 GMT Content-Type: application/json Content-Length: 37 Connection: close CF-Ray: 837e949ccaf5b3e5-MIA CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: https://caffeine.softonic.com.br Cache-Control: no-cache Expires: 0 Set-Cookie: receive-cookie-deprecation=1; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:20 GMT; Max-Age=31536000; HttpOnly; Secure; SameSite=None; Partitioned Access-Control-Allow-Credentials: true Pragma: no-cache Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GFXPDzXMWiVfq57m5as5ioUa8FMfEZfZmpAtczaBGiaVYeUd6uo1U0gT6NOQSM0Yrp9mJDal5EYMzc%2BNxFAIDJAdbTB6n65oGsSTOf2FQ0XrChjikC0g6vYWBqu%2BCMDj%2BxoUk8G6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:20 UTC	37	IN	Data Raw: 7b 22 69 64 22 3a 22 32 34 63 35 32 62 61 36 63 63 34 37 61 61 64 22 2c 22 73 65 61 74 62 69 64 22 3a 5b 5d 7d Data Ascii: {"id":"24c52ba6cc47aad","seatbid":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.16	49811	34.120.63.153	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	635	OUT	POST /rtb/prebid?cid=8CUQ9KO7A HTTP/1.1 Host: prebid.media.net Connection: keep-alive Content-Length: 2460 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	2460	OUT	Data Raw: 7b 22 73 69 74 65 22 3a 7b 22 64 6f 6d 61 69 6e 22 3a 22 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 22 70 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 72 65 66 22 3a 22 22 2c 22 74 6f 70 4d 6f 73 74 4c 6f 63 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 69 73 54 6f 70 22 3a 74 72 75 65 2c 22 63 61 6e 6f 6e 69 63 61 6c 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 6f 67 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d Data Ascii: {"site":{"domain":"caffeine.softonic.com.br","page":"https://caffeine.softonic.com.br/","ref":"","topMostLocation":"https://caffeine.softonic.com.br/","isTop":true,"canonical_url":"https://caffeine.softonic.com.br/","og_url":"https://caffeine.softonic.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.16	49813	50.19.31.61	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	612	OUT	POST /pb HTTP/1.1 Host: ad.360yield.com Connection: keep-alive Content-Length: 1390 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	1390	OUT	Data Raw: 7b 22 69 6d 70 22 3a 5b 7b 22 65 78 74 22 3a 7b 22 74 69 64 22 3a 22 39 34 34 35 33 36 34 38 2d 63 62 34 64 2d 34 64 38 39 2d 62 61 34 39 2d 31 37 66 33 36 66 38 61 66 63 34 65 22 2c 22 64 61 74 61 22 3a 7b 22 70 62 61 64 73 6c 6f 74 22 3a 22 2f 35 33 30 32 2f 64 65 73 6b 74 6f 70 2f 64 65 73 6b 74 6f 70 2d 57 65 62 2d 70 74 2f 41 70 70 73 2f 50 72 6f 67 72 61 6d 70 61 67 65 2f 41 54 46 5f 4d 50 55 5f 46 69 72 73 74 22 7d 2c 22 62 69 64 64 65 72 22 3a 7b 22 70 6c 61 63 65 6d 65 6e 74 49 64 22 3a 32 32 33 33 31 30 34 31 7d 7d 2c 22 69 64 22 3a 22 31 36 32 33 37 36 39 39 62 34 33 37 61 35 32 22 2c 22 62 61 6e 6e 65 72 22 3a 7b 22 74 6f 70 66 72 61 6d 65 22 3a 31 7d 2c 22 73 65 63 75 72 65 22 3a 31 7d 2c 7b 22 65 78 74 22 3a 7b 22 74 69 64 22 3a 22 39 63 31 Data Ascii: {"imp":[{"ext":{"tid":"94453648-cb4d-4d89-ba49-17f36f8afc4e","data":{"pbadslot":"/5302/desktop/desktop-Web-pt/Apps/Programpage/ATF_MPU_First"},"bidder":{"placementId":22331041}},"id":"16237699b437a52","banner":{"topframe":1},"secure":1},{"ext":{"tid":"9c1
2023-12-19 09:22:20 UTC	565	IN	HTTP/1.1 204 No Content Date: Tue, 19 Dec 2023 09:22:20 GMT Content-Type: text/plain Connection: close access-control-allow-origin: https://caffeine.softonic.com.br set-cookie: tuuid=9f860467-d79c-45d4-bcf9-51ad3d856e68; Expires=Mon, 18 Mar 2024 09:22:20 GMT; Domain=.360yield.com; Path=/; SameSite=None; Secure set-cookie: tuuid_lu=1702977740; Expires=Mon, 18 Mar 2024 09:22:20 GMT; Domain=.360yield.com; Path=/; SameSite=None; Secure p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" access-control-allow-credentials: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.16	49821	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	1316	OUT	GET /td/rul/631321069?random=1702977738859&cv=11&fst=1702977738859&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma=0&tcfd=10000&u_w=1280&u_h=1024&url=https%3A%2F%2Fcaffeine.softonic.com.br%2F&hn=www.googleadservices.com&frm=0&tiba=Caffeine%20-%20Download&us_privacy=1---&auid=133230612.1702977737&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=event%3Dgtag.config HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2023-12-19 09:22:20 UTC	954	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:20 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6; expires=Thu, 18-Dec-2025 09:22:20 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:20 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2023-12-19 09:22:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.16	49809	162.19.138.116	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	623	OUT	POST /api/config/prebid HTTP/1.1 Host: id5-sync.com Connection: keep-alive Content-Length: 172 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	172	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 69 64 35 49 64 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 70 61 72 74 6e 65 72 22 3a 36 39 31 2c 22 61 62 54 65 73 74 69 6e 67 22 3a 7b 22 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 6f 6e 74 72 6f 6c 47 72 6f 75 70 50 63 74 22 3a 30 2e 31 7d 7d 2c 22 73 74 6f 72 61 67 65 22 3a 7b 22 74 79 70 65 22 3a 22 68 74 6d 6c 35 22 2c 22 6e 61 6d 65 22 3a 22 69 64 35 69 64 22 2c 22 65 78 70 69 72 65 73 22 3a 39 30 2c 22 72 65 66 72 65 73 68 49 6e 53 65 63 6f 6e 64 73 22 3a 32 38 38 30 30 7d 7d Data Ascii: {"name":"id5Id","params":{"partner":691,"abTesting":{"enabled":true,"controlGroupPct":0.1}},"storage":{"type":"html5","name":"id5id","expires":90,"refreshInSeconds":28800}}
2023-12-19 09:22:20 UTC	426	IN	HTTP/1.1 200 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers access-control-allow-origin: https://caffeine.softonic.com.br vary: Origin access-control-allow-credentials: true content-type: application/json;charset=UTF-8 transfer-encoding: chunked date: Tue, 19 Dec 2023 09:22:20 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2023-12-19 09:22:20 UTC	146	IN	Data Raw: 38 37 0d 0a 7b 22 66 65 74 63 68 43 61 6c 6c 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 64 35 2d 73 79 6e 63 2e 63 6f 6d 2f 67 2f 76 32 2f 36 39 31 2e 6a 73 6f 6e 22 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 43 61 6c 6c 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 62 2e 65 75 2d 31 2d 69 64 35 2d 73 79 6e 63 2e 63 6f 6d 2f 6c 62 2f 76 31 22 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 87{"fetchCall":{"url":"https://id5-sync.com/g/v2/691.json"},"extensionsCall":{"url":"https://lb.eu-1-id5-sync.com/lb/v1","method":"GET"}}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.16	49814	69.175.41.32	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	639	OUT	POST /rtb/bid?src=prebid_prebid_8.19.0 HTTP/1.1 Host: ap.lijit.com Connection: keep-alive Content-Length: 1404 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	1404	OUT	Data Raw: 7b 22 69 64 22 3a 22 33 33 66 35 63 32 62 61 33 65 35 31 30 31 61 22 2c 22 69 6d 70 22 3a 5b 7b 22 61 64 75 6e 69 74 63 6f 64 65 22 3a 22 2f 35 33 30 32 2f 64 65 73 6b 74 6f 70 2f 64 65 73 6b 74 6f 70 2d 57 65 62 2d 70 74 2f 41 70 70 73 2f 50 72 6f 67 72 61 6d 70 61 67 65 2f 41 54 46 5f 4d 50 55 5f 46 69 72 73 74 22 2c 22 69 64 22 3a 22 32 32 63 36 33 37 65 31 65 37 33 34 61 66 62 22 2c 22 74 61 67 69 64 22 3a 22 31 31 35 33 30 39 36 22 2c 22 62 69 64 66 6c 6f 6f 72 22 3a 22 22 2c 22 62 61 6e 6e 65 72 22 3a 7b 22 66 6f 72 6d 61 74 22 3a 5b 7b 22 77 22 3a 33 30 30 2c 22 68 22 3a 36 30 30 7d 2c 7b 22 77 22 3a 33 30 30 2c 22 68 22 3a 32 35 30 7d 2c 7b 22 77 22 3a 33 30 30 2c 22 68 22 3a 31 38 30 7d 2c 7b 22 77 22 3a 33 30 30 2c 22 68 22 3a 31 35 30 7d 2c 7b Data Ascii: {"id":"33f5c2ba3e5101a","imp":[{"adunitcode":"/5302/desktop/desktop-Web-pt/Apps/Programpage/ATF_MPU_First","id":"22c637e1e734afb","tagid":"1153096","bidfloor":"","banner":{"format":[{"w":300,"h":600},{"w":300,"h":250},{"w":300,"h":180},{"w":300,"h":150},{
2023-12-19 09:22:20 UTC	530	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:20 GMT Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6;Version=1;Domain=.lijit.com;Path=/;Max-Age=31536000;Secure; SameSite=None; Content-Type: application/json Access-Control-Allow-Origin: https://caffeine.softonic.com.br Access-Control-Allow-Methods: GET, POST, DELETE, PUT Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Requested-With, Content-Type Vary: Accept-Encoding, User-Agent Content-Length: 94 X-Sovrn-Pod: ad_ap3ord1
2023-12-19 09:22:20 UTC	94	IN	Data Raw: 7b 22 69 64 22 3a 22 33 33 66 35 63 32 62 61 33 65 35 31 30 31 61 22 2c 22 62 69 64 69 64 22 3a 22 38 65 36 34 35 64 63 31 2d 31 37 34 64 2d 34 35 66 64 2d 38 37 31 31 2d 39 66 31 62 63 64 39 61 61 64 32 32 22 2c 22 65 78 74 22 3a 7b 22 69 69 64 22 3a 31 33 34 36 31 32 35 39 7d 7d Data Ascii: {"id":"33f5c2ba3e5101a","bidid":"8e645dc1-174d-45fd-8711-9f1bcd9aad22","ext":{"iid":13461259}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.16	49815	68.67.179.164	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	619	OUT	POST /ut/v3/prebid HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive Content-Length: 1454 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	1454	OUT	Data Raw: 7b 22 74 61 67 73 22 3a 5b 7b 22 73 69 7a 65 73 22 3a 5b 7b 22 77 69 64 74 68 22 3a 33 30 30 2c 22 68 65 69 67 68 74 22 3a 36 30 30 7d 2c 7b 22 77 69 64 74 68 22 3a 33 30 30 2c 22 68 65 69 67 68 74 22 3a 32 35 30 7d 2c 7b 22 77 69 64 74 68 22 3a 33 30 30 2c 22 68 65 69 67 68 74 22 3a 31 38 30 7d 2c 7b 22 77 69 64 74 68 22 3a 33 30 30 2c 22 68 65 69 67 68 74 22 3a 31 35 30 7d 2c 7b 22 77 69 64 74 68 22 3a 32 35 30 2c 22 68 65 69 67 68 74 22 3a 32 35 30 7d 2c 7b 22 77 69 64 74 68 22 3a 32 30 30 2c 22 68 65 69 67 68 74 22 3a 32 30 30 7d 2c 7b 22 77 69 64 74 68 22 3a 31 38 30 2c 22 68 65 69 67 68 74 22 3a 31 35 30 7d 2c 7b 22 77 69 64 74 68 22 3a 31 36 30 2c 22 68 65 69 67 68 74 22 3a 36 30 30 7d 2c 7b 22 77 69 64 74 68 22 3a 31 32 30 2c 22 68 65 69 67 68 74 Data Ascii: {"tags":[{"sizes":[{"width":300,"height":600},{"width":300,"height":250},{"width":300,"height":180},{"width":300,"height":150},{"width":250,"height":250},{"width":200,"height":200},{"width":180,"height":150},{"width":160,"height":600},{"width":120,"height

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.16	49808	35.167.194.178	443	4612	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 507 Host: analytics.apis.mcafee.com
2023-12-19 09:22:20 UTC	507	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 41 66 66 69 64 22 3a 22 39 31 30 38 38 22 2c 22 43 6f 75 6e 74 72 79 5f 43 6f 64 65 22 3a 22 55 53 22 2c 22 44 69 73 74 72 69 62 75 74 69 6f 6e 5f 53 75 62 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 4c 6f 75 64 6e 65 73 73 22 3a 22 53 69 6c 65 6e 74 22 2c 22 49 6e 73 74 61 6c 6c 5f 53 6f 75 72 63 65 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 49 72 6f 6e 73 6f 75 72 63 65 5f 50 69 78 65 6c 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a Data Ascii: {"Data":{"Affid":"91088","Country_Code":"US","Distribution_SubID":"UNDEFINED","Install_ID":"UNDEFINED","Install_Loudness":"Silent","Install_Source":"PaidDistribution","Ironsource_Pixel":"UNDEFINED","Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":
2023-12-19 09:22:20 UTC	304	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:20 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 133 Connection: close x-amz-id-2: 6F8J2ZdeEwFd+E+/wQcQku7r75xGFQRZUna+qmHqaXNBTXQzvIAnhkf5E1lEcvejTWGGkaySNyRi0O0WpXIoQIQqASAG8c0y x-amzn-RequestId: cd0641de-a978-3800-90fd-22d288313c16
2023-12-19 09:22:20 UTC	133	IN	Data Raw: 7b 22 45 6e 63 72 79 70 74 69 6f 6e 54 79 70 65 22 3a 22 4b 4d 53 22 2c 22 53 65 71 75 65 6e 63 65 4e 75 6d 62 65 72 22 3a 22 34 39 36 34 37 31 36 35 36 32 39 37 38 32 32 38 31 30 34 33 33 35 35 33 30 37 39 37 32 32 32 31 33 34 33 33 39 31 30 37 34 34 36 32 30 39 30 34 32 32 39 31 31 30 32 36 22 2c 22 53 68 61 72 64 49 64 22 3a 22 73 68 61 72 64 49 64 2d 30 30 30 30 30 30 30 30 30 30 30 33 22 7d Data Ascii: {"EncryptionType":"KMS","SequenceNumber":"49647165629782281043355307972221343391074462090422911026","ShardId":"shardId-000000000003"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.16	49820	104.36.115.111	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	648	OUT	POST /translator?source=prebid-client HTTP/1.1 Host: hbopenbid.pubmatic.com Connection: keep-alive Content-Length: 1815 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	1815	OUT	Data Raw: 7b 22 69 64 22 3a 22 31 37 30 32 39 37 37 37 33 38 36 34 32 22 2c 22 61 74 22 3a 31 2c 22 63 75 72 22 3a 5b 22 55 53 44 22 5d 2c 22 69 6d 70 22 3a 5b 7b 22 69 64 22 3a 22 37 31 33 39 38 32 34 39 37 38 36 61 61 36 22 2c 22 74 61 67 69 64 22 3a 22 34 32 39 35 31 32 38 22 2c 22 73 65 63 75 72 65 22 3a 31 2c 22 65 78 74 22 3a 7b 22 64 61 74 61 22 3a 7b 22 70 62 61 64 73 6c 6f 74 22 3a 22 2f 35 33 30 32 2f 64 65 73 6b 74 6f 70 2f 64 65 73 6b 74 6f 70 2d 57 65 62 2d 70 74 2f 41 70 70 73 2f 50 72 6f 67 72 61 6d 70 61 67 65 2f 41 54 46 5f 4d 50 55 5f 46 69 72 73 74 22 7d 7d 2c 22 62 69 64 66 6c 6f 6f 72 63 75 72 22 3a 22 55 53 44 22 2c 22 62 61 6e 6e 65 72 22 3a 7b 22 77 22 3a 33 30 30 2c 22 68 22 3a 36 30 30 2c 22 66 6f 72 6d 61 74 22 3a 5b 7b 22 77 22 3a 33 30 Data Ascii: {"id":"1702977738642","at":1,"cur":["USD"],"imp":[{"id":"71398249786aa6","tagid":"4295128","secure":1,"ext":{"data":{"pbadslot":"/5302/desktop/desktop-Web-pt/Apps/Programpage/ATF_MPU_First"}},"bidfloorcur":"USD","banner":{"w":300,"h":600,"format":[{"w":30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.16	49818	208.115.232.150	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	617	OUT	POST /hb/ HTTP/1.1 Host: shb.richaudience.com Connection: keep-alive Content-Length: 900 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	900	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 30 5a 6a 32 6b 78 6c 33 75 33 22 2c 22 73 75 70 70 6c 79 54 79 70 65 22 3a 22 73 69 74 65 22 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 45 55 52 22 2c 22 61 75 63 74 69 6f 6e 49 64 22 3a 22 61 30 32 66 34 63 37 31 2d 64 37 62 31 2d 34 37 66 33 2d 62 35 31 36 2d 66 36 61 31 37 38 38 30 30 30 34 62 22 2c 22 62 69 64 49 64 22 3a 22 32 38 31 63 66 34 66 64 63 61 62 66 34 39 39 22 2c 22 42 69 64 52 65 71 75 65 73 74 73 43 6f 75 6e 74 22 3a 31 2c 22 62 69 64 64 65 72 22 3a 22 72 69 63 68 61 75 64 69 65 6e 63 65 22 2c 22 62 69 64 64 65 72 52 65 71 75 65 73 74 49 64 22 3a 22 32 37 32 38 35 35 36 35 62 32 34 64 61 30 61 22 2c 22 74 61 67 49 64 22 3a 22 2f 35 33 30 32 2f 64 65 73 6b 74 6f 70 2f 64 65 73 6b 74 6f 70 2d 57 65 62 2d 70 Data Ascii: {"pid":"0Zj2kxl3u3","supplyType":"site","currencyCode":"EUR","auctionId":"a02f4c71-d7b1-47f3-b516-f6a17880004b","bidId":"281cf4fdcabf499","BidRequestsCount":1,"bidder":"richaudience","bidderRequestId":"27285565b24da0a","tagId":"/5302/desktop/desktop-Web-p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.16	49817	208.115.232.150	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	617	OUT	POST /hb/ HTTP/1.1 Host: shb.richaudience.com Connection: keep-alive Content-Length: 902 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	902	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 6d 57 35 4f 4f 55 50 44 67 4d 22 2c 22 73 75 70 70 6c 79 54 79 70 65 22 3a 22 73 69 74 65 22 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 45 55 52 22 2c 22 61 75 63 74 69 6f 6e 49 64 22 3a 22 61 30 32 66 34 63 37 31 2d 64 37 62 31 2d 34 37 66 33 2d 62 35 31 36 2d 66 36 61 31 37 38 38 30 30 30 34 62 22 2c 22 62 69 64 49 64 22 3a 22 32 39 35 32 39 64 36 32 63 63 37 39 63 31 63 22 2c 22 42 69 64 52 65 71 75 65 73 74 73 43 6f 75 6e 74 22 3a 31 2c 22 62 69 64 64 65 72 22 3a 22 72 69 63 68 61 75 64 69 65 6e 63 65 22 2c 22 62 69 64 64 65 72 52 65 71 75 65 73 74 49 64 22 3a 22 32 37 32 38 35 35 36 35 62 32 34 64 61 30 61 22 2c 22 74 61 67 49 64 22 3a 22 2f 35 33 30 32 2f 64 65 73 6b 74 6f 70 2f 64 65 73 6b 74 6f 70 2d 57 65 62 2d 70 Data Ascii: {"pid":"mW5OOUPDgM","supplyType":"site","currencyCode":"EUR","auctionId":"a02f4c71-d7b1-47f3-b516-f6a17880004b","bidId":"29529d62cc79c1c","BidRequestsCount":1,"bidder":"richaudience","bidderRequestId":"27285565b24da0a","tagId":"/5302/desktop/desktop-Web-p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.16	49819	208.115.232.150	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	617	OUT	POST /hb/ HTTP/1.1 Host: shb.richaudience.com Connection: keep-alive Content-Length: 902 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	902	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 30 6c 79 39 42 41 49 30 77 73 22 2c 22 73 75 70 70 6c 79 54 79 70 65 22 3a 22 73 69 74 65 22 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 45 55 52 22 2c 22 61 75 63 74 69 6f 6e 49 64 22 3a 22 61 30 32 66 34 63 37 31 2d 64 37 62 31 2d 34 37 66 33 2d 62 35 31 36 2d 66 36 61 31 37 38 38 30 30 30 34 62 22 2c 22 62 69 64 49 64 22 3a 22 33 30 62 30 30 65 39 39 66 63 63 65 34 33 62 22 2c 22 42 69 64 52 65 71 75 65 73 74 73 43 6f 75 6e 74 22 3a 31 2c 22 62 69 64 64 65 72 22 3a 22 72 69 63 68 61 75 64 69 65 6e 63 65 22 2c 22 62 69 64 64 65 72 52 65 71 75 65 73 74 49 64 22 3a 22 32 37 32 38 35 35 36 35 62 32 34 64 61 30 61 22 2c 22 74 61 67 49 64 22 3a 22 2f 35 33 30 32 2f 64 65 73 6b 74 6f 70 2f 64 65 73 6b 74 6f 70 2d 57 65 62 2d 70 Data Ascii: {"pid":"0ly9BAI0ws","supplyType":"site","currencyCode":"EUR","auctionId":"a02f4c71-d7b1-47f3-b516-f6a17880004b","bidId":"30b00e99fcce43b","BidRequestsCount":1,"bidder":"richaudience","bidderRequestId":"27285565b24da0a","tagId":"/5302/desktop/desktop-Web-p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.16	49812	44.231.162.210	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	844	OUT	POST /hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fcaffeine.softonic.com.br%2F&PageUrl=https%3A%2F%2Fcaffeine.softonic.com.br%2F&PageReferrer=https%3A%2F%2Fcaffeine.softonic.com.br%2F&CanonicalUrl=https%3A%2F%2Fcaffeine.softonic.com.br%2F HTTP/1.1 Host: hb-api.omnitagjs.com Connection: keep-alive Content-Length: 1537 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	1537	OUT	Data Raw: 7b 22 56 65 72 73 69 6f 6e 22 3a 22 31 2e 30 22 2c 22 42 69 64 73 22 3a 7b 22 31 39 38 32 64 33 38 62 65 66 30 61 61 62 31 22 3a 7b 22 50 6c 61 63 65 6d 65 6e 74 49 44 22 3a 22 36 35 65 63 32 64 65 62 66 36 32 37 62 32 30 33 64 66 39 30 64 36 61 64 38 30 66 36 35 65 61 37 22 2c 22 54 72 61 6e 73 61 63 74 69 6f 6e 49 44 22 3a 22 39 34 34 35 33 36 34 38 2d 63 62 34 64 2d 34 64 38 39 2d 62 61 34 39 2d 31 37 66 33 36 66 38 61 66 63 34 65 22 2c 22 57 69 64 74 68 22 3a 33 30 30 2c 22 48 65 69 67 68 74 22 3a 36 30 30 2c 22 41 76 61 69 6c 61 62 6c 65 53 69 7a 65 73 22 3a 22 33 30 30 78 36 30 30 2c 33 30 30 78 32 35 30 2c 33 30 30 78 31 38 30 2c 33 30 30 78 31 35 30 2c 32 35 30 78 32 35 30 2c 32 30 30 78 32 30 30 2c 31 38 30 78 31 35 30 2c 31 36 30 78 36 30 30 2c Data Ascii: {"Version":"1.0","Bids":{"1982d38bef0aab1":{"PlacementID":"65ec2debf627b203df90d6ad80f65ea7","TransactionID":"94453648-cb4d-4d89-ba49-17f36f8afc4e","Width":300,"Height":600,"AvailableSizes":"300x600,300x250,300x180,300x150,250x250,200x200,180x150,160x600,

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.16	49824	40.126.29.12	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4693 Host: login.live.com
2023-12-19 09:22:20 UTC	4693	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2023-12-19 09:22:21 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Dec 2023 09:21:20 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C107_SN1 x-ms-request-id: 485b7747-818c-4395-bb34-4530bc104951 PPServer: PPV: 30 H: SN1PEPF00010FB5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Dec 2023 09:22:20 GMT Connection: close Content-Length: 10921
2023-12-19 09:22:21 UTC	10921	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.16	49825	142.250.64.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 142 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	142	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 35 31 36 33 33 39 30 36 34 34 30 35 32 36 37 30 37 32 36 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://softonic.com.br","trigger_debug_key":"5163390644052670726"},"type":"trigger-no-matching-source"}]
2023-12-19 09:22:21 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:20 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.16	49765	65.8.27.208	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	543	OUT	GET /aax2/apstag.js HTTP/1.1 Host: c.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	651	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 288259 Connection: close Date: Tue, 19 Dec 2023 08:34:24 GMT Last-Modified: Tue, 12 Dec 2023 22:20:11 GMT x-amz-server-side-encryption: AES256 Cache-Control: max-age=3600 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 c974a69619205281e0e6b8e73f95e4b4.cloudfront.net (CloudFront), 1.1 4de3cdbf8046367453bc168e829b445e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C3 ETag: "bab82e5d8801f394c1ef53a45dc29542" Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: MIA3-C5 X-Amz-Cf-Id: TrhqpNAo3kEK5OsnlFKrDwzyJyiUvDnqLjneomvQAqhLgL9qB23cEw== Age: 2877
2023-12-19 09:22:20 UTC	15733	IN	Data Raw: 2f 2a 21 20 40 61 6d 7a 6e 2f 61 70 73 77 65 62 61 70 73 74 61 67 6c 69 62 72 61 72 79 20 2d 20 77 65 62 2d 63 6c 69 65 6e 74 2d 62 75 6e 64 6c 65 20 2d 20 76 32 33 2e 31 32 31 31 2e 31 36 34 35 20 2d 20 32 30 32 33 2d 31 32 2d 31 31 20 31 36 3a 34 35 3a 34 39 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 6e 20 74 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 65 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 20 69 Data Ascii: /! @amzn/apswebapstaglibrary - web-client-bundle - v23.1211.1645 - 2023-12-11 16:45:49 /!function(){"use strict";var t=function(e,n){return t=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var n i
2023-12-19 09:22:20 UTC	16384	IN	Data Raw: 74 68 69 73 2e 67 6c 6f 62 61 6c 43 6f 6e 74 65 78 74 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 29 72 65 74 75 72 6e 20 74 68 69 73 2e 67 6c 6f 62 61 6c 43 6f 6e 74 65 78 74 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 65 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 65 72 73 69 73 74 57 72 69 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 21 44 2e 69 6e 63 6c 75 64 65 73 28 74 29 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 22 2e 63 6f 6e 63 61 74 28 74 2c 22 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 62 65 20 77 72 69 74 74 65 6e 20 74 6f 20 62 72 6f 77 73 65 72 20 73 74 6f 72 61 67 65 22 29 29 3b 69 66 28 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 29 74 68 72 6f 77 20 6e 65 77 20 45 72 Data Ascii: this.globalContext.localStorage)return this.globalContext.localStorage.getItem(e)},t.prototype.persistWrite=function(t,e){if(!D.includes(t))throw new Error("".concat(t," is not allowed to be written to browser storage"));if("string"!=typeof e)throw new Er
2023-12-19 09:22:21 UTC	16384	IN	Data Raw: 2e 70 72 6f 74 6f 74 79 70 65 2c 22 70 6f 70 75 6c 61 74 65 22 2c 6e 75 6c 6c 29 2c 61 28 5b 4c 28 22 48 41 53 48 23 43 6f 72 65 2e 6c 69 62 72 61 72 79 2e 55 73 65 72 53 70 61 63 65 2e 6c 6f 61 64 22 29 5d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2c 22 6c 6f 61 64 22 2c 6e 75 6c 6c 29 2c 74 7d 28 29 2c 61 74 3d 6e 65 77 20 4d 61 70 28 5b 5b 22 5f 63 6f 6e 66 69 67 2f 65 76 65 6e 74 73 2f 61 63 74 69 76 61 74 65 22 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2e 63 75 73 74 6f 6d 45 76 65 6e 74 2c 6e 3d 74 2e 61 63 63 6f 75 6e 74 3b 72 65 74 75 72 6e 20 75 28 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 63 28 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: .prototype,"populate",null),a([L("HASH#Core.library.UserSpace.load")],t.prototype,"load",null),t}(),at=new Map([["_config/events/activate",function(t){var e=t.customEvent,n=t.account;return u(void 0,void 0,void 0,(function(){var t;return c(this,(function(
2023-12-19 09:22:21 UTC	16384	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 29 29 7d 28 65 29 2c 5b 32 2c 6f 2e 63 6f 6d 70 6c 65 74 65 64 5d 7d 7d 29 29 7d 29 29 7d 5d 2c 5b 46 74 2e 61 64 5f 74 61 72 67 65 74 69 6e 67 5f 61 74 74 61 63 68 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2e 61 63 63 6f 75 6e 74 2c 6e 3d 74 2e 63 75 73 74 6f 6d 45 76 65 6e 74 3b 72 65 74 75 72 6e 20 75 28 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 72 2c 69 2c 61 3b 72 65 74 75 72 6e 20 63 28 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 75 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 28 74 3d 6e 75 6c 6c 3d 3d 3d 28 69 3d 6e 2e 64 65 74 61 69 6c 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 Data Ascii: unction(){return e}))}(e),[2,o.completed]}}))}))}],[Ft.ad_targeting_attach,function(t){var e=t.account,n=t.customEvent;return u(void 0,void 0,void 0,(function(){var t,r,i,a;return c(this,(function(u){if(void 0===(t=null===(i=n.detail)\|\|void 0===i?void 0:i
2023-12-19 09:22:21 UTC	16384	IN	Data Raw: 7b 76 61 72 20 72 2c 69 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 28 6e 75 6c 6c 3d 3d 3d 28 72 3d 6e 2e 64 65 74 61 69 6c 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 3f 76 6f 69 64 20 30 3a 72 2e 63 6f 6e 66 69 67 29 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 4d 69 73 73 69 6e 67 20 74 6f 6b 65 6e 43 6f 6e 66 69 67 20 6f 62 6a 65 63 74 22 29 3b 74 72 79 7b 6e 75 6c 6c 3d 3d 3d 28 69 3d 65 2e 67 6c 6f 62 61 6c 43 6f 6e 74 65 78 74 2e 61 70 73 74 61 67 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 7c 7c 69 2e 75 70 61 28 6e 2e 64 65 74 61 69 6c 2e 63 6f 6e 66 69 67 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 29 7d 29 2c 6e 2e 64 65 74 61 69 6c 2e 73 65 74 43 6f 6f 6b 69 65 2c 22 61 70 69 22 2c 65 2e 69 64 29 7d 63 61 74 63 68 28 74 29 7b Data Ascii: {var r,i;if(void 0===(null===(r=n.detail)\|\|void 0===r?void 0:r.config))throw new Error("Missing tokenConfig object");try{null===(i=e.globalContext.apstag)\|\|void 0===i\|\|i.upa(n.detail.config,(function(){return t()}),n.detail.setCookie,"api",e.id)}catch(t){
2023-12-19 09:22:21 UTC	16384	IN	Data Raw: 2e 63 6f 6e 63 61 74 28 6c 28 65 5b 6e 2e 73 6c 6f 74 49 44 5d 29 2c 5b 6e 5d 29 3a 4f 62 6a 65 63 74 28 69 2e 6b 29 28 74 2c 6e 2e 73 6c 6f 74 49 44 29 3f 65 5b 6e 2e 73 6c 6f 74 49 44 5d 3d 5b 5d 2e 63 6f 6e 63 61 74 28 6c 28 74 5b 6e 2e 73 6c 6f 74 49 44 5d 29 2c 5b 6e 5d 29 3a 65 5b 6e 2e 73 6c 6f 74 49 44 5d 3d 5b 6e 5d 2c 65 7d 29 2c 7b 7d 29 29 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 20 73 28 7b 7d 2c 74 29 7d 7d 28 74 2e 73 6c 6f 74 42 69 64 73 2c 65 29 2c 74 61 72 67 65 74 69 6e 67 4b 65 79 73 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 22 55 50 44 41 54 45 5f 53 4c 4f 54 5f 42 49 44 53 22 21 3d 3d 65 2e 74 79 70 65 3f 73 28 7b 7d 2c 74 29 3a 73 28 73 28 7b 7d 2c 74 29 2c 65 2e 62 69 64 73 2e 72 65 64 75 63 65 28 28 66 75 Data Ascii: .concat(l(e[n.slotID]),[n]):Object(i.k)(t,n.slotID)?e[n.slotID]=[].concat(l(t[n.slotID]),[n]):e[n.slotID]=[n],e}),{}));default:return s({},t)}}(t.slotBids,e),targetingKeys:function(t,e){return"UPDATE_SLOT_BIDS"!==e.type?s({},t):s(s({},t),e.bids.reduce((fu
2023-12-19 09:22:21 UTC	16384	IN	Data Raw: 22 6d 77 22 2c 65 2e 53 45 4c 46 5f 53 45 52 56 45 5f 57 45 42 3d 22 73 73 77 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 65 2c 22 61 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 29 29 2c 6e 2e 64 28 65 2c 22 62 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6d 7d 29 29 2c 6e 2e 64 28 65 2c 22 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 7d 29 29 2c 6e 2e 64 28 65 2c 22 63 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7d 29 29 2c 6e 2e 64 28 65 2c 22 65 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 29 29 3b 76 61 72 20 72 3d 6e 28 32 29 2c 6f 3d 6e 28 35 29 2c 69 3d 6e 28 30 29 2c 61 3d Data Ascii: "mw",e.SELF_SERVE_WEB="ssw"},function(t,e,n){"use strict";n.d(e,"a",(function(){return d})),n.d(e,"b",(function(){return m})),n.d(e,"d",(function(){return _})),n.d(e,"c",(function(){return A})),n.d(e,"e",(function(){return E}));var r=n(2),o=n(5),i=n(0),a=
2023-12-19 09:22:21 UTC	16384	IN	Data Raw: 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 72 3d 65 5b 6e 5d 3b 72 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 72 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 72 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 72 26 26 28 72 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 49 28 72 2e 6b 65 79 29 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 28 74 2c 65 2c 6e 29 7b 28 65 3d 49 28 65 29 29 69 6e 20 74 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 65 2c 7b 76 61 6c 75 65 3a 6e 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 74 5b 65 5d 3d 6e 7d 66 75 6e 63 Data Ascii: gth;n++){var r=e[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(t,I(r.key),r)}}function A(t,e,n){(e=I(e))in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n}func
2023-12-19 09:22:21 UTC	16384	IN	Data Raw: 28 74 29 7b 72 65 74 75 72 6e 20 74 3d 3d 3d 62 2e 6e 6f 43 6f 6e 73 65 6e 74 3f 22 41 4d 5a 4e 2d 4e 6f 43 6f 6f 6b 69 65 43 6f 6e 73 65 6e 74 22 3a 22 41 4d 5a 4e 2d 54 6f 6b 65 6e 22 7d 66 75 6e 63 74 69 6f 6e 20 76 28 74 2c 65 2c 6e 29 7b 74 3d 30 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 74 3f 74 3a 22 22 2c 65 3d 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 65 3f 65 3a 30 2c 6e 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 3a 62 2e 74 6f 6b 65 6e 3b 74 72 79 7b 76 61 72 20 6f 3d 6e 65 77 20 44 61 74 65 28 65 29 2e 74 6f 55 54 43 53 74 72 69 6e 67 28 29 3b 75 2e 61 2e 67 65 74 44 65 66 61 75 6c 74 28 29 2e 63 6f 6f Data Ascii: (t){return t===b.noConsent?"AMZN-NoCookieConsent":"AMZN-Token"}function v(t,e,n){t=0<arguments.length&&void 0!==t?t:"",e=1<arguments.length&&void 0!==e?e:0,n=2<arguments.length&&void 0!==n?n:b.token;try{var o=new Date(e).toUTCString();u.a.getDefault().coo
2023-12-19 09:22:21 UTC	16384	IN	Data Raw: 2c 41 74 2e 61 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 53 45 54 5f 43 4f 4e 46 49 47 22 2c 63 6f 6e 66 69 67 3a 74 2c 64 65 66 61 75 6c 74 43 6d 70 54 69 6d 65 6f 75 74 3a 41 74 2e 61 2e 67 65 74 53 74 61 74 65 28 29 2e 63 66 67 2e 47 44 50 52 5f 43 4d 50 5f 54 49 4d 45 4f 55 54 7d 29 7d 63 61 74 63 68 28 65 29 7b 4f 62 6a 65 63 74 28 4d 74 2e 62 29 28 65 2c 22 5f 76 61 6c 69 64 61 74 65 41 6e 64 53 74 6f 72 65 43 6f 6e 66 69 67 22 2c 7b 6d 61 6b 65 56 69 73 69 62 6c 65 54 6f 41 6c 6c 55 73 65 72 73 3a 21 30 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 74 2c 65 29 7b 74 72 79 7b 76 61 72 20 6e 3d 74 2e 73 6c 6f 74 49 44 2c 72 3d 21 31 3b 4f 62 6a 65 63 74 28 52 74 2e 6b 29 28 74 2e 62 69 64 43 6f 6e 66 69 67 2c 22 61 6d 7a 6e 62 69 64 22 29 26 Data Ascii: ,At.a.dispatch({type:"SET_CONFIG",config:t,defaultCmpTimeout:At.a.getState().cfg.GDPR_CMP_TIMEOUT})}catch(e){Object(Mt.b)(e,"_validateAndStoreConfig",{makeVisibleToAllUsers:!0})}}function o(t,e){try{var n=t.slotID,r=!1;Object(Rt.k)(t.bidConfig,"amznbid")&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.16	49826	172.217.15.198	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:20 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 142 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:20 UTC	142	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 34 34 35 34 32 35 37 32 30 32 32 36 35 39 34 31 36 33 32 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://softonic.com.br","trigger_debug_key":"4454257202265941632"},"type":"trigger-no-matching-source"}]
2023-12-19 09:22:21 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:21 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.16	49828	35.227.233.104	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	1170	OUT	GET /best-recommended-apps?appId=f46a4db4-96d4-11e6-b215-00163ec9f5fa&categoryId=utilities-tools&pageId=app&developerSlug=zhornsoftware&platformId=windows&locale=pt-BR&programName=Caffeine&browserName=chrome&browserVersion=117.0.0.0&countryCode=US&deviceType=desktop&isEU=false&isuserfornia=false&region=FL&userPlatformId=windows&userPlatformVersion=10.0&placementId=download-intent&position=85 HTTP/1.1 Host: caffeine.softonic.com.br Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _usr_orgn=direct; _swo_pos=341; session.pv=1; persistent.fpmUserId=75c494bb-9642-443c-9078-46f928a097b4; session.fpmSessionId=f3c99309-04ba-4e51-b2a2-fb42d95561db; _gcl_au=1.1.133230612.1702977737; rv_prebid_position=18; rv_test_position=111; rv_fp_ad_session_id=ca334998-1875-4288-9025-8f913da6a89a; rv_fp_pv=1; rv_google_ppid=a621a63a-2788-4df7-a4b3-b3d6a6693bad; AMP_TOKEN=%24RETRIEVING; _dd_s=rum=0&expire=1702978639350
2023-12-19 09:22:21 UTC	781	IN	HTTP/1.1 200 OK x-version: 4.431.0 x-server-by: cpi-api x-resource-id: @cpi-api/bestRecommendedApps x-page-id: bestRecommendedApps x-request-id: 15ee5e2e-f73a-4543-a3db-159550b014ee vary: Origin, accept-encoding access-control-allow-origin: * cache-control: no-cache,no-store,max-age=0,must-revalidate x-suitable-campaigns-count: 4 x-winner-campaign-id: winzip-compression x-winner-campaign-logic: sov x-country-code: US x-user-platform: windows x-publisher-id: softonic x-publisher-projection-version: 3902 content-type: application/json; charset=utf-8 Content-Length: 6234 date: Tue, 19 Dec 2023 09:22:21 GMT x-envoy-upstream-service-time: 24 server: istio-envoy Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 7b 22 77 69 6e 6e 65 72 43 61 6d 70 61 69 67 6e 22 3a 7b 22 69 64 22 3a 22 77 69 6e 7a 69 70 2d 63 6f 6d 70 72 65 73 73 69 6f 6e 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 6c 6f 67 69 63 22 3a 22 73 6f 76 22 2c 22 63 72 65 61 74 69 76 69 74 79 22 3a 7b 22 74 65 6d 70 6c 61 74 65 49 64 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 74 65 6d 70 6c 61 74 65 53 65 74 74 69 6e 67 73 22 3a 7b 22 64 69 73 63 6c 61 69 6d 65 72 43 6f 6c 6f 72 22 3a 22 23 37 31 37 34 37 61 22 2c 22 74 69 74 6c 65 43 6f 6c 6f 72 22 3a 22 23 31 34 31 34 31 35 22 2c 22 73 75 62 74 69 74 6c 65 43 6f 6c 6f 72 22 3a 22 23 31 34 31 34 31 35 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 23 66 66 66 22 2c 22 63 74 61 42 61 63 6b 67 72 6f 75 Data Ascii: {"winnerCampaign":{"id":"winzip-compression","publisherId":"softonic","logic":"sov","creativity":{"templateId":"default","templateSettings":{"disclaimerColor":"#71747a","titleColor":"#141415","subtitleColor":"#141415","backgroundColor":"#fff","ctaBackgrou
2023-12-19 09:22:21 UTC	876	IN	Data Raw: 22 3a 22 5a 69 70 20 66 69 6c 65 73 20 66 72 6f 6d 20 61 6e 79 20 6c 6f 63 61 74 69 6f 6e 22 2c 22 66 65 61 74 75 72 65 43 22 3a 22 50 72 6f 74 65 63 74 c2 a0 66 69 6c 65 73 20 77 69 74 68 20 62 61 6e 6b 69 6e 67 2d 6c 65 76 65 6c 20 65 6e 63 72 79 70 74 69 6f 6e 22 2c 22 73 75 62 54 69 74 6c 65 22 3a 22 5a 69 70 2c 20 55 6e 7a 69 70 20 61 6e 64 20 53 68 61 72 65 22 2c 22 63 75 73 74 6f 6d 22 3a 7b 22 64 69 73 63 6c 61 69 6d 65 72 4c 69 6e 6b 55 72 6c 22 3a 22 22 2c 22 64 69 73 63 6c 61 69 6d 65 72 4c 69 6e 6b 54 65 78 74 22 3a 22 22 2c 22 6f 70 74 69 6f 6e 61 6c 44 69 73 63 6c 61 69 6d 65 72 22 3a 22 22 7d 7d 2c 22 62 75 69 6c 64 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 77 69 6e 7a 69 70 2e 63 6f 6d 2f 67 6c 2f 6f Data Ascii: ":"Zip files from any location","featureC":"Protectfiles with banking-level encryption","subTitle":"Zip, Unzip and Share","custom":{"disclaimerLinkUrl":"","disclaimerLinkText":"","optionalDisclaimer":""}},"build":{"url":"https://download.winzip.com/gl/o
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 4b 6d 62 75 4b 6b 58 69 54 6a 54 41 6c 51 2d 77 37 2d 50 61 45 77 22 7d 2c 22 61 6c 6c 41 63 74 69 76 65 43 61 6d 70 61 69 67 6e 73 22 3a 5b 7b 22 69 64 22 3a 22 70 64 66 2d 64 6f 63 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 72 70 6d 22 3a 32 34 31 2e 32 33 38 39 35 2c 22 73 6f 76 22 3a 31 30 30 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 66 61 6c 73 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 77 69 6e 7a 69 70 2d 63 6f 6d 70 72 65 73 73 69 6f 6e 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c Data Ascii: KmbuKkXiTjTAlQ-w7-PaEw"},"allActiveCampaigns":[{"id":"pdf-doc","publisherId":"softonic","iteration":1,"rpm":241.23895,"sov":100,"isGuaranteedMode":false,"hasLimits":false,"isBackup":false},{"id":"winzip-compression","publisherId":"softonic","iteration":1,
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 72 70 6d 22 3a 31 33 31 2e 37 30 36 32 39 2c 22 73 6f 76 22 3a 22 2d 22 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 74 72 75 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 61 76 61 73 74 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 72 70 6d 22 3a 31 30 36 2e 35 39 38 39 38 2c 22 73 6f 76 22 3a 30 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 74 72 75 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 Data Ascii: Id":"softonic","iteration":1,"rpm":131.70629,"sov":"-","isGuaranteedMode":true,"hasLimits":false,"isBackup":false},{"id":"avast","publisherId":"softonic","iteration":1,"rpm":106.59898,"sov":0,"isGuaranteedMode":true,"hasLimits":false,"isBackup":false},{"i
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 73 6f 76 22 3a 30 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 66 61 6c 73 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 75 70 67 72 61 64 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 73 6f 76 22 3a 30 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 66 61 6c 73 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 74 72 75 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 6f 70 65 72 61 2d 64 65 76 73 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 Data Ascii: :"softonic","iteration":1,"sov":0,"isGuaranteedMode":false,"hasLimits":false,"isBackup":false},{"id":"upgrad","publisherId":"softonic","iteration":1,"sov":0,"isGuaranteedMode":false,"hasLimits":true,"isBackup":false},{"id":"opera-devs","publisherId":"soft
2023-12-19 09:22:21 UTC	350	IN	Data Raw: 31 2c 22 72 70 6d 22 3a 31 33 35 2e 34 34 32 38 31 2c 22 73 6f 76 22 3a 31 30 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 66 61 6c 73 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 74 72 75 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 6e 6f 72 74 6f 6e 2d 73 65 63 75 72 65 2d 62 72 6f 77 73 65 72 22 2c 22 70 75 62 6c 69 73 68 65 72 49 64 22 3a 22 73 6f 66 74 6f 6e 69 63 22 2c 22 69 74 65 72 61 74 69 6f 6e 22 3a 31 2c 22 72 70 6d 22 3a 31 37 31 2e 33 36 31 37 34 2c 22 73 6f 76 22 3a 22 2d 22 2c 22 69 73 47 75 61 72 61 6e 74 65 65 64 4d 6f 64 65 22 3a 66 61 6c 73 65 2c 22 68 61 73 4c 69 6d 69 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 42 61 63 6b 75 70 22 3a 66 61 6c 73 65 7d 5d 2c 22 70 6c 61 63 65 6d 65 6e 74 49 Data Ascii: 1,"rpm":135.44281,"sov":10,"isGuaranteedMode":false,"hasLimits":true,"isBackup":false},{"id":"norton-secure-browser","publisherId":"softonic","iteration":1,"rpm":171.36174,"sov":"-","isGuaranteedMode":false,"hasLimits":false,"isBackup":false}],"placementI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.16	49833	172.217.15.198	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	919	OUT	GET /activity;register_conversion=1;src=12325200;type=invmedia;cat=softo003;ord=6058147887192;auiddc=133230612.1702977737;ps=1;pcor=1728039348;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:21 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:21 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"14437864426135804514"}],"aggregatable_trigger_data":[{"filters":{"14":["13823878"]},"key_piece":"0xd608a8d828d7d85a","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xcf9f15bf62491986","not_filters":{"14":["13823878"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["13823878"]},"key_piece":"0xae615a7c38c10581","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x3c09a5785611be5e","not_filters":{"14":["13823878"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"5163390644052670726","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"14437864426135804514","filters":{"14":["13823878"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"14437864426135804514","filters":{"14":["13823878"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"14437864426135804514","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"14437864426135804514","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["12325200"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Thu, 18-Jan-2024 09:22:21 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.16	49832	172.217.15.198	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	946	OUT	GET /activity;register_conversion=1;src=8876029;type=invmedia;cat=progr0;ord=2316977282064;auiddc=133230612.1702977737;u2=%2Fprogram_page;u3=Caffeine;ps=1;pcor=858286563;gtm=45He3bt0v6335967;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fcaffeine.softonic.com.br%2F? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:21 UTC	2214	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:21 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16122196795318167323"}],"aggregatable_trigger_data":[{"filters":{"14":["7903994"]},"key_piece":"0xad472b9bcd9c296f","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xc9442a5fcb6ebfbf","not_filters":{"14":["7903994"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["7903994"]},"key_piece":"0xd4494164f9fa265a","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xe5799ebc19073057","not_filters":{"14":["7903994"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"4454257202265941632","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16122196795318167323","filters":{"14":["7903994"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"16122196795318167323","filters":{"14":["7903994"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"16122196795318167323","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"16122196795318167323","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["8876029"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Thu, 18-Jan-2024 09:22:21 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.16	49829	172.217.3.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	771	OUT	GET /pagead/managed/js/gpt/m202312060101/pubads_impl.js HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:21 UTC	709	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe Content-Length: 441821 X-XSS-Protection: 0 Date: Mon, 18 Dec 2023 14:05:36 GMT Expires: Tue, 17 Dec 2024 14:05:36 GMT Cache-Control: public, immutable, max-age=31536000 ETag: 6854214708762155125 Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 69405 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:21 UTC	543	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 2f 2a 20 0a 20 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 0a 2a 2f 20 0a 2f 2a 20 0a 20 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 0a 2a 2f 20 0a 76 61 72 20 63 61 2c 65 61 2c 68 61 2c 6a 61 2c 6e 61 2c 70 61 2c 73 61 2c 76 61 2c 75 61 2c 77 61 2c 78 61 2c 7a 61 2c 42 61 2c 43 61 2c 45 61 2c 47 61 2c 4b 61 2c 4c 61 2c 4d 61 2c 4e 61 2c 51 61 2c 58 61 2c 66 62 2c 69 62 2c 6b 62 2c 6d 62 2c 71 62 2c 74 62 2c 78 62 2c 7a 62 2c 44 62 2c 47 62 2c 49 62 2c 4b 62 Data Ascii: (function(_){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / / SPDX-License-Identifier: Apache-2.0 */ var ca,ea,ha,ja,na,pa,sa,va,ua,wa,xa,za,Ba,Ca,Ea,Ga,Ka,La,Ma,Na,Qa,Xa,fb,ib,kb,mb,qb,tb,xb,zb,Db,Gb,Ib,Kb
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 2c 48 65 2c 4d 65 2c 4f 65 2c 51 65 2c 53 65 2c 54 65 2c 55 65 2c 61 66 2c 62 66 2c 63 66 2c 6a 66 2c 6b 66 2c 6d 66 2c 6e 66 2c 6f 66 2c 70 66 2c 71 66 2c 73 66 2c 75 66 2c 76 66 2c 79 66 2c 7a 66 2c 41 66 2c 44 66 2c 46 66 2c 48 66 2c 4a 66 2c 4c 66 2c 4e 66 2c 51 66 2c 52 66 2c 53 66 2c 54 66 2c 56 66 2c 57 66 2c 59 66 2c 5a 66 2c 61 67 2c 63 67 2c 64 67 2c 65 67 2c 66 67 2c 69 67 2c 6b 67 2c 6f 67 2c 6d 67 2c 73 67 2c 74 67 2c 75 67 2c 71 67 2c 72 67 2c 76 67 2c 77 67 2c 78 67 2c 41 67 2c 42 67 2c 47 67 2c 48 67 2c 4f 67 2c 50 67 2c 53 67 2c 57 67 2c 24 67 2c 63 68 2c 65 68 2c 67 68 2c 68 68 2c 69 68 2c 6a 68 2c 6b 68 2c 6c 68 2c 6e 68 2c 71 68 2c 72 68 2c 78 68 2c 45 68 2c 48 68 2c 4b 68 2c 4c 2c 4c 68 2c 52 68 2c 50 68 2c 68 69 2c 6a 69 2c 6c 69 2c Data Ascii: ,He,Me,Oe,Qe,Se,Te,Ue,af,bf,cf,jf,kf,mf,nf,of,pf,qf,sf,uf,vf,yf,zf,Af,Df,Ff,Hf,Jf,Lf,Nf,Qf,Rf,Sf,Tf,Vf,Wf,Yf,Zf,ag,cg,dg,eg,fg,ig,kg,og,mg,sg,tg,ug,qg,rg,vg,wg,xg,Ag,Bg,Gg,Hg,Og,Pg,Sg,Wg,$g,ch,eh,gh,hh,ih,jh,kh,lh,nh,qh,rh,xh,Eh,Hh,Kh,L,Lh,Rh,Ph,hi,ji,li,
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 74 79 70 65 2e 73 70 6c 69 63 65 2e 63 61 6c 6c 28 61 2c 62 2c 31 29 3b 72 65 74 75 72 6e 20 63 7d 3b 5f 2e 69 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 6c 65 6e 67 74 68 3b 69 66 28 30 3c 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 41 72 72 61 79 28 62 29 2c 64 3d 30 3b 64 3c 62 3b 64 2b 2b 29 63 5b 64 5d 3d 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 6a 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 32 3e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3f 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 2c 62 29 3a 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 2c 62 2c 63 29 7d 3b 6e 61 3d 66 75 6e 63 74 Data Ascii: type.splice.call(a,b,1);return c};_.ia=function(a){var b=a.length;if(0<b){for(var c=Array(b),d=0;d<b;d++)c[d]=a[d];return c}return[]};ja=function(a,b,c){return 2>=arguments.length?Array.prototype.slice.call(a,b):Array.prototype.slice.call(a,b,c)};na=funct
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 2e 63 61 6c 6c 28 76 6f 69 64 20 30 2c 61 5b 63 5d 2c 63 2c 61 29 7d 3b 42 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 5b 5d 2c 63 3d 30 2c 64 3b 66 6f 72 28 64 20 69 6e 20 61 29 62 5b 63 2b 2b 5d 3d 61 5b 64 5d 3b 72 65 74 75 72 6e 20 62 7d 3b 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 69 66 28 62 2e 63 61 6c 6c 28 76 6f 69 64 20 30 2c 61 5b 63 5d 2c 63 2c 61 29 29 72 65 74 75 72 6e 20 63 7d 3b 45 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 2c 64 2c 65 3d 31 3b 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 64 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 66 6f 72 28 63 20 69 Data Ascii: ,b){for(var c in a)b.call(void 0,a[c],c,a)};Ba=function(a){var b=[],c=0,d;for(d in a)b[c++]=a[d];return b};Ca=function(a,b){for(var c in a)if(b.call(void 0,a[c],c,a))return c};Ea=function(a,b){for(var c,d,e=1;e<arguments.length;e++){d=arguments[e];for(c i
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 74 72 79 7b 62 2e 68 72 65 66 3d 61 7d 63 61 74 63 68 28 63 29 7b 62 3d 76 6f 69 64 20 30 3b 62 72 65 61 6b 20 62 7d 62 3d 62 2e 70 72 6f 74 6f 63 6f 6c 3b 62 3d 22 3a 22 3d 3d 3d 62 7c 7c 22 22 3d 3d 3d 62 3f 22 68 74 74 70 73 3a 22 3a 62 7d 69 66 28 22 6a 61 76 61 73 63 72 69 70 74 3a 22 21 3d 3d 62 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 53 61 3f 5f 2e 24 61 28 61 29 3a 5f 2e 5a 61 28 61 29 7d 3b 5f 2e 64 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 3d 5f 2e 61 62 28 62 29 3b 76 6f 69 64 20 30 21 3d 3d 62 26 26 28 61 2e 68 72 65 66 3d 62 29 7d 3b 5f 2e 65 62 3d 66 75 6e 63 74 69 6f 6e Data Ascii: reateElement("a");try{b.href=a}catch(c){b=void 0;break b}b=b.protocol;b=":"===b\|\|""===b?"https:":b}if("javascript:"!==b)return a};_.ab=function(a){return a instanceof _.Sa?_.$a(a):_.Za(a)};_.db=function(a,b){b=_.ab(b);void 0!==b&&(a.href=b)};_.eb=function
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 28 6f 62 28 62 29 2c 34 29 3b 63 61 73 65 20 34 3a 63 3d 68 2e 6d 3b 68 2e 67 3d 33 3b 68 2e 6c 3d 30 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 70 62 28 68 29 3b 63 61 73 65 20 33 3a 69 66 28 21 63 29 72 65 74 75 72 6e 20 68 2e 72 65 74 75 72 6e 28 76 6f 69 64 20 30 29 3b 64 3d 61 2e 44 64 7c 7c 63 2e 73 6f 64 61 72 5f 71 75 65 72 79 5f 69 64 3b 65 3d 76 6f 69 64 20 30 21 3d 3d 63 2e 72 63 5f 65 6e 61 62 6c 65 26 26 61 2e 6c 3f 63 2e 72 63 5f 65 6e 61 62 6c 65 3a 22 6e 22 3b 66 3d 76 6f 69 64 20 30 3d 3d 3d 63 2e 62 67 5f 73 6e 61 70 73 68 6f 74 5f 64 65 6c 61 79 5f 6d 73 3f 22 30 22 3a 63 2e 62 67 5f 73 6e 61 70 73 68 6f 74 5f 64 65 6c 61 79 5f 6d 73 3b 67 3d 76 6f 69 64 20 30 3d 3d 3d 63 2e 69 73 5f 67 65 6e 5f 32 30 34 3f 22 31 22 3a 63 2e 69 73 5f 67 Data Ascii: (ob(b),4);case 4:c=h.m;h.g=3;h.l=0;break;case 2:pb(h);case 3:if(!c)return h.return(void 0);d=a.Dd\|\|c.sodar_query_id;e=void 0!==c.rc_enable&&a.l?c.rc_enable:"n";f=void 0===c.bg_snapshot_delay_ms?"0":c.bg_snapshot_delay_ms;g=void 0===c.is_gen_204?"1":c.is_g
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 3b 65 6c 73 65 7b 69 66 28 35 35 32 39 36 3c 3d 66 26 26 35 37 33 34 33 3e 3d 66 29 7b 69 66 28 35 36 33 31 39 3e 3d 66 26 26 65 3c 61 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 67 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 65 29 3b 69 66 28 35 36 33 32 30 3c 3d 67 26 26 35 37 33 34 33 3e 3d 67 29 7b 66 3d 31 30 32 34 2a 28 66 2d 35 35 32 39 36 29 2b 67 2d 35 36 33 32 30 2b 36 35 35 33 36 3b 64 5b 63 2b 2b 5d 3d 66 3e 3e 31 38 7c 32 34 30 3b 64 5b 63 2b 2b 5d 3d 66 3e 3e 31 32 26 36 33 7c 31 32 38 3b 64 5b 63 2b 2b 5d 3d 66 3e 3e 36 26 36 33 7c 31 32 38 3b 64 5b 63 2b 2b 5d 3d 66 26 36 33 7c 31 32 38 3b 63 6f 6e 74 69 6e 75 65 7d 65 6c 73 65 20 65 2d 2d 7d 69 66 28 62 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 46 6f 75 6e 64 20 61 6e 20 75 6e 70 61 69 72 Data Ascii: ;else{if(55296<=f&&57343>=f){if(56319>=f&&e<a.length){var g=a.charCodeAt(++e);if(56320<=g&&57343>=g){f=1024*(f-55296)+g-56320+65536;d[c++]=f>>18\|240;d[c++]=f>>12&63\|128;d[c++]=f>>6&63\|128;d[c++]=f&63\|128;continue}else e--}if(b)throw Error("Found an unpair
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 63 26 26 28 62 2b 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 63 2f 31 45 37 29 2c 63 25 3d 31 45 37 29 2c 63 3d 62 2b 52 62 28 63 29 2b 52 62 28 61 29 29 3b 72 65 74 75 72 6e 20 63 7d 3b 52 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 53 74 72 69 6e 67 28 61 29 3b 72 65 74 75 72 6e 22 30 30 30 30 30 30 30 22 2e 73 6c 69 63 65 28 61 2e 6c 65 6e 67 74 68 29 2b 61 7d 3b 55 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 4e 62 2c 62 3d 4f 62 3b 62 26 32 31 34 37 34 38 33 36 34 38 3f 4c 62 28 29 3f 61 3d 22 22 2b 28 42 69 67 49 6e 74 28 62 7c 30 29 3c 3c 42 69 67 49 6e 74 28 33 32 29 7c 42 69 67 49 6e 74 28 61 3e 3e 3e 30 29 29 3a 28 62 3d 5f 2e 7a 28 4d 62 28 61 2c 62 29 29 2c 61 3d 62 2e 6e 65 78 74 28 29 2e 76 61 6c 75 65 2c 62 3d 62 2e 6e 65 78 74 28 Data Ascii: c&&(b+=Math.floor(c/1E7),c%=1E7),c=b+Rb(c)+Rb(a));return c};Rb=function(a){a=String(a);return"0000000".slice(a.length)+a};Ub=function(){var a=Nb,b=Ob;b&2147483648?Lb()?a=""+(BigInt(b\|0)<<BigInt(32)\|BigInt(a>>>0)):(b=_.z(Mb(a,b)),a=b.next().value,b=b.next(
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 3e 31 34 26 31 30 32 33 3b 72 65 74 75 72 6e 20 30 3d 3d 3d 61 3f 35 33 36 38 37 30 39 31 32 3a 61 7d 3b 6f 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 21 28 21 61 7c 7c 22 6f 62 6a 65 63 74 22 21 3d 3d 74 79 70 65 6f 66 20 61 7c 7c 61 2e 58 6b 21 3d 3d 6c 63 29 7d 3b 70 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 61 26 26 22 6f 62 6a 65 63 74 22 3d 3d 3d 74 79 70 65 6f 66 20 61 26 26 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 26 26 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 4f 62 6a 65 63 74 7d 3b 73 63 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 6e 75 6c 6c 21 3d 61 29 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 61 29 61 3d 61 3f 6e 65 77 20 71 63 28 Data Ascii: >14&1023;return 0===a?536870912:a};oc=function(a){return!(!a\|\|"object"!==typeof a\|\|a.Xk!==lc)};pc=function(a){return null!==a&&"object"===typeof a&&!Array.isArray(a)&&a.constructor===Object};sc=function(a,b,c){if(null!=a)if("string"===typeof a)a=a?new qc(
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 72 72 6f 72 28 22 45 78 70 65 63 74 65 64 20 62 6f 6f 6c 65 61 6e 20 62 75 74 20 67 6f 74 20 22 2b 48 63 28 61 29 2b 22 3a 20 22 2b 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 4b 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 6e 75 6c 6c 3d 3d 61 7c 7c 22 62 6f 6f 6c 65 61 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 61 29 72 65 74 75 72 6e 20 61 3b 69 66 28 22 6e 75 6d 62 65 72 22 3d 3d 3d 74 79 70 65 6f 66 20 61 29 72 65 74 75 72 6e 21 21 61 7d 3b 4d 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 74 79 70 65 6f 66 20 61 3b 72 65 74 75 72 6e 22 6e 75 6d 62 65 72 22 3d 3d 3d 62 3f 5f 2e 41 28 4e 75 6d 62 65 72 2c 22 69 73 46 69 6e 69 74 65 22 29 2e 63 61 6c 6c 28 4e 75 6d 62 65 72 2c 61 29 3a 22 73 74 72 69 6e 67 22 21 3d 3d 62 3f 21 31 3a 4c 63 2e 74 Data Ascii: rror("Expected boolean but got "+Hc(a)+": "+a);return a};Kc=function(a){if(null==a\|\|"boolean"===typeof a)return a;if("number"===typeof a)return!!a};Mc=function(a){var b=typeof a;return"number"===b?_.A(Number,"isFinite").call(Number,a):"string"!==b?!1:Lc.t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.16	49834	104.22.74.216	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	573	OUT	GET /tag?o=5633429348548608&domain=softonic.com&upapi=true HTTP/1.1 Host: btloader.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:21 UTC	447	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:21 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300 Etag: W/"41b114329bc09b26e53c634771e77de3" Last-Modified: Tue, 19 Dec 2023 09:01:51 GMT Vary: Origin Via: 1.1 google CF-Cache-Status: HIT Age: 1030 Server: cloudflare CF-RAY: 837e94a3cb2d032d-MIA
2023-12-19 09:22:21 UTC	922	IN	Data Raw: 37 64 65 32 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 73 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 73 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 26 26 28 65 5b 72 5d 3d 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 65 7d 2c 65 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 74 28 65 Data Ascii: 7de2!function(){"use strict";var e=function(){return e=Object.assign\|\|function(e){for(var t,n=1,s=arguments.length;n<s;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},e.apply(this,arguments)};function t(e
2023-12-19 09:22:21 UTC	1369	IN	Data Raw: 6f 77 7c 7c 28 28 72 3d 73 2e 72 65 74 75 72 6e 29 26 26 72 2e 63 61 6c 6c 28 73 29 2c 30 29 3a 73 2e 6e 65 78 74 29 26 26 21 28 72 3d 72 2e 63 61 6c 6c 28 73 2c 69 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 72 3b 73 77 69 74 63 68 28 73 3d 30 2c 72 26 26 28 69 3d 5b 32 26 69 5b 30 5d 2c 72 2e 76 61 6c 75 65 5d 29 2c 69 5b 30 5d 29 7b 63 61 73 65 20 30 3a 63 61 73 65 20 31 3a 72 3d 69 3b 62 72 65 61 6b 3b 63 61 73 65 20 34 3a 72 65 74 75 72 6e 20 6f 2e 6c 61 62 65 6c 2b 2b 2c 7b 76 61 6c 75 65 3a 69 5b 31 5d 2c 64 6f 6e 65 3a 21 31 7d 3b 63 61 73 65 20 35 3a 6f 2e 6c 61 62 65 6c 2b 2b 2c 73 3d 69 5b 31 5d 2c 69 3d 5b 30 5d 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 20 37 3a 69 3d 6f 2e 6f 70 73 2e 70 6f 70 28 29 2c 6f 2e 74 72 79 73 2e 70 6f 70 Data Ascii: ow\|\|((r=s.return)&&r.call(s),0):s.next)&&!(r=r.call(s,i[1])).done)return r;switch(s=0,r&&(i=[2&i[0],r.value]),i[0]){case 0:case 1:r=i;break;case 4:return o.label++,{value:i[1],done:!1};case 5:o.label++,s=i[1],i=[0];continue;case 7:i=o.ops.pop(),o.trys.pop
2023-12-19 09:22:21 UTC	1369	IN	Data Raw: 76 6f 69 64 20 30 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 69 2c 61 2c 63 3b 72 65 74 75 72 6e 20 6e 28 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 73 77 69 74 63 68 28 6e 2e 6c 61 62 65 6c 29 7b 63 61 73 65 20 30 3a 72 65 74 75 72 6e 20 6e 2e 74 72 79 73 2e 70 75 73 68 28 5b 30 2c 33 2c 2c 34 5d 29 2c 77 69 6e 64 6f 77 2e 5f 5f 62 74 3d 77 69 6e 64 6f 77 2e 5f 5f 62 74 7c 7c 7b 7d 2c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 5f 5f 62 74 2e 63 75 73 74 6f 6d 44 65 74 65 63 74 41 64 42 6c 6f 63 6b 3f 5b 33 2c 32 5d 3a 5b 34 2c 77 69 6e 64 6f 77 2e 5f 5f 62 74 2e 63 75 73 74 6f 6d 44 65 74 65 63 74 41 64 42 6c 6f 63 6b 28 29 5d 3b 63 61 73 65 20 31 3a 72 65 74 75 72 6e 5b 32 2c 6e 2e 73 65 Data Ascii: void 0,(function(){var e,t,i,a,c;return n(this,(function(n){switch(n.label){case 0:return n.trys.push([0,3,,4]),window.__bt=window.__bt\|\|{},"function"!=typeof window.__bt.customDetectAdBlock?[3,2]:[4,window.__bt.customDetectAdBlock()];case 1:return[2,n.se
2023-12-19 09:22:21 UTC	1369	IN	Data Raw: 29 29 7d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 28 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 7c 7c 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 29 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 7d 76 61 72 20 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 77 69 6e 64 6f 77 3b 74 72 79 7b 69 66 28 74 6f 70 2e 64 6f 63 75 6d 65 6e 74 29 72 65 74 75 72 6e 20 74 6f 70 7d 63 61 74 63 68 28 65 29 7b 7d 74 72 79 7b 66 6f 72 28 3b 65 2e 70 61 72 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 3b 29 65 3d 65 2e 70 61 72 65 6e 74 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 20 65 7d 28 29 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 22 22 21 3d 3d Data Ascii: ))}))}function l(e){(window.document.body\|\|window.document.documentElement).removeChild(e)}var u=function(){var e=window;try{if(top.document)return top}catch(e){}try{for(;e.parent.document;)e=e.parent}catch(e){}return e}();var d=function(){try{return""!==
2023-12-19 09:22:21 UTC	1369	IN	Data Raw: 6f 72 3b 66 6f 72 28 76 61 72 20 73 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 28 6e 2b 31 2d 74 29 29 2b 74 2c 72 3d 22 22 2c 69 3d 30 3b 69 3c 73 3b 69 2b 2b 29 72 2b 3d 65 2e 63 68 61 72 41 74 28 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 65 2e 6c 65 6e 67 74 68 29 29 3b 72 65 74 75 72 6e 20 72 7d 28 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 22 2c 65 2c 74 29 7d 79 3d 22 35 36 33 33 34 32 39 33 34 38 35 34 38 36 30 38 22 2c 49 3d 22 62 74 6c 6f 61 64 65 72 2e 63 6f 6d 22 2c 5f 3d 22 61 70 69 2e 62 74 6c 6f 61 64 65 72 2e 63 6f 6d 22 2c 45 3d Data Ascii: or;for(var s=Math.floor(Math.random()(n+1-t))+t,r="",i=0;i<s;i++)r+=e.charAt(Math.floor(Math.random()e.length));return r}("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",e,t)}y="5633429348548608",I="btloader.com",_="api.btloader.com",E=
2023-12-19 09:22:21 UTC	1369	IN	Data Raw: 6f 67 28 22 45 72 72 6f 72 20 69 6e 20 63 75 73 74 6f 6d 44 65 74 65 63 74 44 6f 6d 61 69 6e 3a 22 2c 65 29 7d 7d 28 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3d 70 2e 68 6f 73 74 6e 61 6d 65 3b 74 72 79 7b 69 66 28 22 64 69 73 71 75 73 73 65 72 76 69 63 65 2e 63 6f 6d 22 3d 3d 3d 74 29 7b 76 61 72 20 6e 3d 75 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 74 3d 28 6e 75 6c 6c 21 3d 28 65 3d 68 28 22 73 6f 75 72 63 65 55 72 6c 22 2c 6e 29 2e 6d 61 74 63 68 28 2f 3a 5c 2f 5c 2f 28 77 77 77 5b 30 2d 39 5d 3f 5c 2e 29 3f 28 2e 5b 5e 2f 3a 5d 2b 29 2f 69 29 29 26 26 65 2e 6c 65 6e 67 74 68 3e 32 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 5b 32 5d 26 26 65 5b 32 5d 2e 6c 65 6e 67 74 68 3e 30 3f 65 5b 32 5d 3a 6e 75 6c 6c 29 Data Ascii: og("Error in customDetectDomain:",e)}}()\|\|function(){var e,t=p.hostname;try{if("disqusservice.com"===t){var n=u.location.href;t=(null!=(e=h("sourceUrl",n).match(/:\/\/(www[0-9]?\.)?(.[^/:]+)/i))&&e.length>2&&"string"==typeof e[2]&&e[2].length>0?e[2]:null)
2023-12-19 09:22:21 UTC	1369	IN	Data Raw: 3d 3d 28 63 3d 53 2e 63 65 29 26 26 76 6f 69 64 20 30 21 3d 3d 63 3f 63 3a 53 2e 63 6f 6e 74 65 6e 74 5f 65 6e 61 62 6c 65 64 2c 74 2e 6d 6f 62 69 6c 65 43 6f 6e 74 65 6e 74 45 6e 61 62 6c 65 64 3d 6e 75 6c 6c 21 3d 3d 28 6c 3d 53 2e 6d 65 29 26 26 76 6f 69 64 20 30 21 3d 3d 6c 3f 6c 3a 53 2e 6d 6f 62 69 6c 65 5f 63 6f 6e 74 65 6e 74 5f 65 6e 61 62 6c 65 64 2c 74 2e 77 69 64 67 65 74 3d 6e 75 6c 6c 21 3d 3d 28 64 3d 53 2e 77 69 64 67 65 74 29 26 26 76 6f 69 64 20 30 21 3d 3d 64 26 26 64 29 3b 69 66 28 6d 29 72 65 74 75 72 6e 5b 32 2c 7b 73 69 74 65 49 6e 66 6f 3a 74 7d 5d 3b 69 66 28 62 28 31 29 29 7b 69 66 28 43 3d 7b 64 6f 6d 61 69 6e 3a 67 2c 6f 72 67 49 44 3a 70 61 72 73 65 49 6e 74 28 79 29 7d 2c 41 3d 76 6f 69 64 20 30 2c 77 69 6e 64 6f 77 2e 54 65 Data Ascii: ==(c=S.ce)&&void 0!==c?c:S.content_enabled,t.mobileContentEnabled=null!==(l=S.me)&&void 0!==l?l:S.mobile_content_enabled,t.widget=null!==(d=S.widget)&&void 0!==d&&d);if(m)return[2,{siteInfo:t}];if(b(1)){if(C={domain:g,orgID:parseInt(y)},A=void 0,window.Te
2023-12-19 09:22:21 UTC	1369	IN	Data Raw: 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2d 5f 22 3b 73 74 61 74 69 63 20 52 45 56 45 52 53 45 5f 44 49 43 54 3d 6e 65 77 20 4d 61 70 28 5b 5b 22 41 22 2c 30 5d 2c 5b 22 42 22 2c 31 5d 2c 5b 22 43 22 2c 32 5d 2c 5b 22 44 22 2c 33 5d 2c 5b 22 45 22 2c 34 5d 2c 5b 22 46 22 2c 35 5d 2c 5b 22 47 22 2c 36 5d 2c 5b 22 48 22 2c 37 5d 2c 5b 22 49 22 2c 38 5d 2c 5b 22 4a 22 2c 39 5d 2c 5b 22 4b 22 2c 31 30 5d 2c 5b 22 4c 22 2c 31 31 5d 2c 5b 22 4d 22 2c 31 32 5d 2c 5b 22 4e 22 2c 31 33 5d 2c 5b 22 4f 22 2c 31 34 5d 2c 5b 22 50 22 2c 31 35 5d 2c 5b 22 51 22 2c 31 36 5d 2c 5b 22 52 22 2c 31 37 5d 2c 5b 22 53 22 2c 31 38 5d 2c 5b 22 54 22 2c 31 39 5d 2c 5b 22 55 22 2c 32 30 5d Data Ascii: STUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";static REVERSE_DICT=new Map([["A",0],["B",1],["C",2],["D",3],["E",4],["F",5],["G",6],["H",7],["I",8],["J",9],["K",10],["L",11],["M",12],["N",13],["O",14],["P",15],["Q",16],["R",17],["S",18],["T",19],["U",20]
2023-12-19 09:22:21 UTC	1369	IN	Data Raw: 6c 21 3d 3d 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 3d 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 63 6c 6f 6e 65 29 72 65 74 75 72 6e 20 65 2e 63 6c 6f 6e 65 28 29 3b 69 66 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 44 61 74 65 29 72 65 74 75 72 6e 20 6e 65 77 20 44 61 74 65 28 65 2e 67 65 74 54 69 6d 65 28 29 29 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 7b 63 6f 6e 73 74 20 74 3d 5b 5d 3b 66 6f 72 28 63 6f 6e 73 74 20 6e 20 6f 66 20 65 29 74 2e 70 75 73 68 28 74 68 69 73 2e 64 65 65 70 43 6c 6f 6e 65 28 6e 29 29 3b 72 65 74 75 72 6e 20 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 74 3a 6e 65 77 20 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 74 29 7d 7b 63 Data Ascii: l!==e&&"object"===t){if("function"==typeof e.clone)return e.clone();if(e instanceof Date)return new Date(e.getTime());if(void 0!==e[Symbol.iterator]){const t=[];for(const n of e)t.push(this.deepClone(n));return e instanceof Array?t:new e.constructor(t)}{c
2023-12-19 09:22:21 UTC	1369	IN	Data Raw: 76 61 6c 75 65 29 6e 3d 74 2c 74 3d 74 2e 6c 65 66 74 2c 73 3d 22 6c 65 66 74 22 3b 65 6c 73 65 20 69 66 28 65 3e 74 2e 76 61 6c 75 65 29 6e 3d 74 2c 74 3d 74 2e 72 69 67 68 74 2c 73 3d 22 72 69 67 68 74 22 3b 65 6c 73 65 7b 69 66 28 74 2e 6c 65 66 74 7c 7c 74 2e 72 69 67 68 74 29 69 66 28 74 2e 6c 65 66 74 29 69 66 28 74 2e 72 69 67 68 74 29 7b 63 6f 6e 73 74 20 65 3d 74 68 69 73 2e 6d 69 6e 28 74 2e 72 69 67 68 74 29 3b 74 68 69 73 2e 72 65 6d 6f 76 65 28 65 2c 74 2e 72 69 67 68 74 29 2c 74 2e 76 61 6c 75 65 3d 65 7d 65 6c 73 65 20 6e 3f 6e 5b 73 5d 3d 74 2e 6c 65 66 74 3a 74 68 69 73 2e 72 6f 6f 74 3d 74 2e 6c 65 66 74 3b 65 6c 73 65 20 6e 3f 6e 5b 73 5d 3d 74 2e 72 69 67 68 74 3a 74 68 69 73 2e 72 6f 6f 74 3d 74 2e 72 69 67 68 74 3b 65 6c 73 65 20 6e Data Ascii: value)n=t,t=t.left,s="left";else if(e>t.value)n=t,t=t.right,s="right";else{if(t.left\|\|t.right)if(t.left)if(t.right){const e=this.min(t.right);this.remove(e,t.right),t.value=e}else n?n[s]=t.left:this.root=t.left;else n?n[s]=t.right:this.root=t.right;else n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.16	49837	104.18.36.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	365	OUT	GET /openrtb/pbjs?s=805152 HTTP/1.1 Host: htlb.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:21 UTC	616	IN	HTTP/1.1 204 No Content Date: Tue, 19 Dec 2023 09:22:21 GMT Content-Type: application/json Connection: close CF-Ray: 837e94a438ab67c3-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Pragma: no-cache Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vvStSiEky13y%2F6v8eIGKE%2F5BCxiK%2FxHP681dcJplek2oIqiTfeCsNzApcc%2BJ6zWk%2FrSKapTJyJZ41deSFNs0HyTXsS3hFRS9uzcLAelr20ZhGmgZyNyIdQNqadnO45y3%2BcjW%2F%2BNR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.16	49836	142.250.217.164	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	1823	OUT	GET /sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fpsid%3D3261714721%26iab_gdprApplies%3Dfalse%26client%3Dsoftonic%26r%3Dm%26hl%3Dpt%26cpp%3D5%26rpbu%3Dhttps%253A%252F%252Fwww.softonic.com.br%252Fs%252F%253Frscp%253Ddsk_rscp_pt_pp%2526platformId%253Dwindows%26rpqp%3Dq%26type%3D3%26rs_tt%3Dc%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301383%26format%3Dr4%26nocache%3D9311702977738466%26num%3D0%26output%3Dafd_ads%26domain_name%3Dcaffeine.softonic.com.br%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D60%26dt%3D1702977738467%26u_w%3D1280%26u_h%3D1024%26biw%3D1263%26bih%3D907%26psw%3D1263%26psh%3D6480%26frm%3D0%26cl%3D588056317%26uio%3Dwi290-%26cont%3Drscontainer%26drt%3D0%26jsid%3Dcsa%26nfp%3D1%26jsv%3D588056317%26rurl%3Dhttps%253A%252F%252Fcaffeine.softonic.com.br%252F&hl=pt&q=EgRmgZjUGMzBhawGIjDYmH_Xf2aM1xdZKz8ZZRlQk2kz51DAs7QUplT8tENUOdH_uo1e7PI4UepJ3ir3LS4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:21 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Tue, 19 Dec 2023 09:22:21 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 5279 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:21 UTC	896	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 64 73 65 6e 73 65 63 75 73 74 6f 6d 73 65 61 72 63 68 61 64 73 2e 63 6f 6d 2f 61 66 73 2f 61 64 73 3f 70 73 69 64 3d 33 32 36 31 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.adsensecustomsearchads.com/afs/ads?psid=3261
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 3d 35 38 38 30 35 36 33 31 37 26 61 6d 70 3b 72 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 25 32 46 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 70 61 64 64 69 6e 67 3a 32 30 70 78 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 3b 20 6f 76 65 72 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 3a 63 6f 6e 74 61 69 6e 3b 22 20 6f 6e 6c 6f 61 64 3d 22 65 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 Data Ascii: =588056317&rurl=https%3A%2F%2Fcaffeine.softonic.com.br%2F</title></head><body style="font-family: arial, sans-serif; background-color: #fff; color: #000; padding:20px; font-size:18px; overscroll-behavior:contain;" onload="e=document.getElementById('c
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 69 64 64 65 6e 27 20 6e 61 6d 65 3d 27 71 27 20 76 61 6c 75 65 3d 27 45 67 52 6d 67 5a 6a 55 47 4d 7a 42 68 61 77 47 49 6a 44 59 6d 48 5f 58 66 32 61 4d 31 78 64 5a 4b 7a 38 5a 5a 52 6c 51 6b 32 6b 7a 35 31 44 41 73 37 51 55 70 6c 54 38 74 45 4e 55 4f 64 48 5f 75 6f 31 65 37 50 49 34 55 65 70 4a 33 69 72 33 4c 53 34 79 41 58 4a 4b 47 56 4e 50 55 6c 4a 5a 58 30 46 43 56 56 4e 4a 56 6b 56 66 54 6b 56 55 58 30 31 46 55 31 4e 42 52 30 56 61 41 55 4d 27 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 63 6f 6e 74 69 6e 75 65 22 20 76 61 6c 75 65 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 64 73 65 6e 73 65 63 75 73 74 6f 6d 73 65 61 72 63 68 61 64 73 2e 63 6f 6d 2f 61 66 73 2f 61 64 73 3f 70 73 69 64 3d 33 32 36 31 37 31 34 Data Ascii: idden' name='q' value='EgRmgZjUGMzBhawGIjDYmH_Xf2aM1xdZKz8ZZRlQk2kz51DAs7QUplT8tENUOdH_uo1e7PI4UepJ3ir3LS4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM'><input type="hidden" name="continue" value="https://www.adsensecustomsearchads.com/afs/ads?psid=3261714
2023-12-19 09:22:21 UTC	1252	IN	Data Raw: 20 61 73 20 73 6f 6c 69 63 69 74 61 c3 a7 c3 b5 65 73 20 65 20 6e c3 a3 6f 20 75 6d 20 72 6f 62 c3 b4 20 76 69 6e 64 6f 20 64 65 73 74 61 20 72 65 64 65 2e 20 3c 62 72 3e 3c 62 72 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 66 6f 44 69 76 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 20 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 20 6d 61 72 67 69 6e 3a 30 20 30 20 31 35 70 78 20 30 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 Data Ascii: as solicitaes e no um rob vindo desta rede. <br><br><div id="infoDiv" style="display:none; background-color:#eee; padding:10px; margin:0 0 15px 0; line-height:1.4em;">This page appears when Google automatically detects requests coming from your
2023-12-19 09:22:21 UTC	627	IN	Data Raw: 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 25 32 46 73 25 32 46 25 33 46 72 73 63 70 25 33 44 64 73 6b 5f 72 73 63 70 5f 70 74 5f 70 70 25 32 36 70 6c 61 74 66 6f 72 6d 49 64 25 33 44 77 69 6e 64 6f 77 73 26 61 6d 70 3b 72 70 71 70 3d 71 26 61 6d 70 3b 74 79 70 65 3d 33 26 61 6d 70 3b 72 73 5f 74 74 3d 63 26 61 6d 70 3b 6f 65 3d 55 54 46 2d 38 26 61 6d 70 3b 69 65 3d 55 54 46 2d 38 26 61 6d 70 3b 66 65 78 70 3d 32 31 34 30 34 25 32 43 31 37 33 30 30 30 30 32 25 32 43 31 37 33 30 31 33 38 33 26 61 6d 70 3b 66 6f 72 6d 61 74 3d 72 34 26 61 6d 70 3b 6e 6f 63 61 63 68 65 3d 39 33 31 31 37 30 32 39 37 37 37 33 38 34 36 36 26 61 6d 70 3b 6e 75 6d 3d 30 26 61 6d 70 3b 6f 75 74 70 75 74 3d 61 66 64 5f 61 64 73 26 61 6d 70 3b 64 6f 6d 61 69 6e 5f 6e 61 6d 65 3d 63 61 Data Ascii: ftonic.com.br%2Fs%2F%3Frscp%3Ddsk_rscp_pt_pp%26platformId%3Dwindows&rpqp=q&type=3&rs_tt=c&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301383&format=r4&nocache=9311702977738466&num=0&output=afd_ads&domain_name=ca

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.16	49835	162.19.138.119	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	597	OUT	GET /lb/v1 HTTP/1.1 Host: lb.eu-1-id5-sync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:21 UTC	386	IN	HTTP/1.1 200 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers access-control-allow-origin: https://caffeine.softonic.com.br vary: Origin content-type: application/json;charset=UTF-8 transfer-encoding: chunked date: Tue, 19 Dec 2023 09:22:20 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2023-12-19 09:22:21 UTC	39	IN	Data Raw: 32 31 0d 0a 7b 22 6c 62 22 3a 22 2b 65 76 44 70 76 37 58 75 4e 54 64 69 41 4d 4e 4f 73 36 69 62 51 3d 3d 22 7d 0d 0a Data Ascii: 21{"lb":"+evDpv7XuNTdiAMNOs6ibQ=="}
2023-12-19 09:22:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.16	49840	65.8.27.208	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	632	OUT	GET /cdn/prod/config?src=3177&u=https%3A%2F%2Fcaffeine.softonic.com.br HTTP/1.1 Host: c.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:22 UTC	504	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Content-Length: 1246 Connection: close Access-Control-Allow-Origin: https://caffeine.softonic.com.br Access-Control-Allow-Credentials: true Cache-Control: max-age=21550, s-maxage=21600 Date: Tue, 19 Dec 2023 09:22:21 GMT Server: Server X-Cache: Miss from cloudfront Via: 1.1 24b9ed9aa2f44f71ea012f05fe255326.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C5 X-Amz-Cf-Id: dV4bVUqQmZLMqvS_mRR6w0Cei3tbzl0veiqstNgT5qTrAzpU4t0QSQ==
2023-12-19 09:22:22 UTC	1246	IN	Data Raw: 7b 22 33 70 76 65 6e 64 6f 72 22 3a 22 76 61 72 20 6c 65 78 69 63 6f 6e 50 72 6f 70 65 72 74 79 49 64 20 3d 20 27 30 30 31 33 33 30 30 30 30 31 6b 51 6a 31 61 41 41 43 27 3b 5c 6e 69 66 20 28 6c 65 78 69 63 6f 6e 50 72 6f 70 65 72 74 79 49 64 20 26 26 20 6c 65 78 69 63 6f 6e 50 72 6f 70 65 72 74 79 49 64 2e 63 68 61 72 41 74 28 30 29 20 21 3d 3d 20 27 25 27 29 20 7b 5c 6e 20 20 69 66 20 28 21 77 69 6e 64 6f 77 2e 5f 33 33 41 63 72 6f 73 73 49 64 4d 61 70 70 69 6e 67 73 50 72 6f 76 69 64 65 72 29 20 7b 5c 6e 20 20 20 20 63 72 65 61 74 65 6c 65 78 69 63 6f 6e 53 63 72 69 70 74 28 6c 65 78 69 63 6f 6e 50 72 6f 70 65 72 74 79 49 64 29 3b 5c 6e 20 20 7d 5c 6e 7d 5c 6e 5c 6e 66 75 6e 63 74 69 6f 6e 20 63 72 65 61 74 65 6c 65 78 69 63 6f 6e 53 63 72 69 70 74 28 Data Ascii: {"3pvendor":"var lexiconPropertyId = '0013300001kQj1aAAC';\nif (lexiconPropertyId && lexiconPropertyId.charAt(0) !== '%') {\n if (!window._33AcrossIdMappingsProvider) {\n createlexiconScript(lexiconPropertyId);\n }\n}\n\nfunction createlexiconScript(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.16	49841	65.8.27.208	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	594	OUT	GET /bao-csm/aps-comm/aps_csm.js HTTP/1.1 Host: c.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:22 UTC	714	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 6482 Connection: close Date: Tue, 19 Dec 2023 09:22:23 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 3000 Last-Modified: Tue, 29 Aug 2023 08:30:37 GMT ETag: "a4d296427fc806b21335359e398c025c" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=86400 x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding,Origin X-Cache: Miss from cloudfront Via: 1.1 d5385d9a6bccb3289338c8f9df4440ac.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C5 X-Amz-Cf-Id: vcdCCFblCLOax0i0K376kgPmdyyzD7t37jUe_TKPNThBb829lBqHFA==
2023-12-19 09:22:22 UTC	6482	IN	Data Raw: 76 61 72 20 61 6d 7a 6e 5f 61 70 73 5f 63 73 6d 3d 61 6d 7a 6e 5f 61 70 73 5f 63 73 6d 7c 7c 7b 7d 3b 61 6d 7a 6e 5f 61 70 73 5f 63 73 6d 2e 65 72 72 6f 72 73 3d 5b 5d 2c 61 6d 7a 6e 5f 61 70 73 5f 63 73 6d 2e 72 65 70 6f 72 74 45 72 72 6f 72 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 3b 66 6f 72 28 2f 5e 68 74 74 70 73 3f 3a 5c 2f 5c 2f 2f 2e 74 65 73 74 28 61 29 3d 3d 3d 21 31 26 26 28 61 3d 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2b 22 2f 2f 22 2b 61 29 2c 22 2f 22 21 3d 3d 61 2e 73 75 62 73 74 72 28 61 2e 6c 65 6e 67 74 68 2d 31 29 26 26 28 61 2b 3d 22 2f 22 29 2c 62 3d 30 3b 62 3c 61 6d 7a 6e 5f 61 70 73 5f 63 73 6d 2e 65 72 72 6f 72 73 2e 6c 65 6e 67 74 68 3b 62 2b 2b 29 63 3d 27 7b 22 61 64 Data Ascii: var amzn_aps_csm=amzn_aps_csm\|\|{};amzn_aps_csm.errors=[],amzn_aps_csm.reportErrors=function(a){var b,c;for(/^https?:\/\//.test(a)===!1&&(a=document.location.protocol+"//"+a),"/"!==a.substr(a.length-1)&&(a+="/"),b=0;b<amzn_aps_csm.errors.length;b++)c='{"ad

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.16	49839	173.194.219.154	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	966	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-20035800-1&cid=430166992.1702977739&jid=183335909&gjid=7637531&_gid=759421984.1702977740&_u=YCDAgEABAAQCAGAAI~&z=1378827441 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://caffeine.softonic.com.br X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:22 UTC	602	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://caffeine.softonic.com.br Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Tue, 19 Dec 2023 09:22:22 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:22 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.16	49843	99.84.242.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:21 UTC	1723	OUT	GET /e/dtb/bid?src=3177&u=https%3A%2F%2Fcaffeine.softonic.com.br%2F&pid=sN2DceDyaHhkI&cb=0&ws=1280x907&v=23.1211.1645&t=1000&slots=%5B%7B%22sd%22%3A%22top-mpu-1__ad%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%2C%22300x180%22%2C%22300x150%22%2C%22250x250%22%2C%22200x200%22%2C%22180x150%22%2C%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fdesktop-Web-pt%2FApps%2FProgrampage%2FATF_MPU_First%22%7D%2C%7B%22sd%22%3A%22top-leaderboard-1__ad%22%2C%22s%22%3A%5B%221x1%22%2C%22970x250%22%2C%22970x90%22%2C%22960x90%22%2C%22950x90%22%2C%22728x90%22%2C%22500x90%22%2C%22468x90%22%2C%22468x60%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fdesktop-Web-pt%2FApps%2FProgrampage%2FATF_Leaderboard_First%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22Windows%22%7D%2C%22browsers%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%5B%22117%22%5D%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%5B%228%22%5D%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%5B%22117%22%5D%7D%5D%7D%7D%7D&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D HTTP/1.1 Host: aax.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:22 UTC	620	IN	HTTP/1.1 200 OK Content-Type: text/javascript;charset=UTF-8 Content-Length: 159 Connection: close Server: Server Date: Tue, 19 Dec 2023 09:22:22 GMT x-amz-rid: N8709MCYM8YCPB561K4R Access-Control-Allow-Origin: https://caffeine.softonic.com.br Access-Control-Allow-Credentials: true Timing-Allow-Origin: * Strict-Transport-Security: max-age=47474747; includeSubDomains; preload Vary: Accept-Encoding,User-Agent X-Cache: Miss from cloudfront Via: 1.1 6501a9c20d6e55c2a7db43858f47dc56.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P6 X-Amz-Cf-Id: niZVQ0scCdIKDkP2LeGo1TH4Pb41hpmec2ozL9UZd0o9xACuQqaUbw==
2023-12-19 09:22:22 UTC	159	IN	Data Raw: 61 70 73 74 61 67 2e 70 75 6e 74 28 7b 22 63 6d 70 22 3a 22 68 74 74 70 73 3a 2f 2f 73 2e 61 6d 61 7a 6f 6e 2d 61 64 73 79 73 74 65 6d 2e 63 6f 6d 2f 69 75 33 3f 63 6d 33 70 70 64 3d 31 26 64 3d 64 74 62 2d 70 75 62 26 63 73 69 66 3d 74 26 67 64 70 72 3d 30 26 64 6c 3d 67 67 5f 6e 2d 69 6e 64 65 78 5f 6e 2d 6f 6e 65 74 61 67 5f 70 6d 2d 64 62 35 5f 72 62 64 5f 72 78 5f 6f 78 2d 64 62 35 5f 73 6d 72 74 5f 73 6f 76 72 6e 5f 33 6c 69 66 74 22 2c 22 63 62 22 3a 22 30 22 7d 29 Data Ascii: apstag.punt({"cmp":"https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-onetag_pm-db5_rbd_rx_ox-db5_smrt_sovrn_3lift","cb":"0"})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.16	49844	142.250.217.164	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:22 UTC	1760	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fpsid%3D3261714721%26iab_gdprApplies%3Dfalse%26client%3Dsoftonic%26r%3Dm%26hl%3Dpt%26cpp%3D5%26rpbu%3Dhttps%253A%252F%252Fwww.softonic.com.br%252Fs%252F%253Frscp%253Ddsk_rscp_pt_pp%2526platformId%253Dwindows%26rpqp%3Dq%26type%3D3%26rs_tt%3Dc%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301383%26format%3Dr4%26nocache%3D9311702977738466%26num%3D0%26output%3Dafd_ads%26domain_name%3Dcaffeine.softonic.com.br%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D60%26dt%3D1702977738467%26u_w%3D1280%26u_h%3D1024%26biw%3D1263%26bih%3D907%26psw%3D1263%26psh%3D6480%26frm%3D0%26cl%3D588056317%26uio%3Dwi290-%26cont%3Drscontainer%26drt%3D0%26jsid%3Dcsa%26nfp%3D1%26jsv%3D588056317%26rurl%3Dhttps%253A%252F%252Fcaffeine.softonic.com.br%252F&hl=pt&q=EgRmgZjUGMzBhawGIjDYmH_Xf2aM1xdZKz8ZZRlQk2kz51DAs7QUplT8tENUOdH_uo1e7PI4UepJ3ir3LS4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:22 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Tue, 19 Dec 2023 09:22:22 GMT Date: Tue, 19 Dec 2023 09:22:22 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:22 UTC	724	IN	Data Raw: 34 63 36 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 4c6/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2023-12-19 09:22:22 UTC	505	IN	Data Raw: 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 75 2d 78 63 71 33 50 4f 43 57 46 6c 43 72 33 78 38 5f 49 50 78 67 50 75 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 3b 70 6f 2e 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 43 44 6b 6f 66 71 4d 6f 36 68 53 41 50 52 Data Ascii: mV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-CDkofqMo6hSAPR
2023-12-19 09:22:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.16	49846	130.211.23.194	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:22 UTC	582	OUT	GET /mw/state?bt_env=prod HTTP/1.1 Host: api.btloader.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:22 UTC	203	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Vary: Origin Date: Tue, 19 Dec 2023 09:22:22 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.16	49847	162.19.138.116	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:22 UTC	619	OUT	POST /g/v2/691.json HTTP/1.1 Host: id5-sync.com Connection: keep-alive Content-Length: 419 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:22 UTC	419	OUT	Data Raw: 7b 22 70 61 72 74 6e 65 72 22 3a 36 39 31 2c 22 67 64 70 72 22 3a 30 2c 22 6e 62 50 61 67 65 22 3a 31 2c 22 6f 22 3a 22 70 62 6a 73 22 2c 22 74 6d 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 72 65 66 22 3a 6e 75 6c 6c 2c 22 63 75 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 74 6f 70 22 3a 31 2c 22 75 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 76 22 3a 22 38 2e 31 39 2e 30 22 2c 22 73 74 6f 72 61 67 65 22 3a 7b 22 74 79 70 65 22 3a 22 68 74 6d 6c 35 22 2c 22 6e 61 6d 65 22 3a 22 69 64 35 69 64 22 2c 22 65 78 70 69 72 65 73 22 3a 39 30 2c Data Ascii: {"partner":691,"gdpr":0,"nbPage":1,"o":"pbjs","tml":"https://caffeine.softonic.com.br/","ref":null,"cu":"https://caffeine.softonic.com.br/","top":1,"u":"https://caffeine.softonic.com.br/","v":"8.19.0","storage":{"type":"html5","name":"id5id","expires":90,
2023-12-19 09:22:22 UTC	753	IN	HTTP/1.1 200 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers access-control-allow-origin: https://caffeine.softonic.com.br vary: Origin access-control-allow-credentials: true p3p: CP="CAO PSA OUR" set-cookie: 3pi=; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:22 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure set-cookie: id5=007d896a-8f1e-732b-999f-36c629c57f99#1702977742775#1; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:22 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure content-type: application/json;charset=UTF-8 transfer-encoding: chunked date: Tue, 19 Dec 2023 09:22:22 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2023-12-19 09:22:22 UTC	670	IN	Data Raw: 32 39 37 0d 0a 7b 22 73 69 67 6e 61 74 75 72 65 22 3a 22 49 44 35 5f 41 70 34 6b 64 50 53 72 67 4e 57 31 4d 39 43 6b 62 53 57 62 4e 41 31 44 42 75 64 33 77 34 39 6e 55 4b 4e 53 6e 50 36 31 74 6d 46 71 55 59 57 50 52 37 76 50 61 61 6e 61 72 46 71 4b 66 56 61 41 2d 7a 38 51 61 52 76 6b 64 7a 6a 64 2d 6f 43 73 70 42 62 66 65 5f 78 75 6b 73 42 56 35 35 42 35 55 52 67 41 68 4d 6a 31 56 64 4e 64 42 4a 52 46 4e 4c 5f 47 7a 6f 63 34 52 6b 75 33 34 6e 62 4b 6c 6c 50 4e 6d 63 70 48 50 44 71 4c 6d 44 74 35 55 35 49 22 2c 22 63 72 65 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 32 2d 31 39 54 30 39 3a 32 32 3a 32 32 2e 37 37 35 35 32 36 37 39 34 5a 22 2c 22 69 64 35 5f 63 6f 6e 73 65 6e 74 22 3a 74 72 75 65 2c 22 6f 72 69 67 69 6e 61 6c 5f 75 69 64 22 3a 22 49 44 Data Ascii: 297{"signature":"ID5_Ap4kdPSrgNW1M9CkbSWbNA1DBud3w49nUKNSnP61tmFqUYWPR7vPaanarFqKfVaA-z8QaRvkdzjd-oCspBbfe_xuksBV55B5URgAhMj1VdNdBJRFNL_Gzoc4Rku34nbKllPNmcpHPDqLmDt5U5I","created_at":"2023-12-19T09:22:22.775526794Z","id5_consent":true,"original_uid":"ID
2023-12-19 09:22:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.16	49850	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	789	OUT	GET /iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-onetag_pm-db5_rbd_rx_ox-db5_smrt_sovrn_3lift HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:23 UTC	796	IN	HTTP/1.1 302 Found Server: Server Date: Tue, 19 Dec 2023 09:22:23 GMT Content-Length: 0 Connection: close x-amz-rid: CWY3YSE7ESNZPCWBKG9K Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM\|t; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:23 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-onetag_pm-db5_rbd_rx_ox-db5_smrt_sovrn_3lift&dcc=t Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.16	49856	172.217.3.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	2573	OUT	GET /gampad/ads?pvsid=3694862415250323&correlator=3128165725747980&eid=31079783%2C44807747%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&trt=2&iu_parts=5302%2Cdesktop%2Cdesktop-Web-pt%2CApps%2CProgrampage%2CATF_OOP_Wallpaper&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=1x1&ifi=1&sfv=1-0-40&ists=1&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1702977741711&lmt=1702977741&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fcaffeine.softonic.com.br%2F&vis=1&psz=0x0&msz=0x0&fws=128&ohw=0&ga_vid=430166992.1702977739&ga_sid=1702977742&ga_hid=1147585949&ga_fc=true&td=1&topics=9&tps=9&htps=10&a3p=EhsKDGlkNS1zeW5jLmNvbRiIx4iLyDFIAFICCGQ.&nt=1&psd=WzE1LFsyLFtbIi81MzAyL2Rlc2t0b3AvZGVza3RvcC1XZWItcHQvQXBwcy9Qcm9ncmFtcGFnZS9BVEZfT09QX1dhbGxwYXBlciIsW11dXV0sbnVsbCwzXQ..&dlt=1702977735228&idt=6425&prev_scp=pos%3Dtop%26countryCluster%3DA1%26td-slot%3Dtop-wallpaper%26hvi%3Dfalse%26type%3Doop_display_wallpaper&cust_params=medium%3Dorganic%26campaign%3D%26source%3Dnone%26medium_campaign%3Dorganic%26medium_source%3Dorganic-none%26file%3Df46a4db4-96d4-11e6-b215-00163ec9f5fa%26reviewvecna%3Dfalse%26recat%3Dutilities-tools%26hosted%3Dfalse%26compliant%3D1%26devel%3D0%26locale%3Dpt-BR%26author%3DZhornsoftware%26content%3Drich%26country%3DUS%26region%3DA%26platformId%3Dwindows%26ad_session_id%3Dca334998-1875-4288-9025-8f913da6a89a%26pv%3D1%26ab_upr%3D6%26personalized%3D1&adks=968654847&frm=20 HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:23 UTC	885	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://caffeine.softonic.com.br Observe-Browsing-Topics: ?1 Google-LineItem-Id: -2 Google-Creative-Id: -2 Google-MediationGroup-Id: -2 Google-MediationTag-Id: -2 Date: Tue, 19 Dec 2023 09:22:23 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/plain; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:23 UTC	367	IN	Data Raw: 32 65 66 0d 0a 7b 22 2f 35 33 30 32 2f 64 65 73 6b 74 6f 70 2f 64 65 73 6b 74 6f 70 2d 57 65 62 2d 70 74 2f 41 70 70 73 2f 50 72 6f 67 72 61 6d 70 61 67 65 2f 41 54 46 5f 4f 4f 50 5f 57 61 6c 6c 70 61 70 65 72 22 3a 5b 22 68 74 6d 6c 22 2c 30 2c 30 2c 6e 75 6c 6c 2c 30 2c 30 2c 30 2c 31 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 22 49 44 3d 39 33 38 31 62 38 65 39 30 64 39 33 62 65 32 62 3a 54 3d 31 37 30 32 39 37 37 37 34 33 3a 52 54 3d 31 37 30 32 39 37 37 37 34 33 3a 53 3d 41 4c 4e 49 5f 4d 62 55 34 41 41 69 48 58 63 4e 73 72 30 57 38 56 4e 36 34 78 75 50 6e 52 76 42 70 51 22 2c 31 37 33 36 36 37 33 37 34 33 2c 22 2f 22 2c 22 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 31 5d 2c 5b 22 55 49 44 3d 30 30 30 30 30 64 Data Ascii: 2ef{"/5302/desktop/desktop-Web-pt/Apps/Programpage/ATF_OOP_Wallpaper":["html",0,0,null,0,0,0,1,0,null,null,null,null,[["ID=9381b8e90d93be2b:T=1702977743:RT=1702977743:S=ALNI_MbU4AAiHXcNsr0W8VN64xuPnRvBpQ",1736673743,"/","softonic.com.br",1],["UID=00000d
2023-12-19 09:22:23 UTC	391	IN	Data Raw: 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 41 4f 72 59 47 73 6c 58 71 7a 57 78 5a 6e 4d 77 61 31 30 48 68 73 6f 47 35 43 30 61 22 2c 22 43 4a 47 4b 31 72 75 57 6d 34 4d 44 46 63 7a 4d 4b 41 55 64 38 4e 6b 4c 63 51 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c Data Ascii: ,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CJGK1ruWm4MDFczMKAUd8NkLcQ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,nul
2023-12-19 09:22:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.16	49855	172.217.3.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	3477	OUT	GET /gampad/ads?pvsid=3694862415250323&correlator=363531866443330&eid=31079783%2C44807747%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&trt=2&iu_parts=5302%2Cdesktop%2Cdesktop-Web-pt%2CApps%2CProgrampage%2CATF_MPU_First%2CATF_Notificationbar%2CATF_Leaderboard_First&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5%2C%2F0%2F1%2F2%2F3%2F4%2F6%2C%2F0%2F1%2F2%2F3%2F4%2F7&prev_iu_szs=300x600%7C300x250%7C300x180%7C300x150%7C250x250%7C200x200%7C180x150%7C160x600%7C120x600%2C320x50%2C1x1%7C970x250%7C970x90%7C960x90%7C950x90%7C728x90%7C500x90%7C468x90%7C468x60&fluid=0%2Cheight%2C0&ifi=2&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1702977741720&lmt=1702977741&adxs=939%2C0%2C147&adys=424%2C0%2C258&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=2%7C3%7C4&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fcaffeine.softonic.com.br%2F&vis=1&psz=300x0%7C1263x0%7C970x0&msz=300x0%7C1263x0%7C970x0&fws=512%2C4%2C4&ohw=0%2C1263%2C970&ga_vid=430166992.1702977739&ga_sid=1702977742&ga_hid=1147585949&ga_fc=true&td=1&topics=9&tps=9&htps=10&a3p=EhsKDGlkNS1zeW5jLmNvbRiIx4iLyDFIAFICCGQ.&nt=1&psd=WzE1LFsyLFtbIi81MzAyL2Rlc2t0b3AvZGVza3RvcC1XZWItcHQvQXBwcy9Qcm9ncmFtcGFnZS9BVEZfTVBVX0ZpcnN0IixbXV0sWyIvNTMwMi9kZXNrdG9wL2Rlc2t0b3AtV2ViLXB0L0FwcHMvUHJvZ3JhbXBhZ2UvQVRGX05vdGlmaWNhdGlvbmJhciIsW11dLFsiLzUzMDIvZGVza3RvcC9kZXNrdG9wLVdlYi1wdC9BcHBzL1Byb2dyYW1wYWdlL0FURl9MZWFkZXJib2FyZF9GaXJzdCIsW11dXV0sbnVsbCwzXQ..&dlt=1702977735228&idt=6425&prev_scp=pos%3Dtop%26countryCluster%3DA1%26td-slot%3Dtop-mpu-1%26hvi%3Dfalse%26type%3Dtop_display_mpu%26afcSlotId%3D1217021608%26amznbid%3D2%26amznp%3D2%7Cpos%3Dtop%26countryCluster%3DA1%26td-slot%3Dnative-notificationbar%26hvi%3Dfalse%26type%3Dnative_notificationbar%26devicePlatformId%3Dwindows%7Cpos%3Dtop%26countryCluster%3DA1%26td-slot%3Dtop-leaderboard-1%26hvi%3Dfalse%26type%3Dtop_display_leaderboard%26amznbid%3D2%26amznp%3D2&cust_params=medium%3Dorganic%26campaign%3D%26source%3Dnone%26medium_campaign%3Dorganic%26medium_source%3Dorganic-none%26file%3Df46a4db4-96d4-11e6-b215-00163ec9f5fa%26reviewvecna%3Dfalse%26recat%3Dutilities-tools%26hosted%3Dfalse%26compliant%3D1%26devel%3D0%26locale%3Dpt-BR%26author%3DZhornsoftware%26content%3Drich%26country%3DUS%26region%3DA%26platformId%3Dwindows%26ad_session_id%3Dca334998-1875-4288-9025-8f913da6a89a%26pv%3D1%26ab_upr%3D6%26personalized%3D1&adks=4226504758%2C3804165121%2C1886130427&frm=20 HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:24 UTC	957	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://caffeine.softonic.com.br Observe-Browsing-Topics: ?1 Google-LineItem-Id: 6394220594,5540562854,6389242249 Google-Creative-Id: 138449286096,138334288301,138448073384 Google-MediationGroup-Id: -2,-2,-2 Google-MediationTag-Id: -2 Date: Tue, 19 Dec 2023 09:22:24 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/plain; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:24 UTC	295	IN	Data Raw: 37 32 36 65 0d 0a 7b 22 2f 35 33 30 32 2f 64 65 73 6b 74 6f 70 2f 64 65 73 6b 74 6f 70 2d 57 65 62 2d 70 74 2f 41 70 70 73 2f 50 72 6f 67 72 61 6d 70 61 67 65 2f 41 54 46 5f 4d 50 55 5f 46 69 72 73 74 22 3a 5b 22 68 74 6d 6c 22 2c 30 2c 30 2c 6e 75 6c 6c 2c 30 2c 36 30 30 2c 33 30 30 2c 30 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 2c 5b 5b 22 49 44 3d 33 37 38 39 37 30 38 63 39 64 37 34 66 34 33 32 3a 54 3d 31 37 30 32 39 37 37 37 34 33 3a 52 54 3d 31 37 30 32 39 37 37 37 34 33 3a 53 3d 41 4c 4e 49 5f 4d 62 53 76 4a 5a 64 66 2d 59 68 56 49 65 31 42 45 61 51 32 35 56 49 33 38 4d 7a 61 77 22 2c 31 37 33 36 36 37 33 37 34 33 2c 22 2f 22 2c 22 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 31 5d 2c 5b 22 55 49 44 3d 30 30 30 30 30 64 61 62 Data Ascii: 726e{"/5302/desktop/desktop-Web-pt/Apps/Programpage/ATF_MPU_First":["html",0,0,null,0,600,300,0,0,null,null,null,1,[["ID=3789708c9d74f432:T=1702977743:RT=1702977743:S=ALNI_MbSvJZdf-YhVIe1BEaQ25VI38Mzaw",1736673743,"/","softonic.com.br",1],["UID=00000dab
2023-12-19 09:22:24 UTC	1252	IN	Data Raw: 4e 49 5f 4d 5a 67 68 72 4c 30 4b 37 67 58 2d 73 42 4c 2d 76 39 34 6d 37 70 6f 41 43 67 36 76 41 22 2c 31 37 33 36 36 37 33 37 34 33 2c 22 2f 22 2c 22 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 32 5d 5d 2c 5b 31 33 38 34 34 39 32 38 36 30 39 36 5d 2c 5b 36 33 39 34 32 32 30 35 39 34 5d 2c 5b 33 39 32 32 32 36 35 39 5d 2c 5b 33 32 35 35 34 31 39 32 32 31 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 41 4f 72 59 47 73 6b 30 52 71 77 67 5a 33 53 32 61 54 64 74 45 73 65 35 66 6a 37 38 55 59 46 72 45 44 35 74 48 64 73 6a 69 54 58 6f 50 6c 7a 71 51 6c 72 4a 4b 30 70 5f 54 77 4a 5f 2d 4d 32 4e Data Ascii: NI_MZghrL0K7gX-sBL-v94m7poACg6vA",1736673743,"/","softonic.com.br",2]],[138449286096],[6394220594],[39222659],[3255419221],null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGsk0RqwgZ3S2aTdtEse5fj78UYFrED5tHdsjiTXoPlzqQlrJK0p_TwJ_-M2N
2023-12-19 09:22:24 UTC	1252	IN	Data Raw: 37 31 38 39 36 31 31 22 2c 22 2d 32 32 36 30 36 37 33 37 32 33 30 31 34 35 37 33 38 36 30 22 2c 22 34 37 31 34 30 37 35 33 38 34 32 38 36 37 33 38 30 39 30 22 2c 22 34 38 30 35 31 32 34 34 34 32 33 37 31 37 31 34 38 33 35 22 2c 22 38 36 34 31 33 30 34 38 30 30 32 34 38 34 32 38 36 31 35 22 2c 22 32 39 39 33 37 31 37 36 36 30 33 35 36 30 35 38 35 32 31 22 2c 22 33 35 36 34 33 35 37 38 39 35 38 37 30 36 36 36 38 31 39 22 2c 22 38 30 35 32 39 33 37 32 35 36 35 39 30 39 37 31 37 32 32 22 2c 22 36 37 38 30 34 32 36 34 35 32 39 31 38 30 33 30 35 33 30 22 2c 22 39 32 37 39 35 30 36 37 38 37 37 30 31 34 39 31 31 30 22 2c 22 2d 35 34 38 32 35 33 39 34 33 35 39 37 38 30 38 38 32 36 38 22 2c 22 2d 35 37 39 38 31 33 31 38 35 35 33 32 33 38 34 34 30 35 31 22 2c 22 35 Data Ascii: 7189611","-2260673723014573860","4714075384286738090","4805124442371714835","8641304800248428615","2993717660356058521","3564357895870666819","8052937256590971722","6780426452918030530","927950678770149110","-5482539435978088268","-5798131855323844051","5
2023-12-19 09:22:24 UTC	1252	IN	Data Raw: 32 36 39 33 2c 31 37 38 37 2c 31 31 38 33 2c 35 32 37 34 2c 33 34 36 32 2c 33 37 36 34 2c 34 36 37 30 2c 35 37 39 2c 31 36 38 2c 37 37 32 2c 34 37 30 2c 34 32 33 31 2c 33 39 32 39 2c 32 35 38 34 2c 31 30 37 34 2c 33 33 32 35 2c 33 36 32 37 2c 34 38 33 35 2c 31 33 37 36 2c 34 35 33 33 2c 35 31 33 37 2c 36 30 37 2c 33 30 35 2c 34 33 39 36 2c 33 31 38 38 2c 33 30 32 33 2c 34 30 39 34 2c 32 34 31 39 2c 33 2c 35 30 30 30 2c 31 32 31 31 2c 31 35 31 33 2c 39 30 39 2c 35 33 30 32 2c 35 31 36 35 2c 32 34 37 35 2c 32 37 37 37 2c 33 39 35 37 2c 34 35 36 31 2c 34 38 36 33 2c 35 39 2c 32 39 31 34 2c 34 31 32 32 2c 31 31 30 32 2c 33 33 33 2c 36 33 35 2c 33 31 2c 31 37 30 36 2c 34 37 32 36 2c 34 39 38 2c 38 30 30 2c 33 36 38 33 2c 33 33 38 31 2c 34 32 38 37 2c 35 30 32 Data Ascii: 2693,1787,1183,5274,3462,3764,4670,579,168,772,470,4231,3929,2584,1074,3325,3627,4835,1376,4533,5137,607,305,4396,3188,3023,4094,2419,3,5000,1211,1513,909,5302,5165,2475,2777,3957,4561,4863,59,2914,4122,1102,333,635,31,1706,4726,498,800,3683,3381,4287,502
2023-12-19 09:22:24 UTC	1252	IN	Data Raw: 34 33 38 2c 39 32 38 2c 33 30 34 32 2c 31 35 33 32 2c 33 33 37 32 2c 35 33 32 31 2c 31 35 38 38 2c 37 38 2c 36 38 32 2c 34 32 37 38 2c 32 37 39 36 2c 34 34 34 33 2c 34 37 34 35 2c 35 30 34 37 2c 32 34 39 34 2c 34 31 34 31 2c 33 30 39 38 2c 34 38 38 32 2c 34 38 39 2c 32 39 33 33 2c 32 30 32 37 2c 31 34 32 33 2c 32 33 32 39 2c 35 32 31 32 2c 34 33 30 36 2c 34 39 31 30 2c 35 31 37 2c 32 31 35 2c 38 31 39 2c 34 36 30 38 2c 31 30 36 2c 37 31 30 2c 33 38 36 37 2c 34 31 36 39 2c 31 33 31 34 2c 32 35 32 32 2c 33 31 32 36 2c 35 30 37 35 2c 34 37 37 33 2c 34 34 37 31 2c 38 34 37 2c 35 34 35 2c 34 36 33 36 2c 32 34 33 2c 34 39 33 38 2c 35 32 34 30 2c 33 37 33 30 2c 34 33 33 34 2c 33 34 32 38 2c 32 33 35 37 2c 32 36 35 39 2c 31 34 35 31 2c 31 32 30 35 2c 32 37 31 35 Data Ascii: 438,928,3042,1532,3372,5321,1588,78,682,4278,2796,4443,4745,5047,2494,4141,3098,4882,489,2933,2027,1423,2329,5212,4306,4910,517,215,819,4608,106,710,3867,4169,1314,2522,3126,5075,4773,4471,847,545,4636,243,4938,5240,3730,4334,3428,2357,2659,1451,1205,2715
2023-12-19 09:22:24 UTC	1252	IN	Data Raw: 2c 34 39 32 39 2c 33 37 32 31 2c 32 39 35 32 2c 34 33 32 35 2c 31 34 34 32 2c 31 37 34 34 2c 35 32 33 31 2c 33 35 38 34 2c 32 37 30 36 2c 34 34 39 30 2c 32 31 30 32 2c 33 38 38 36 2c 34 31 38 38 2c 38 39 34 2c 34 37 39 32 2c 35 30 39 34 2c 32 38 34 33 2c 31 30 33 31 2c 38 36 36 2c 31 39 33 37 2c 31 33 33 33 2c 31 37 37 32 2c 34 33 35 33 2c 31 32 35 2c 34 36 35 35 2c 34 39 35 37 2c 35 32 35 39 2c 32 36 37 38 2c 33 39 31 34 2c 35 36 34 2c 31 36 2c 33 31 38 2c 36 32 30 2c 33 30 33 36 2c 32 37 33 34 2c 35 31 32 32 2c 32 34 33 32 2c 34 36 38 33 2c 34 33 38 31 2c 33 37 37 37 2c 35 32 38 37 2c 31 39 36 35 2c 33 36 34 30 2c 33 39 34 32 2c 34 32 34 34 2c 37 35 37 2c 34 35 35 2c 34 35 34 36 2c 31 35 33 2c 34 38 34 38 2c 35 31 35 30 2c 34 34 2c 36 34 38 2c 39 35 30 Data Ascii: ,4929,3721,2952,4325,1442,1744,5231,3584,2706,4490,2102,3886,4188,894,4792,5094,2843,1031,866,1937,1333,1772,4353,125,4655,4957,5259,2678,3914,564,16,318,620,3036,2734,5122,2432,4683,4381,3777,5287,1965,3640,3942,4244,757,455,4546,153,4848,5150,44,648,950
2023-12-19 09:22:24 UTC	1252	IN	Data Raw: 34 39 39 30 2c 35 32 39 32 2c 33 37 38 32 2c 34 30 38 34 2c 34 36 38 38 2c 33 34 38 30 2c 34 33 38 36 2c 34 38 38 2c 37 39 30 2c 32 39 30 34 2c 36 35 33 2c 33 36 34 35 2c 32 33 30 30 2c 32 36 30 32 2c 34 32 34 39 2c 34 35 35 31 2c 34 38 35 33 2c 34 34 31 34 2c 36 32 35 2c 34 37 31 36 2c 35 30 31 38 2c 35 33 32 30 2c 33 32 33 2c 32 31 2c 33 38 31 30 2c 32 34 33 37 2c 34 31 31 32 2c 32 37 33 39 2c 33 32 30 36 2c 31 35 33 31 2c 33 36 37 33 2c 33 30 39 37 2c 34 35 37 39 2c 33 39 37 35 2c 34 38 38 31 2c 35 31 38 33 2c 36 38 31 2c 34 31 34 30 2c 33 38 33 38 2c 33 35 33 36 2c 31 31 32 30 2c 31 34 32 32 2c 34 37 34 34 2c 34 34 34 32 2c 31 38 36 31 2c 31 35 35 39 2c 32 31 34 2c 31 32 35 37 2c 35 31 36 2c 34 39 30 39 2c 34 30 30 33 2c 32 34 36 35 2c 32 37 36 37 2c Data Ascii: 4990,5292,3782,4084,4688,3480,4386,488,790,2904,653,3645,2300,2602,4249,4551,4853,4414,625,4716,5018,5320,323,21,3810,2437,4112,2739,3206,1531,3673,3097,4579,3975,4881,5183,681,4140,3838,3536,1120,1422,4744,4442,1861,1559,214,1257,516,4909,4003,2465,2767,
2023-12-19 09:22:24 UTC	1252	IN	Data Raw: 32 31 35 34 2c 33 34 32 2c 32 37 35 38 2c 34 32 39 36 2c 33 39 38 2c 37 30 30 2c 33 31 31 36 2c 35 32 30 32 2c 34 39 30 30 2c 35 30 36 35 2c 34 37 36 33 2c 34 34 36 31 2c 31 33 30 34 2c 33 37 32 30 2c 38 33 37 2c 34 36 32 36 2c 35 33 35 2c 32 33 33 2c 34 39 32 38 2c 35 32 33 30 2c 37 32 38 2c 38 39 33 2c 31 32 34 2c 33 38 38 35 2c 32 38 34 32 2c 34 31 38 37 2c 33 31 34 34 2c 31 36 33 34 2c 34 32 36 2c 34 34 38 39 2c 34 37 39 31 2c 38 36 35 2c 34 36 35 34 2c 34 39 35 36 2c 32 36 31 2c 35 32 35 38 2c 33 37 34 38 2c 33 34 34 36 2c 32 39 37 39 2c 31 37 37 31 2c 31 31 36 37 2c 31 32 32 33 2c 33 36 31 31 2c 32 31 32 39 2c 34 32 31 35 2c 35 31 32 31 2c 34 35 31 37 2c 33 31 37 2c 31 35 2c 36 31 39 2c 32 32 36 36 2c 34 30 37 38 2c 35 32 38 36 2c 31 36 36 32 2c 31 Data Ascii: 2154,342,2758,4296,398,700,3116,5202,4900,5065,4763,4461,1304,3720,837,4626,535,233,4928,5230,728,893,124,3885,2842,4187,3144,1634,426,4489,4791,865,4654,4956,261,5258,3748,3446,2979,1771,1167,1223,3611,2129,4215,5121,4517,317,15,619,2266,4078,5286,1662,1
2023-12-19 09:22:24 UTC	1252	IN	Data Raw: 37 2c 31 37 36 32 2c 35 32 34 39 2c 31 31 35 38 2c 33 36 30 32 2c 34 32 30 36 2c 34 38 31 30 2c 34 35 30 38 2c 36 2c 33 31 36 33 2c 33 30 38 2c 33 37 36 37 2c 33 34 36 35 2c 32 38 36 31 2c 31 33 35 31 2c 34 36 37 33 2c 31 39 35 35 2c 37 34 37 2c 31 34 38 38 2c 34 35 33 36 2c 31 34 33 2c 35 31 34 30 2c 31 30 34 39 2c 34 39 37 35 2c 34 32 33 34 2c 33 33 32 38 2c 33 33 36 2c 34 34 35 2c 36 33 38 2c 32 37 35 32 2c 33 30 35 34 2c 38 38 34 2c 32 34 35 30 2c 33 34 39 33 2c 35 30 30 33 2c 33 37 39 35 2c 39 34 30 2c 34 37 30 31 2c 31 38 34 36 2c 31 35 34 34 2c 35 33 30 35 2c 34 35 36 34 2c 37 37 35 2c 34 38 36 36 2c 35 31 36 38 2c 34 34 32 37 2c 36 36 36 2c 31 31 33 33 2c 34 31 32 35 2c 33 38 32 33 2c 36 32 2c 32 32 37 2c 31 35 37 32 2c 38 33 31 2c 39 36 38 2c 35 Data Ascii: 7,1762,5249,1158,3602,4206,4810,4508,6,3163,308,3767,3465,2861,1351,4673,1955,747,1488,4536,143,5140,1049,4975,4234,3328,336,445,638,2752,3054,884,2450,3493,5003,3795,940,4701,1846,1544,5305,4564,775,4866,5168,4427,666,1133,4125,3823,62,227,1572,831,968,5
2023-12-19 09:22:24 UTC	1252	IN	Data Raw: 34 33 2c 34 37 33 34 2c 35 30 33 36 2c 34 31 33 30 2c 33 38 32 38 2c 33 34 31 2c 33 35 32 36 2c 32 34 35 35 2c 32 31 35 33 2c 39 34 35 2c 31 30 30 31 2c 33 36 39 31 2c 34 32 39 35 2c 32 35 31 31 2c 31 33 30 33 2c 33 31 31 35 2c 31 36 30 35 2c 33 33 38 39 2c 34 35 39 37 2c 34 38 39 39 2c 35 32 30 31 2c 33 39 37 2c 33 32 35 32 2c 36 39 39 2c 32 33 34 36 2c 35 30 36 34 2c 31 34 34 30 2c 34 34 36 30 2c 35 33 34 2c 38 33 36 2c 35 32 32 39 2c 32 33 32 2c 33 30 38 37 2c 34 37 36 32 2c 34 36 32 35 2c 34 33 32 33 2c 37 32 37 2c 31 32 33 2c 33 35 38 32 2c 32 32 33 37 2c 33 38 38 34 2c 34 37 39 30 2c 31 33 33 31 2c 31 37 37 30 2c 32 36 30 2c 31 31 36 36 2c 35 36 32 2c 32 36 37 36 2c 33 34 34 35 2c 38 36 34 2c 34 36 35 33 2c 34 33 35 31 2c 35 32 35 37 2c 35 30 30 35 Data Ascii: 43,4734,5036,4130,3828,341,3526,2455,2153,945,1001,3691,4295,2511,1303,3115,1605,3389,4597,4899,5201,397,3252,699,2346,5064,1440,4460,534,836,5229,232,3087,4762,4625,4323,727,123,3582,2237,3884,4790,1331,1770,260,1166,562,2676,3445,864,4653,4351,5257,5005

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.16	49859	69.175.41.44	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	413	OUT	GET /rtb/bid?src=prebid_prebid_8.19.0 HTTP/1.1 Host: ap.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6
2023-12-19 09:22:23 UTC	296	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 19 Dec 2023 09:22:23 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, DELETE, PUT Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Requested-With, Content-Type X-Sovrn-Pod: ad_ap4ord1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.16	49862	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	836	OUT	GET /iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-onetag_pm-db5_rbd_rx_ox-db5_smrt_sovrn_3lift&dcc=t HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM\|t
2023-12-19 09:22:23 UTC	827	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:23 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 329 Connection: close x-amz-rid: 5YY8YQFTN8ZNZ8EDG899 Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:23 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:23 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:23 UTC	329	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 69 66 72 61 6d 65 20 77 69 64 74 68 3d 22 31 22 20 68 65 69 67 68 74 3d 22 31 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 73 72 63 3d 22 2f 2f 73 2e 61 6d 61 7a 6f 6e 2d 61 64 73 79 73 74 65 6d 2e 63 6f 6d 2f 76 33 2f 70 72 3f 65 78 6c 69 73 74 3d 67 67 5f 6e 2d 69 6e 64 65 78 5f 6e 2d 6f 6e 65 74 61 67 5f 70 6d 2d 64 62 35 5f 72 62 64 5f 72 78 5f 6f 78 2d 64 62 35 5f 73 6d 72 74 5f 73 6f 76 72 6e 5f 33 6c 69 66 74 26 66 76 3d 31 2e 30 26 61 3d 63 6d 26 63 6d 33 70 70 64 3d 31 26 64 6d 74 3d 33 26 Data Ascii: <html><body style="background-color:transparent"><iframe width="1" height="1" frameborder="0" marginwidth="0" marginheight="0" src="//s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-onetag_pm-db5_rbd_rx_ox-db5_smrt_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.16	49867	192.178.50.78	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	691	OUT	GET /v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM HTTP/1.1 Host: ampcid.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:24 UTC	297	IN	HTTP/1.1 404 Not Found Date: Tue, 19 Dec 2023 09:22:24 GMT Content-Type: text/html; charset=UTF-8 Server: ESF Content-Length: 1629 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:24 UTC	955	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2023-12-19 09:22:24 UTC	674	IN	Data Raw: 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 Data Ascii: 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelog

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.16	49868	65.8.27.208	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	451	OUT	GET /cdn/prod/config?src=3177&u=https%3A%2F%2Fcaffeine.softonic.com.br HTTP/1.1 Host: c.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM\|t
2023-12-19 09:22:24 UTC	401	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Content-Length: 1246 Connection: close Cache-Control: max-age=21550, s-maxage=21600 Date: Tue, 19 Dec 2023 09:22:23 GMT Server: Server X-Cache: Miss from cloudfront Via: 1.1 67edc2c709bde36f8564dbd713a1d90e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C5 X-Amz-Cf-Id: 122grl8DzADIXWPobwMPXawi9u4oTyVwRKIoSWRmeBR7fo3jZWbtSQ==
2023-12-19 09:22:24 UTC	1246	IN	Data Raw: 7b 22 33 70 76 65 6e 64 6f 72 22 3a 22 76 61 72 20 6c 65 78 69 63 6f 6e 50 72 6f 70 65 72 74 79 49 64 20 3d 20 27 30 30 31 33 33 30 30 30 30 31 6b 51 6a 31 61 41 41 43 27 3b 5c 6e 69 66 20 28 6c 65 78 69 63 6f 6e 50 72 6f 70 65 72 74 79 49 64 20 26 26 20 6c 65 78 69 63 6f 6e 50 72 6f 70 65 72 74 79 49 64 2e 63 68 61 72 41 74 28 30 29 20 21 3d 3d 20 27 25 27 29 20 7b 5c 6e 20 20 69 66 20 28 21 77 69 6e 64 6f 77 2e 5f 33 33 41 63 72 6f 73 73 49 64 4d 61 70 70 69 6e 67 73 50 72 6f 76 69 64 65 72 29 20 7b 5c 6e 20 20 20 20 63 72 65 61 74 65 6c 65 78 69 63 6f 6e 53 63 72 69 70 74 28 6c 65 78 69 63 6f 6e 50 72 6f 70 65 72 74 79 49 64 29 3b 5c 6e 20 20 7d 5c 6e 7d 5c 6e 5c 6e 66 75 6e 63 74 69 6f 6e 20 63 72 65 61 74 65 6c 65 78 69 63 6f 6e 53 63 72 69 70 74 28 Data Ascii: {"3pvendor":"var lexiconPropertyId = '0013300001kQj1aAAC';\nif (lexiconPropertyId && lexiconPropertyId.charAt(0) !== '%') {\n if (!window._33AcrossIdMappingsProvider) {\n createlexiconScript(lexiconPropertyId);\n }\n}\n\nfunction createlexiconScript(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.16	49869	65.8.27.208	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	413	OUT	GET /bao-csm/aps-comm/aps_csm.js HTTP/1.1 Host: c.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM\|t
2023-12-19 09:22:23 UTC	620	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 6482 Connection: close Date: Tue, 19 Dec 2023 08:34:38 GMT Last-Modified: Tue, 29 Aug 2023 08:30:37 GMT ETag: "a4d296427fc806b21335359e398c025c" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=86400 x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c9e91f71d3df5bdb47d5911662f0b3c2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C5 X-Amz-Cf-Id: gt3HD4nWl08FgfFdkMnWmxtdpa9cVnq8G7fPYT2_eOFapU0h1lLjEw== Age: 2866
2023-12-19 09:22:23 UTC	6396	IN	Data Raw: 76 61 72 20 61 6d 7a 6e 5f 61 70 73 5f 63 73 6d 3d 61 6d 7a 6e 5f 61 70 73 5f 63 73 6d 7c 7c 7b 7d 3b 61 6d 7a 6e 5f 61 70 73 5f 63 73 6d 2e 65 72 72 6f 72 73 3d 5b 5d 2c 61 6d 7a 6e 5f 61 70 73 5f 63 73 6d 2e 72 65 70 6f 72 74 45 72 72 6f 72 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 3b 66 6f 72 28 2f 5e 68 74 74 70 73 3f 3a 5c 2f 5c 2f 2f 2e 74 65 73 74 28 61 29 3d 3d 3d 21 31 26 26 28 61 3d 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2b 22 2f 2f 22 2b 61 29 2c 22 2f 22 21 3d 3d 61 2e 73 75 62 73 74 72 28 61 2e 6c 65 6e 67 74 68 2d 31 29 26 26 28 61 2b 3d 22 2f 22 29 2c 62 3d 30 3b 62 3c 61 6d 7a 6e 5f 61 70 73 5f 63 73 6d 2e 65 72 72 6f 72 73 2e 6c 65 6e 67 74 68 3b 62 2b 2b 29 63 3d 27 7b 22 61 64 Data Ascii: var amzn_aps_csm=amzn_aps_csm\|\|{};amzn_aps_csm.errors=[],amzn_aps_csm.reportErrors=function(a){var b,c;for(/^https?:\/\//.test(a)===!1&&(a=document.location.protocol+"//"+a),"/"!==a.substr(a.length-1)&&(a+="/"),b=0;b<amzn_aps_csm.errors.length;b++)c='{"ad
2023-12-19 09:22:23 UTC	86	IN	Data Raw: 73 79 73 74 65 6d 5c 2e 63 6f 6d 2f 2e 74 65 73 74 28 6c 29 26 26 61 6d 7a 6e 5f 61 70 73 5f 63 73 6d 2e 70 69 78 65 6c 51 75 65 75 65 2e 66 69 72 65 50 69 78 65 6c 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 6d 29 2c 6c 2c 22 22 29 7d 7d 29 7d 28 29 3b Data Ascii: system\.com/.test(l)&&amzn_aps_csm.pixelQueue.firePixel(JSON.stringify(m),l,"")}})}();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.16	49870	99.84.242.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	1542	OUT	GET /e/dtb/bid?src=3177&u=https%3A%2F%2Fcaffeine.softonic.com.br%2F&pid=sN2DceDyaHhkI&cb=0&ws=1280x907&v=23.1211.1645&t=1000&slots=%5B%7B%22sd%22%3A%22top-mpu-1__ad%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%2C%22300x180%22%2C%22300x150%22%2C%22250x250%22%2C%22200x200%22%2C%22180x150%22%2C%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fdesktop-Web-pt%2FApps%2FProgrampage%2FATF_MPU_First%22%7D%2C%7B%22sd%22%3A%22top-leaderboard-1__ad%22%2C%22s%22%3A%5B%221x1%22%2C%22970x250%22%2C%22970x90%22%2C%22960x90%22%2C%22950x90%22%2C%22728x90%22%2C%22500x90%22%2C%22468x90%22%2C%22468x60%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fdesktop-Web-pt%2FApps%2FProgrampage%2FATF_Leaderboard_First%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22Windows%22%7D%2C%22browsers%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%5B%22117%22%5D%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%5B%228%22%5D%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%5B%22117%22%5D%7D%5D%7D%7D%7D&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D HTTP/1.1 Host: aax.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM\|t
2023-12-19 09:22:24 UTC	493	IN	HTTP/1.1 200 OK Content-Type: text/javascript;charset=UTF-8 Content-Length: 650 Connection: close Server: Server Date: Tue, 19 Dec 2023 09:22:24 GMT x-amz-rid: 2VM608VCZ4ZAP2CDARYK Strict-Transport-Security: max-age=47474747; includeSubDomains; preload Vary: Accept-Encoding,User-Agent X-Cache: Miss from cloudfront Via: 1.1 ac14fcc863a89fac74e34ba2c00bfef4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P6 X-Amz-Cf-Id: s8FnTu21lo3mMBQYs3kl9ZLFcvT1MIUgq85GahH6NvyiigXxrKf-cA==
2023-12-19 09:22:24 UTC	650	IN	Data Raw: 2f 2a 20 61 61 78 20 72 65 73 70 6f 6e 73 65 20 2a 2f 0a 61 70 73 74 61 67 2e 62 69 64 73 28 7b 22 73 6c 6f 74 73 22 3a 5b 7b 22 74 61 72 67 65 74 69 6e 67 22 3a 5b 22 61 6d 7a 6e 69 69 64 22 2c 22 61 6d 7a 6e 70 22 2c 22 61 6d 7a 6e 73 7a 22 2c 22 61 6d 7a 6e 62 69 64 22 2c 22 61 6d 7a 6e 61 63 74 74 22 5d 2c 22 61 6d 7a 6e 69 69 64 22 3a 22 4a 4c 39 54 6a 41 43 4c 33 6e 47 50 6e 31 2d 4f 33 47 47 5a 46 38 67 41 41 41 47 4d 67 57 49 73 68 41 45 41 41 41 78 70 41 51 42 68 63 48 4e 66 64 48 68 75 58 32 4a 70 5a 44 45 67 49 43 42 68 63 48 4e 66 64 48 68 75 58 32 6c 74 63 44 45 67 49 43 41 49 47 37 41 55 22 2c 22 73 69 7a 65 22 3a 22 37 32 38 78 39 30 22 2c 22 6d 65 74 61 22 3a 5b 22 73 6c 6f 74 49 44 22 2c 22 6d 65 64 69 61 54 79 70 65 22 2c 22 73 69 7a 65 Data Ascii: /* aax response */apstag.bids({"slots":[{"targeting":["amzniid","amznp","amznsz","amznbid","amznactt"],"amzniid":"JL9TjACL3nGPn1-O3GGZF8gAAAGMgWIshAEAAAxpAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICAIG7AU","size":"728x90","meta":["slotID","mediaType","size

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.16	49863	141.95.33.120	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	425	OUT	GET /api/config/prebid HTTP/1.1 Host: id5-sync.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 3pi=; id5=007d896a-8f1e-732b-999f-36c629c57f99#1702977742775#1
2023-12-19 09:22:24 UTC	304	IN	HTTP/1.1 400 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding content-type: text/html;charset=utf-8 transfer-encoding: chunked date: Tue, 19 Dec 2023 09:22:23 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2023-12-19 09:22:24 UTC	40	IN	Data Raw: 32 32 0d 0a 70 61 72 74 6e 65 72 20 70 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 0d 0a Data Ascii: 22partner parameter must not be null
2023-12-19 09:22:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.16	49864	141.95.33.120	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	421	OUT	GET /g/v2/691.json HTTP/1.1 Host: id5-sync.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 3pi=; id5=007d896a-8f1e-732b-999f-36c629c57f99#1702977742775#1
2023-12-19 09:22:24 UTC	304	IN	HTTP/1.1 400 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding content-type: text/html;charset=utf-8 transfer-encoding: chunked date: Tue, 19 Dec 2023 09:22:23 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2023-12-19 09:22:24 UTC	28	IN	Data Raw: 31 31 0d 0a 6d 69 73 73 69 6e 67 20 28 76 29 65 72 73 69 6f 6e 0d 0a 30 0d 0a 0d 0a Data Ascii: 11missing (v)ersion0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.16	49871	172.253.124.156	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	698	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-20035800-1&cid=430166992.1702977739&jid=183335909&gjid=7637531&_gid=759421984.1702977740&_u=YCDAgEABAAQCAGAAI~&z=1378827441 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:25 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Tue, 19 Dec 2023 09:22:24 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:25 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.16	49866	162.19.138.120	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:23 UTC	349	OUT	GET /lb/v1 HTTP/1.1 Host: lb.eu-1-id5-sync.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:24 UTC	309	IN	HTTP/1.1 200 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers content-type: application/json;charset=UTF-8 transfer-encoding: chunked date: Tue, 19 Dec 2023 09:22:23 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2023-12-19 09:22:24 UTC	39	IN	Data Raw: 32 31 0d 0a 7b 22 6c 62 22 3a 22 2b 65 76 44 70 76 37 58 75 4e 54 64 69 41 4d 4e 4f 73 36 69 62 51 3d 3d 22 7d 0d 0a Data Ascii: 21{"lb":"+evDpv7XuNTdiAMNOs6ibQ=="}
2023-12-19 09:22:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.16	49881	151.101.193.108	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:24 UTC	708	OUT	GET /dmp/async_usersync.html HTTP/1.1 Host: acdn.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:24 UTC	553	IN	HTTP/1.1 200 OK Connection: close Content-Length: 53044 Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT ETag: "623de86a-cf34" Expires: Thu, 16 Nov 2023 08:05:33 GMT Cache-Control: max-age=86402 Access-Control-Allow-Origin: * Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Tue, 19 Dec 2023 09:22:24 GMT Age: 33609 X-Served-By: cache-lga13626-LGA, cache-pdk-kfty2130034-PDK X-Cache: HIT, HIT X-Cache-Hits: 6980, 91 X-Timer: S1702977745.613180,VS0,VE0 Vary: Accept-Encoding
2023-12-19 09:22:24 UTC	1371	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 6e 29 7b 69 66 28 65 5b 6e 5d 29 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 69 3d 65 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 69 2c 69 2e 65 78 70 6f 72 74 73 2c 61 29 2c 69 2e 6c 3d 21 30 2c 69 2e 65 78 70 6f 72 74 73 7d 61 2e 6d 3d 74 2c 61 2e 63 3d 65 2c 61 2e 64 3d 66 75 6e 63 74 69 6f Data Ascii: <!DOCTYPE html><html><head></head><body><script type="text/javascript">!function(t){var e={};function a(n){if(e[n])return e[n].exports;var i=e[n]={i:n,l:!1,exports:{}};return t[n].call(i.exports,i,i.exports,a),i.l=!0,i.exports}a.m=t,a.c=e,a.d=functio
2023-12-19 09:22:24 UTC	1371	IN	Data Raw: 6e 20 61 29 69 28 61 2c 6e 29 26 26 28 74 5b 6e 5d 3d 61 5b 6e 5d 29 7d 7d 72 65 74 75 72 6e 20 74 7d 2c 65 2e 73 68 72 69 6e 6b 42 75 66 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 2e 6c 65 6e 67 74 68 3d 3d 3d 65 3f 74 3a 74 2e 73 75 62 61 72 72 61 79 3f 74 2e 73 75 62 61 72 72 61 79 28 30 2c 65 29 3a 28 74 2e 6c 65 6e 67 74 68 3d 65 2c 74 29 7d 3b 76 61 72 20 72 3d 7b 61 72 72 61 79 53 65 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 61 2c 6e 2c 69 29 7b 69 66 28 65 2e 73 75 62 61 72 72 61 79 26 26 74 2e 73 75 62 61 72 72 61 79 29 74 2e 73 65 74 28 65 2e 73 75 62 61 72 72 61 79 28 61 2c 61 2b 6e 29 2c 69 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 6e 3b 72 2b 2b 29 74 5b 69 2b 72 5d 3d 65 5b 61 2b 72 5d 7d 2c Data Ascii: n a)i(a,n)&&(t[n]=a[n])}}return t},e.shrinkBuf=function(t,e){return t.length===e?t:t.subarray?t.subarray(0,e):(t.length=e,t)};var r={arraySet:function(t,e,a,n,i){if(e.subarray&&t.subarray)t.set(e.subarray(a,a+n),i);else for(var r=0;r<n;r++)t[i+r]=e[a+r]},
2023-12-19 09:22:24 UTC	1371	IN	Data Raw: 22 6f 6e 22 2b 74 2c 65 29 7d 2c 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 21 74 7c 7c 21 74 2e 70 75 72 70 6f 73 65 7c 7c 21 74 2e 70 75 72 70 6f 73 65 2e 63 6f 6e 73 65 6e 74 73 7c 7c 21 30 3d 3d 3d 74 2e 70 75 72 70 6f 73 65 2e 63 6f 6e 73 65 6e 74 73 5b 31 5d 7d 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2e 64 61 74 61 3b 74 72 79 7b 65 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 65 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 61 3d 65 2e 5f 5f 63 6d 70 52 65 74 75 72 6e 7c 7c 65 2e 5f 5f 74 63 66 61 70 69 52 65 74 75 72 6e 3b 61 26 26 28 22 67 65 74 43 6f 6e 73 65 6e 74 44 61 74 61 22 3d 3d 3d 61 2e 63 6f 6d 6d 61 6e 64 26 26 61 2e 72 65 74 75 72 6e 56 61 6c 75 65 3f 68 28 61 2e 63 61 6c 6c 49 64 2c 61 2e 72 65 74 Data Ascii: "on"+t,e)},o=function(t){return!t\|\|!t.purpose\|\|!t.purpose.consents\|\|!0===t.purpose.consents[1]},l=function(t){var e=t.data;try{e=JSON.parse(e)}catch(t){}var a=e.__cmpReturn\|\|e.__tcfapiReturn;a&&("getConsentData"===a.command&&a.returnValue?h(a.callId,a.ret
2023-12-19 09:22:24 UTC	1371	IN	Data Raw: 33 3a 61 3b 64 6f 7b 72 3d 72 2b 28 69 3d 69 2b 65 5b 6e 2b 2b 5d 7c 30 29 7c 30 7d 77 68 69 6c 65 28 2d 2d 73 29 3b 69 25 3d 36 35 35 32 31 2c 72 25 3d 36 35 35 32 31 7d 72 65 74 75 72 6e 20 69 7c 72 3c 3c 31 36 7c 30 7d 7d 2c 32 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 61 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 2c 65 3d 5b 5d 2c 61 3d 30 3b 61 3c 32 35 36 3b 61 2b 2b 29 7b 74 3d 61 3b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 38 3b 6e 2b 2b 29 74 3d 31 26 74 3f 33 39 38 38 32 39 32 33 38 34 5e 74 3e 3e 3e 31 3a 74 3e 3e 3e 31 3b 65 5b 61 5d 3d 74 7d 72 65 74 75 72 6e 20 65 7d 28 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 61 2c 69 29 7b Data Ascii: 3:a;do{r=r+(i=i+e[n++]\|0)\|0}while(--s);i%=65521,r%=65521}return i\|r<<16\|0}},20:function(t,e,a){"use strict";var n=function(){for(var t,e=[],a=0;a<256;a++){t=a;for(var n=0;n<8;n++)t=1&t?3988292384^t>>>1:t>>>1;e[a]=t}return e}();t.exports=function(t,e,a,i){
2023-12-19 09:22:24 UTC	1371	IN	Data Raw: 75 72 6e 20 65 7d 2c 65 2e 62 75 66 32 62 69 6e 73 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6c 28 74 2c 74 2e 6c 65 6e 67 74 68 29 7d 2c 65 2e 62 69 6e 73 74 72 69 6e 67 32 62 75 66 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 65 77 20 6e 2e 42 75 66 38 28 74 2e 6c 65 6e 67 74 68 29 2c 61 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 61 3c 69 3b 61 2b 2b 29 65 5b 61 5d 3d 74 2e 63 68 61 72 43 6f 64 65 41 74 28 61 29 3b 72 65 74 75 72 6e 20 65 7d 2c 65 2e 62 75 66 32 73 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 61 2c 6e 2c 69 2c 72 2c 6f 3d 65 7c 7c 74 2e 6c 65 6e 67 74 68 2c 68 3d 6e 65 77 20 41 72 72 61 79 28 32 2a 6f 29 3b 66 6f 72 28 6e 3d 30 2c 61 3d 30 3b 61 3c 6f Data Ascii: urn e},e.buf2binstring=function(t){return l(t,t.length)},e.binstring2buf=function(t){for(var e=new n.Buf8(t.length),a=0,i=e.length;a<i;a++)e[a]=t.charCodeAt(a);return e},e.buf2string=function(t,e){var a,n,i,r,o=e\|\|t.length,h=new Array(2*o);for(n=0,a=0;a<o
2023-12-19 09:22:24 UTC	1371	IN	Data Raw: 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 6e 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 2c 61 3d 31 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 61 3c 6e 3b 61 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 65 3d 61 72 67 75 6d 65 6e 74 73 5b 61 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 69 29 26 26 28 74 5b 69 5d 3d 65 5b 69 5d 29 3b 72 65 74 75 72 6e 20 74 7d 29 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 3b 76 61 72 20 69 3d 61 28 33 37 29 2c 72 3d 28 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e Data Ascii: tion(){return(n=Object.assign\|\|function(t){for(var e,a=1,n=arguments.length;a<n;a++)for(var i in e=arguments[a])Object.prototype.hasOwnProperty.call(e,i)&&(t[i]=e[i]);return t}).apply(this,arguments)};e.__esModule=!0;var i=a(37),r=(window&&window.location
2023-12-19 09:22:24 UTC	1371	IN	Data Raw: 65 3d 6e 6f 6e 65 3b 73 65 63 75 72 65 3b 70 61 74 68 3d 22 2b 69 2b 72 7d 2c 74 68 69 73 2e 77 72 69 74 65 50 69 78 65 6c 4d 61 70 54 6f 43 6f 6f 6b 69 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 2e 70 69 78 65 6c 4d 61 70 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 61 3d 65 2e 70 69 78 65 6c 4d 61 70 5b 74 5d 2c 6e 3d 61 2e 69 64 2c 69 3d 61 2e 73 79 6e 63 5f 63 6f 6d 70 6c 65 74 65 3b 72 65 74 75 72 6e 7b 69 64 3a 6e 2c 73 79 6e 63 5f 73 74 61 72 74 3a 61 2e 73 79 6e 63 5f 73 74 61 72 74 2c 73 79 6e 63 5f 63 6f 6d 70 6c 65 74 65 3a 69 7d 7d 29 2c 61 3d 69 2e 65 6e 63 6f 64 65 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 7b 76 65 72 73 69 6f 6e 3a 73 2c 70 69 78 65 6c 73 3a 74 Data Ascii: e=none;secure;path="+i+r},this.writePixelMapToCookie=function(){var t=Object.keys(e.pixelMap).map(function(t){var a=e.pixelMap[t],n=a.id,i=a.sync_complete;return{id:n,sync_start:a.sync_start,sync_complete:i}}),a=i.encode(JSON.stringify({version:s,pixels:t
2023-12-19 09:22:24 UTC	1371	IN	Data Raw: 2e 66 69 72 73 74 43 68 69 6c 64 29 7d 2c 74 68 69 73 2e 70 72 6f 63 65 73 73 50 69 78 65 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3b 74 3d 65 2e 70 69 78 65 6c 51 75 65 75 65 2e 73 68 69 66 74 28 29 3b 29 7b 76 61 72 20 61 3d 74 2e 69 64 3b 65 2e 70 69 78 65 6c 52 65 71 75 65 73 74 4d 61 70 5b 61 5d 7c 7c 28 65 2e 70 69 78 65 6c 52 65 71 75 65 73 74 4d 61 70 5b 61 5d 3d 74 2c 65 2e 6c 6f 61 64 50 69 78 65 6c 28 74 29 29 7d 7d 2c 74 68 69 73 2e 69 6d 70 62 75 73 55 72 6c 3d 74 7c 7c 64 2c 74 68 69 73 2e 70 69 78 65 6c 51 75 65 75 65 3d 5b 5d 2c 74 68 69 73 2e 70 69 78 65 6c 52 65 71 75 65 73 74 4d 61 70 3d 7b 7d 2c 74 68 69 73 2e 70 69 78 65 6c 4d 61 70 3d 74 68 69 73 2e 72 65 61 64 50 69 78 65 6c 4d 61 70 46 72 6f 6d 43 6f 6f Data Ascii: .firstChild)},this.processPixels=function(){for(var t;t=e.pixelQueue.shift();){var a=t.id;e.pixelRequestMap[a]\|\|(e.pixelRequestMap[a]=t,e.loadPixel(t))}},this.impbusUrl=t\|\|d,this.pixelQueue=[],this.pixelRequestMap={},this.pixelMap=this.readPixelMapFromCoo
2023-12-19 09:22:24 UTC	1371	IN	Data Raw: 29 3e 3e 38 29 2c 65 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 32 35 35 26 61 29 29 2c 65 7d 7d 2c 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 61 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3b 66 6f 72 28 74 3d 53 74 72 69 6e 67 28 74 29 2c 65 3d 30 3b 65 3c 74 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 69 66 28 74 2e 63 68 61 72 43 6f 64 65 41 74 28 65 29 3e 32 35 35 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 61 3d 22 22 3b 66 6f 72 28 65 3d 30 3b 65 3c 74 2e 6c 65 6e 67 74 68 3b 65 2b 3d 33 29 7b 76 61 72 20 6e 3d 5b 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 5d 3b 6e 5b 30 5d 3d 74 2e 63 68 61 72 43 6f 64 Data Ascii: )>>8),e+=String.fromCharCode(255&a)),e}},40:function(t,e,a){"use strict";t.exports=function(t){var e;for(t=String(t),e=0;e<t.length;e++)if(t.charCodeAt(e)>255)return null;var a="";for(e=0;e<t.length;e+=3){var n=[void 0,void 0,void 0,void 0];n[0]=t.charCod
2023-12-19 09:22:24 UTC	1371	IN	Data Raw: 65 77 20 45 72 72 6f 72 28 73 5b 61 5d 29 3b 69 66 28 65 2e 68 65 61 64 65 72 26 26 6e 2e 64 65 66 6c 61 74 65 53 65 74 48 65 61 64 65 72 28 74 68 69 73 2e 73 74 72 6d 2c 65 2e 68 65 61 64 65 72 29 2c 65 2e 64 69 63 74 69 6f 6e 61 72 79 29 7b 76 61 72 20 5f 3b 69 66 28 5f 3d 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 69 63 74 69 6f 6e 61 72 79 3f 72 2e 73 74 72 69 6e 67 32 62 75 66 28 65 2e 64 69 63 74 69 6f 6e 61 72 79 29 3a 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 42 75 66 66 65 72 5d 22 3d 3d 3d 6c 2e 63 61 6c 6c 28 65 2e 64 69 63 74 69 6f 6e 61 72 79 29 3f 6e 65 77 20 55 69 6e 74 38 41 72 72 61 79 28 65 2e 64 69 63 74 69 6f 6e 61 72 79 29 3a 65 2e 64 69 63 74 69 6f 6e 61 72 79 2c 28 61 3d 6e 2e 64 65 66 6c 61 74 65 53 65 74 44 69 63 Data Ascii: ew Error(s[a]);if(e.header&&n.deflateSetHeader(this.strm,e.header),e.dictionary){var _;if(_="string"==typeof e.dictionary?r.string2buf(e.dictionary):"[object ArrayBuffer]"===l.call(e.dictionary)?new Uint8Array(e.dictionary):e.dictionary,(a=n.deflateSetDic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.16	49880	35.163.115.57	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:24 UTC	779	OUT	GET /visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:24 UTC	525	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:24 UTC	6150	IN	Data Raw: 31 37 66 65 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 6d 67 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 2e 61 64 6e 78 73 2e 63 6f 6d 2f 67 65 74 75 69 64 3f 68 74 74 70 73 25 33 41 25 32 46 25 32 46 76 69 73 69 74 6f 72 2d 75 73 2d 77 65 73 74 2d 32 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 25 32 46 76 69 73 69 74 6f 72 25 32 46 73 79 6e 63 25 33 46 6e 61 6d 65 25 33 44 58 61 6e 64 72 25 32 42 25 32 35 45 32 25 32 35 38 30 25 32 35 39 33 25 32 42 49 6e 76 65 73 74 25 32 42 44 53 50 25 32 36 74 74 6c 25 33 44 37 32 30 25 32 36 75 69 64 25 33 44 34 38 64 35 37 31 33 64 35 63 35 36 33 63 Data Ascii: 17fe<html><head><title></title></head><body><img style="display:none;" src="https://secure.adnxs.com/getuid?https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DXandr%2B%25E2%2580%2593%2BInvest%2BDSP%26ttl%3D720%26uid%3D48d5713d5c563c
2023-12-19 09:22:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.16	49884	162.55.236.225	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:24 UTC	740	OUT	GET /dcf3528a0b8aa83634892d50e91c306e/?ord=3082303562 HTTP/1.1 Host: sync.richaudience.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:25 UTC	543	IN	HTTP/1.1 302 Found Server: nginx/1.14.1 Date: Tue, 19 Dec 2023 09:22:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.2.4 P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: pdid=64f4bbfb-8ac7-4d56-b41c-1zz1702977725; expires=Thu, 18 Jan 2024 09:22:05 GMT; Max-Age=2592000; path=/; domain=.richaudience.com; secure; HttpOnly; SameSite=None Location: https://sync.richaudience.com/dcf3528a0b8aa83634892d50e91c306e/?ord=3082303562&rd=1
2023-12-19 09:22:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.16	49889	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:24 UTC	950	OUT	GET /v3/pr?exlist=gg_n-index_n-onetag_pm-db5_rbd_rx_ox-db5_smrt_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0 HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-onetag_pm-db5_rbd_rx_ox-db5_smrt_sovrn_3lift&dcc=t Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:25 UTC	452	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:25 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2624 Connection: close x-amz-rid: B2MJARHQQCE2YAZ2AVXG Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:25 UTC	2624	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 38 36 36 61 61 34 37 65 2d 64 66 37 39 2d 34 31 66 65 2d 61 64 66 32 2d 36 61 33 31 34 30 34 61 38 38 36 64 22 3e 20 62 6f 64 79 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 20 7d 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 69 66 72 61 6d 65 20 77 69 64 74 68 3d 22 31 22 20 68 65 69 67 68 74 3d 22 31 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 73 Data Ascii: <html><head><meta name="referrer" content="no-referrer" /><style nonce="866aa47e-df79-41fe-adf2-6a31404a886d"> body { background-color:transparent } </style></head><body><iframe width="1" height="1" frameborder="0" marginwidth="0" marginheight="0" s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.16	49882	104.18.38.76	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:25 UTC	704	OUT	GET /um/ixmatch.html HTTP/1.1 Host: js-sec.indexww.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:25 UTC	442	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 25 Jul 2022 19:18:19 GMT P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" CF-Cache-Status: HIT Age: 348 Expires: Tue, 19 Dec 2023 13:22:25 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 837e94bc7c144982-MIA
2023-12-19 09:22:25 UTC	927	IN	Data Raw: 62 36 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 6e 29 7b 69 66 28 65 5b 6e 5d 29 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 69 3d 65 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 69 2c 69 2e 65 78 70 6f 72 74 73 2c 72 29 2c 69 2e 6c 3d 21 30 2c 69 2e 65 78 70 6f 72 74 73 7d 72 2e 6d 3d 74 2c 72 2e 63 3d 65 2c 72 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 72 2e 6f 28 74 2c 65 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 Data Ascii: b68<!doctype html><head></head><body><script>!function(t){var e={};function r(n){if(e[n])return e[n].exports;var i=e[n]={i:n,l:!1,exports:{}};return t[n].call(i.exports,i,i.exports,r),i.l=!0,i.exports}r.m=t,r.c=e,r.d=function(t,e,n){r.o(t,e)\|\|Object.def
2023-12-19 09:22:25 UTC	1369	IN	Data Raw: 74 79 2e 63 61 6c 6c 28 74 2c 65 29 7d 2c 72 2e 70 3d 22 22 2c 72 28 72 2e 73 3d 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 6c 65 74 20 72 3d 21 31 3b 63 6f 6e 73 74 20 6e 3d 7b 7d 3b 6c 65 74 20 69 2c 61 2c 6f 2c 63 3b 63 6f 6e 73 74 20 75 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 73 28 74 29 7b 6c 65 74 20 65 2c 72 2c 6e 3d 77 69 6e 64 6f 77 2c 69 3d 22 54 43 46 22 3d 3d 3d 74 3f 22 5f 5f 74 63 66 61 70 69 22 3a 22 5f 5f 75 73 70 61 70 69 22 2c 61 3d 22 54 43 46 22 3d 3d 3d 74 3f 22 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 22 3a 22 5f 5f 75 73 70 61 70 69 4c 6f 63 61 74 6f 72 22 3b 66 6f 72 28 3b 6e 3b 29 7b 74 72 79 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 5b 69 5d 29 7b 72 3d 6e 5b 69 5d 2c 65 3d 6e 3b 62 Data Ascii: ty.call(t,e)},r.p="",r(r.s=0)}([function(t,e){let r=!1;const n={};let i,a,o,c;const u={};function s(t){let e,r,n=window,i="TCF"===t?"__tcfapi":"__uspapi",a="TCF"===t?"__tcfapiLocator":"__uspapiLocator";for(;n;){try{if("function"==typeof n[i]){r=n[i],e=n;b
2023-12-19 09:22:25 UTC	631	IN	Data Raw: 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 74 79 6c 65 22 2c 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 29 2c 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 77 69 64 74 68 22 2c 22 30 22 29 2c 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 68 65 69 67 68 74 22 2c 22 30 22 29 2c 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 66 72 61 6d 65 62 6f 72 64 65 72 22 2c 22 30 22 29 2c 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6d 61 72 67 69 6e 68 65 69 67 68 74 22 2c 22 30 22 29 2c 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6d 61 72 67 69 6e 77 69 64 74 68 22 2c 22 30 22 29 2c 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 63 72 6f 6c 6c 69 6e 67 22 2c 22 6e 6f 22 29 2c 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 74 29 2c Data Ascii: setAttribute("style","display:none;"),i.setAttribute("width","0"),i.setAttribute("height","0"),i.setAttribute("frameborder","0"),i.setAttribute("marginheight","0"),i.setAttribute("marginwidth","0"),i.setAttribute("scrolling","no"),i.setAttribute("src",t),
2023-12-19 09:22:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.16	49891	172.217.3.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:25 UTC	1381	OUT	GET /pcs/view?xai=AKAOjsvsnASaC-WJAIa4dpNXbOvXaR38eH0MKD_V9HkpTl6-s_-pDi3imX72Ebc7M0YMLhO-Gt6TgrmeI_y6FRgvLts71CCwjQdNCPi_JzhjEKx3R3NFG6JXOwo_ztqWoIB8dUGYclD8cBewvoMxTtPSN7iNh9czNErlmOiFZ3dwqoOjV0pK8OCfnuKWN20iPkagjhvh5WLeJ6M_pr1394pye0FydAvERYxr5odc9q8V5aaijS7js6WUUmu4EuQFq7rbQ_4RPozZGl5L_8f7UoD1bcCkiZJB3hMzZPX9VO73DI_EFdLKTFjwM6xNVc9qCKjjrtii0-xOHQmm2wzHOzXh4kXq171XED75KDcOKC7MJ3w-1esSTf_9XgdG_DMss325kRzeJ6VZd3xbqOCRsx9ozcg3nSdIeqVNu0MEWIX_akJcC-1eBJj4Rjj87rBfhZm-CuirSeSi&sai=AMfl-YRPPcLfgAnLmu-HcYTh435wxVnqQ27PveSaL0rmf2EjfGRfHnkQE_aMED0KZPVWzGtQFMqfzXpnK1hr0EB9TAGF2AM14mLbvU2rs_GyMgtqSZk_Vn9o_13x7K1XCw&sig=Cg0ArKJSzPbmLxxj6AvAEAE&uach_m=%5BUACH%5D&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:25 UTC	792	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:25 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.16	49892	142.250.189.130	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:25 UTC	2033	OUT	GET /td/auctionwinner?status=nowinner&isContextualWinner=1&hasXfpAds=1&winner_qid=CK2u3ruWm4MDFdDuKAUd1xQP4Q&xfpQid=CJfE3LuWm4MDFdDuKAUd1xQP4Q&ecrs=Aee5mYxVJddiSWZUyZvUNnyzFJssqB0FMy1xuqU_IoKd8B-2kGoovgTv1Bf5FR-amt9i6XuXjpVDsrC3ePcjt3uAOuAd2WmzA-buF5xEbepZfWT3AZKsMni53n6aDGBL5uEMqogy1Mh6JqHAykKy-HTGpr5wkEhhjLotHuLl--kOF5i5F1zjv1vwb1nrZAMt5YPVcOPhe07ZKqzKRj4BJwHi2hLLyplVG1EgEYsz5FuDiHQxyMHk6-507Q_Mtu_JyW8W3EPVQ9Y3Bz7IgZmoXP5_WDkqGRYjr3-kVswfEbxYPt0eS2FyTX1_rY-OoEOasMd57Laplw7XGDel8_tqEO5PkC-DGtOQ41ZpAnejagkGb5r2Dz34n3DlsdIKHxaNDFDgmMT0PRto3VT4BecT-ge5bvGEQXgoB-tnToqmowTznbUqja8Y9f9Lm8UF8sIu1PiwDnQq1rOv3eY3-LlhyET_niBC_xHv4NTQpAB8ZmYbXBlqgIffcI2ENeI9o7fe3CQkXHDsDxrfw96QN7VyNFkEnCkkNGr1htlCuigOwGrr_iH2todoygc_gQDlyO5khUqwTUMWJjvfUgEKx_KB4g4W46lMA5rwyJGTLex3bEVEqm0VSgyspm6Y-jz2MC7o3m6X3sq3r4XSG6jz5hmSJbD_dCwlw_ht2_wOIGVAngZDcAIf_sfy0cUjJzhmOXG5APMLHG9eJLFsHZ0QQCFi44OfRovd4dhEfVnS5ZSogmlOKpE9AlIbntr4-V0hHh78QqlC7YGN-Z0halzGYGdkAtt7HUQT3NXMja-IBsIYGJnDMc5b22w-h6AdMqJAjZrw5moZKg0q_-SZxpyzuKM_oJF2xpFxf852pdu-eURICJoVC_8YEIngXcjPDNH_ToyO7eY_ynEyweJ_HGrjCxGmlw-al5leY_YC5nY6mcd2BbtV47dPwjSQqxo7iRL6sVDX6EX_t2mrFOyBKbRFaGMb0U5ah5gNQ1wOine6k89s1j1wcUoL2IYiMTDN_8l1z7ajLDRZ8jqIrFQvZkOwi56lXw&cid=CAQSOwAvHhf_trxtd5X6ykyKo_UFREQYOgbuBeLqQudwTTX-y5kH5rDfx0tVDY-ID5fQKwdgHu5nCrLJl60oGAE&applied_timeout_ms=0&duration_ms=6 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:25 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:25 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.16	49879	63.251.86.49	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:25 UTC	768	OUT	GET /beacon?us_privacy=1---&informer=13461259 HTTP/1.1 Host: ap.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6
2023-12-19 09:22:25 UTC	145	IN	HTTP/1.1 301 Moved Permanently Content-length: 0 Location: https://ce.lijit.com/beacon?us_privacy=1---&informer=13461259 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.16	49896	172.217.3.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:25 UTC	1392	OUT	GET /pcs/view?xai=AKAOjsuBo2OGG1kJXBWi--r68AbKF--cLAMouyohqXwjwBhkHR4kG1Cb2WgB5PLvD-OfKuN6SAX0bSdcs-8Tnk2D-WPP5lqoYT4G8faTdX9aCokMdvZMtFKcGzW9QlYdwh1d__3W-pHSYME8rdFxA8wfBNJdm_H1YOZ476dR5asV8ll4Pu_aLWm6sp-8QFGyDYh57kE46dYBjbgPafvDC0LFTQck-KE6t9IfGvdFa2X1mQyzfCbWvuUZdcJ5yrdmAjRCdcvlWkJOE6yKJNkESS2i7Saetk3Fsmh8JJH4ClBThvijAPUVVp0gPs-TRu175BQ7GUho0HuH09q_D_ZWyGdB8d_7b5Dg0VdjBrJ-cg2CU2laNQldh60WZXhqfYpdws3Bdb4hTQGSB_JlUqE-2lgCcl1ZstMfZki2tGOt-QM_bf-2-sg-tGY3RGrUClicJ7GtFkjczZv0dDBPpSm-pf4&sai=AMfl-YS4BAe5YTqjEGJxf8MDUyACDwFtzRMzflTyVfNMZ2khzVS5W5V6WEv6mjKBvO8v7p4DyNfZ63qwpAc6OtjjcfbYACcPNdnIEhL12R32MMue5_FHUqdknHoydawIoA&sig=Cg0ArKJSzO8YgrMzDerzEAE&uach_m=%5BUACH%5D&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:25 UTC	792	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:25 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.16	49895	142.250.189.130	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:25 UTC	2039	OUT	GET /td/auctionwinner?status=nowinner&isContextualWinner=1&hasXfpAds=1&winner_qid=CK-u3ruWm4MDFdDuKAUd1xQP4Q&xfpQid=CJnE3LuWm4MDFdDuKAUd1xQP4Q&ecrs=Aee5mYxb7JdvCRsYbAlCMN4aqdWvjGE71UFLNEb6N2gD11oqzGXW2W-TjHHZ-SS3GqbfSF_-rMBxaj_SUmk0e03TwnyCx_ro4GTe095EBojydfOrF97VUt9A_iPo_66zhPXUTLOc8QJ0CvaB1JbtfcfS36RLaNea_4VZa6dQhiVIqfVLg8noSruVT0GcdLNJeb9jeB_nRHMcq5HU9YPG3k9mzCSYxA1smzt7ZCyNYN3pS0_NIVOB00mGn2b8E8nXAhVoKnbg-x06oCBpAR66rP578CtqIwS3WIi08Mu9lWE-zrnKMg2rs9regM2NNSkISrh-2tv3M3oa2bXhVwJ2mYs5UTGZostoy9PQlkQ5oA3fDfl0tLiYKH_EEuQe91lFrb8dQ9HzaJL6XL4m41WVN7Eu1OizUyMy4tL5qWcbYSHLyR5_AOpNoR6QMbzoi3xpxPdDgsMJdkM4zBDdu34OqFCT9_pV8ejuPHM32JiDsjobR1iCroIyrAcmQLeLpoU3H9d5SkBTGKjGyeJ_1hA6ixWtD7tKoWARjXf0UG6LABQGvAOpY_Bqm7Evq5UsjMwneTP_OKQw23Z221Bp22XgnTSH1GrOeDmaRys-IK93XwnDpkMcr06mNGoH51dEDcCtRRL2xZr68nqnFkvMMPA21f3Iq1Ecmhce2yKDH0KJc-727kQPtZz49kwKV8HC0IsQSMvAOVRTNW0lNM5ZahQv2wSDYzvtJgvQg7HyyAewfjo-cNoBlNdcpsgggmx5_VqC2rjx59gGmjzgOoiPKpgbDAi_8dLo8x0K6g38VgVGHmDTevFouGuh6CMe8e0CJUys6v0xAVr8pIHRZj5gQnl-iCiYcb0DmyQVCm7GeDhMhYsrSaa4-OabY2gVdl87EDvnWQcKePwFvAnVKSjdxgAAbvOZXiCSTKf_8xE_UMwbRcx6AYZKibhR05FWzXvnzns20dho6XNe9VFIKzxceCvKJkipi4X9E32-_GlG6ypKV1SVgmc0IZpix726YG9IfDFz9bZqscuDjPQkBStUpMpgE61DAXg&cid=CAQSOwAvHhf_trxtd5X6ykyKo_UFREQYOgbuBeLqQudwTTX-y5kH5rDfx0tVDY-ID5fQKwdgHu5nCrLJl60oGAE&applied_timeout_ms=0&duration_ms=30 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:25 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:25 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.16	49901	162.55.236.225	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:26 UTC	797	OUT	GET /dcf3528a0b8aa83634892d50e91c306e/?ord=3082303562&rd=1 HTTP/1.1 Host: sync.richaudience.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pdid=64f4bbfb-8ac7-4d56-b41c-1zz1702977725
2023-12-19 09:22:27 UTC	405	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Tue, 19 Dec 2023 09:22:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.2.4 P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: raibs=1; expires=Tue, 19 Dec 2023 09:22:16 GMT; Max-Age=10; path=/; domain=.richaudience.com; secure; HttpOnly; SameSite=None
2023-12-19 09:22:27 UTC	1734	IN	Data Raw: 36 62 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 73 63 72 69 70 74 3e 0a 09 09 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 53 79 6e 63 50 69 78 65 6c 28 70 69 78 65 6c 55 72 6c 29 7b 0a 09 09 09 76 61 72 20 61 76 49 6d 67 53 79 6e 63 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 69 6d 67 27 29 3b 0a 09 09 09 61 76 49 6d 67 53 79 6e 63 2e 77 69 64 74 68 20 3d 20 22 31 22 3b 0a 09 09 09 61 76 49 6d 67 53 79 6e Data Ascii: 6ba<!DOCTYPE html><html lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><script>function loadSyncPixel(pixelUrl){var avImgSync = document.createElement('img');avImgSync.width = "1";avImgSyn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.16	49905	74.119.119.150	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	805	OUT	GET /dis/usersync.aspx?r=70&p=120&cp=adyoulike&cu=1&url=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fis_cookie_sync_uid%3Dtrue%26uid%3D4246a50e6cf42e85f26c381a4b7701fb%26name%3DCRITEO%26visitor%3D%40%40CRITEO_USERID%40%40 HTTP/1.1 Host: dis.criteo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	441	IN	HTTP/1.1 200 OK content-type: image/gif date: Tue, 19 Dec 2023 09:22:27 GMT server: Kestrel cache-control: no-cache expires: Tue, 19 Dec 2023 00:00:00 GMT pragma: no-cache transfer-encoding: chunked x-errorlevel: 0 p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" cross-origin-resource-policy: cross-origin server-processing-duration-in-ticks: 439585 strict-transport-security: max-age=31536000; preload; connection: close
2023-12-19 09:22:27 UTC	54	IN	Data Raw: 32 42 0d 0a 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2BGIF89a!,D;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.16	49915	65.8.178.13	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	636	OUT	GET /pixels/ayl_pixel?ayl_id=da2e1841566f4d1e6fa4fa9cd4b48a08 HTTP/1.1 Host: api-2-0.spot.im Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	641	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 19 Dec 2023 09:22:27 GMT X-Cache: Miss from cloudfront Via: 1.1 64924074212560e583e5c4823e606c04.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: G1QffSDU3YX2C_bzM2GTQgQWHN0id8dKlG6eXxNchyJbeQyeVodKqA== Content-Security-Policy: default-src 'none'; img-src 'self'; script-src-elem connect.facebook.net; style-src-elem 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-attr 'unsafe-inline'; report-uri https://o294277.ingest.sentry.io/api/4505425533272064/security/?sentry_key=f16f012f16c94b179d820f4d5e9c39ff Strict-Transport-Security: max-age=31536000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.16	49923	63.251.86.49	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	778	OUT	GET /beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0 HTTP/1.1 Host: ap.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6
2023-12-19 09:22:27 UTC	199	IN	HTTP/1.1 301 Moved Permanently Content-length: 0 Location: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.16	49919	8.28.7.81	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	673	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=50010433&p=159047&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	903	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=1; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=159047:2; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1704153600%3A201_263%7C1703030400%3A248%7C1703548800%3A265; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: SyncRTB3=1704153600%3A54_250_71_220_21_13_166_104%7C1703548800%3A223_15; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:26 GMT Transfer-Encoding: chunked Connection: close
2023-12-19 09:22:27 UTC	2416	IN	Data Raw: 39 36 34 0d 0a 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 63 6d 2e 67 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 70 69 78 65 6c 3f 67 6f 6f 67 6c 65 5f 6e 69 64 3d 70 6d 65 62 26 67 6f 6f 67 6c 65 5f 73 63 3d 31 26 67 6f 6f 67 6c 65 5f 68 6d 3d 58 63 4e 59 4f 66 33 34 54 4f 69 6e 58 41 58 41 54 75 71 72 66 77 25 33 44 25 33 44 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 74 61 70 61 64 2e 63 6f 6d 2f 69 64 73 79 6e 63 2f 65 78 2f 72 65 63 65 69 76 65 3f 70 61 72 74 6e 65 72 5f 69 64 3d 33 33 37 31 26 70 61 72 74 6e 65 72 Data Ascii: 964PubMatic.loadAsyncImagePixel('https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=XcNYOf34TOinXAXATuqrfw%3D%3D&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.16	49904	68.67.181.211	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	820	OUT	GET /getuid?https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DXandr%2B%25E2%2580%2593%2BInvest%2BDSP%26ttl%3D720%26uid%3D48d5713d5c563cba2049f505b2d944b6%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	1283	IN	HTTP/1.1 307 Redirection Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fvisitor-us-west-2.omnitagjs.com%252Fvisitor%252Fsync%253Fname%253DXandr%252B%2525E2%252580%252593%252BInvest%252BDSP%2526ttl%253D720%2526uid%253D48d5713d5c563cba2049f505b2d944b6%2526visitor%253D%2524UID%2526gdpr%253D0%2526gdpr_consent%253D%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: 225cdd3d-7bf1-4245-87df-8d9725f143eb Set-Cookie: uuid2=2580459956406394370; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:27 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.16	49926	35.244.159.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	823	OUT	GET /w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0 HTTP/1.1 Host: u.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	629	IN	HTTP/1.1 302 Found Set-Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; Version=1; Expires=Wed, 18-Dec-2024 09:22:27 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None Server: OXGW/0.0.0 P3P: CP="CUR ADM OUR NOR STA NID" Location: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0 Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.16	49903	68.67.181.211	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	833	OUT	GET /getuid?https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DXandr%2B%25E2%2580%2593%2BInvest%2BDSP%2B-%2BBanner%26ttl%3D720%26uid%3D75d56568a11564bfb79a01d2fa9fdb29%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	1300	IN	HTTP/1.1 307 Redirection Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fvisitor-us-west-2.omnitagjs.com%252Fvisitor%252Fsync%253Fname%253DXandr%252B%2525E2%252580%252593%252BInvest%252BDSP%252B-%252BBanner%2526ttl%253D720%2526uid%253D75d56568a11564bfb79a01d2fa9fdb29%2526visitor%253D%2524UID%2526gdpr%253D0%2526gdpr_consent%253D%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: 53eb9f43-ebea-4560-b7d7-a68e0c012d79 Set-Cookie: uuid2=1479236160778221245; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:27 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.16	49908	185.184.8.90	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	623	OUT	GET /cm-notify?pi=adyoulike&gdpr=0&gdpr_consent= HTTP/1.1 Host: creativecdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	742	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:27 GMT vary: Accept-Encoding set-cookie: u=5daBKxwFecmtxHnQb9Qq;Path=/;Domain=.creativecdn.com;Expires=Wed, 18-Dec-2024 09:22:27 GMT;Max-Age=31536000;Secure;SameSite=None set-cookie: g=5daBKxwFecmtxHnQb9Qq_1702977747631;Path=/;Domain=.creativecdn.com;Expires=Wed, 18-Dec-2024 09:22:27 GMT;Max-Age=31536000;Secure;SameSite=None set-cookie: ts=1702977747;Path=/;Domain=.creativecdn.com;Expires=Wed, 18-Dec-2024 09:22:27 GMT;Max-Age=31536000;Secure;SameSite=None;Partitioned expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" location: https://creativecdn.com/cm-notify?pi=adyoulike&gdpr=0&gdpr_consent=&tc=1 content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.16	49928	172.64.151.101	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	791	OUT	GET /usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0 HTTP/1.1 Host: ssum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1
2023-12-19 09:22:27 UTC	1210	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Length: 0 Connection: close Location: /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1 CF-Ray: 837e94c9fb3d8e02-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg05BR8MuggUMSNtG2uQAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:27 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPS=1526; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:27 GMT; Max-Age=7776000; Secure; SameSite=None Set-Cookie: CMPRO=1526; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:27 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lln7tm657tjiuUErRkfhV1pL0YKP1Ondt3ZkJxtPosIUKEA0G2JaUYot11D1ZjtfQiTCWAhXUSEY05iQwBN3jXjhJSXNPlW9EIcQ%2Fa0jaEPLjOcOy3pb8oPJ3EkItVItIRYIfrkQDvNqvw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.16	49921	68.67.161.208	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	540	OUT	GET /async_usersync?cbfn=queuePixels HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://acdn.adnxs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	945	IN	HTTP/1.1 307 Redirection Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels AN-X-Request-Uuid: 14bb13f6-3ff1-4191-a1b1-896001fd26a2 Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:27 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.16	49906	35.211.178.172	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	619	OUT	GET /sync?ssp=adyoulike&gdpr=0&gdpr_consent= HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	770	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: https://x.bidswitch.net/ul_cb/sync?ssp=adyoulike&gdpr=0&gdpr_consent= Set-Cookie: tuuid=23912205-517d-4062-a267-9c34b728c7c0; path=/; expires=Wed, 18-Dec-2024 09:22:27 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: c=1702977747; path=/; expires=Wed, 18-Dec-2024 09:22:27 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: tuuid_lu=1702977747; path=/; expires=Wed, 18-Dec-2024 09:22:27 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: c=1702977747; path=/; expires=Wed, 18-Dec-2024 09:22:27 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.16	49936	216.22.16.4	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	681	OUT	GET /api/sync?callerId=2&gdpr=0 HTTP/1.1 Host: ssbsync-us.smartadserver.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	348	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:26 GMT location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=6016766153027957348&gdpr=0&gdpr_consent= set-cookie: pid=6016766153027957348; expires=Sat, 18 Jan 2025 09:21:27 GMT; domain=smartadserver.com; path=/; samesite=None; secure; samesite=none connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.16	49934	67.202.105.21	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	939	OUT	GET /ps/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: ssc-cms.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	795	IN	HTTP/1.1 302 p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" set-cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632; Domain=.33across.com; Expires=Wed, 18-Dec-2024 09:22:27 GMT; Path=/; Secure; SameSite=None referrer-policy: unsafe-url pragma: no-cache cache-control: no-store, no-cache, must-revalidate expires: Thu, 01-Jan-70 00:00:01 GMT x-33x-status: 8340000C server: 33XP018 location: https://de.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= content-length: 0 date: Tue, 19 Dec 2023 09:22:27 GMT connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.16	49910	15.197.193.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	645	OUT	GET /track/cmf/generic?ttd_pid=k2j3gqp&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	500	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Length: 209 Connection: close server: Kestrel location: https://match.adsrvr.org/track/cmb/generic?ttd_pid=k2j3gqp&ttd_tpi=1&gdpr=0&gdpr_consent= set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:27 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAEYBSgCMgsIxOyx_tefwDwQBTgB; expires=Thu, 19 Dec 2024 09:22:27 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:27 UTC	209	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 74 63 68 2e 61 64 73 72 76 72 2e 6f 72 67 2f 74 72 61 63 6b 2f 63 6d 62 2f 67 65 6e 65 72 69 63 3f 74 74 64 5f 70 69 64 3d 6b 32 6a 33 67 71 70 26 74 74 64 5f 74 70 69 3d 31 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 68 74 74 70 73 3a 2f 2f 6d 61 74 63 68 2e 61 64 73 72 76 72 2e 6f 72 67 2f 74 72 61 63 6b 2f 63 6d 62 2f 67 65 6e 65 72 69 63 3f 74 74 64 5f 70 69 64 3d 6b 32 6a 33 67 71 70 26 74 74 64 5f 74 70 69 3d 31 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://match.adsrvr.org/track/cmb/generic?ttd_pid=k2j3gqp&ttd_tpi=1&gdpr=0&gdpr_consent=">https://match.adsrvr.org/track/cmb/generic?ttd_pid=k2j3gqp&ttd_tpi=1&gdpr=0&gdpr_consent=</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.16	49945	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	768	OUT	GET /beacon?us_privacy=1---&informer=13461259 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6
2023-12-19 09:22:27 UTC	800	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:27 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: ljtrtbexp=eJxdkLkRwEAIA3u52AEcv1vzuHePb0hQuOKR4FkV6%2BYg5QzRuNaeyARCMDbIFBQ4%2FLBYbvu5qi2FXLmVnDNJYOLgUdAPnqnABgz7Ep8A%2Byw78aY6dQcOuBGeViPP%2BwHHKUmA; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:27 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:27 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: text/html Vary: Accept-Encoding, User-Agent Content-Length: 4516 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:27 UTC	4516	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 0a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 73 6f 76 72 6e 20 42 65 61 63 6f 6e 20 28 32 33 20 53 65 6e 74 20 2f 20 2d 31 20 4d 61 78 29 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 69 6d 67 20 63 6c 61 73 73 3d 27 73 6f 76 72 6e 2d 62 65 61 63 6f 6e 2d 70 69 78 65 6c 27 20 73 74 79 6c 65 3d 27 77 69 64 74 68 3a 30 70 78 3b 20 68 65 69 67 68 74 3a 30 70 78 3b 27 20 77 69 64 74 68 3d 27 30 27 20 68 65 69 67 68 74 3d 27 30 27 20 73 72 63 3d 27 68 74 74 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""https://www.w3.org/TR/html4/strict.dtd"><html><head><title>sovrn Beacon (23 Sent / -1 Max)</title></head><body><img class='sovrn-beacon-pixel' style='width:0px; height:0px;' width='0' height='0' src='htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.16	49949	52.72.45.103	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	830	OUT	GET /server_match?partner_id=2048&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsync.richaudience.com%2F056f32ee5cf49404607e368bd8d3f2af%2F%3Fgdpr%3D0%26euconsent%3D%26uid%3D%7BPUB_USER_ID%7D HTTP/1.1 Host: ad.360yield.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=9f860467-d79c-45d4-bcf9-51ad3d856e68; tuuid_lu=1702977740
2023-12-19 09:22:27 UTC	369	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Type: text/plain Content-Length: 0 Connection: close access-control-allow-origin: * p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" location: https://sync.richaudience.com/056f32ee5cf49404607e368bd8d3f2af/?gdpr=0&euconsent=&uid=9f860467-d79c-45d4-bcf9-51ad3d856e68

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.16	49909	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	598	OUT	GET /cookie-sync/aul HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	368	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:27 GMT location: https://match.prod.bidr.io/cookie-sync/aul?_bee_ppp=1 Server: gunicorn set-cookie: checkForPermission=ok; Domain=bidr.io; expires=Tue, 19 Dec 2023 09:32:27 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.16	49942	172.64.151.101	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	881	OUT	GET /usermatch?s=201092&cb=https%3A%2F%2Fsync.richaudience.com%2F2066127a3f7c6635eb4f6cac536feb5a%2F%3Fgdpr%3D0%26euconsent%3D%26uid%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: ssum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1
2023-12-19 09:22:27 UTC	1265	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Length: 0 Connection: close Location: /usermatch?cb=https%3A%2F%2Fsync.richaudience.com%2F2066127a3f7c6635eb4f6cac536feb5a%2F%3Fgdpr%3D0%26euconsent%3D%26uid%3D&gdpr=0&gdpr_consent=&s=201092&C=1 CF-Ray: 837e94cb9d8474aa-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:27 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPS=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:27 GMT; Max-Age=7776000; Secure; SameSite=None Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:27 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e4ZRFeXU85%2Fi3X6xUmJf6ZM3DMPEA%2FT2gFWkiI7AhkY6JCCF7yAcpWW5d5kqB2OBI5tsY74FpCl4n9zh8FCYnp9LpEOuN5YYenSmCyYGnvEGvCXNGnkcEEsaoqLjkF5g%2B0hd%2FipOuyLLMA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.16	49943	35.211.178.172	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	668	OUT	GET /sync?ssp=richaudience&gdpr=0&gdpr_consent=&user_id=64f4bbfb-8ac7-4d56-b41c-1zz1702977725 HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	819	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: https://x.bidswitch.net/ul_cb/sync?ssp=richaudience&gdpr=0&gdpr_consent=&user_id=64f4bbfb-8ac7-4d56-b41c-1zz1702977725 Set-Cookie: tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; path=/; expires=Wed, 18-Dec-2024 09:22:27 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: c=1702977747; path=/; expires=Wed, 18-Dec-2024 09:22:27 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: tuuid_lu=1702977747; path=/; expires=Wed, 18-Dec-2024 09:22:27 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: c=1702977747; path=/; expires=Wed, 18-Dec-2024 09:22:27 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.16	49933	51.222.239.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	731	OUT	GET /usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent= HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	466	IN	HTTP/1.1 200 OK p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:45; domain=onetag-sys.com; SameSite=None; Secure content-type: text/html cache-control: no-transform, no-cache content-length: 4715 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close
2023-12-19 09:22:27 UTC	2544	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 79 6e 63 20 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 73 63 72 69 70 74 3e 0a 0a 20 20 20 20 76 61 72 20 73 79 6e 63 50 69 78 65 6c 73 20 3d 20 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 6d 61 74 68 74 61 67 2e 63 6f 6d 2f 73 79 6e 63 2f 69 6d 67 3f 6d 74 5f 65 78 69 64 3d 37 35 26 72 65 64 69 72 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 6f 6e 65 74 61 67 2d 73 79 73 2e 63 6f 6d 25 32 46 6d 61 74 63 68 25 32 46 25 33 46 69 6e 74 5f 69 64 25 33 44 31 25 32 36 75 69 64 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title>Sync Pixels</title></head><body><script> var syncPixels = "https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid
2023-12-19 09:22:27 UTC	2171	IN	Data Raw: 5f 63 6f 6e 73 65 6e 74 3d 24 7b 47 44 50 52 5f 53 54 52 49 4e 47 7d 20 68 74 74 70 73 3a 2f 2f 76 69 73 69 74 6f 72 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 2f 76 69 73 69 74 6f 72 2f 73 79 6e 63 3f 75 69 64 3d 66 30 34 66 35 63 35 35 66 38 38 66 66 65 61 37 61 33 63 65 35 62 32 64 39 30 38 61 36 65 37 31 26 76 69 73 69 74 6f 72 3d 66 4e 31 6b 33 37 57 30 59 63 44 63 64 47 42 7a 38 71 73 71 65 62 4b 30 68 79 49 55 57 46 54 75 58 31 68 79 4c 4f 6b 58 6b 56 59 22 3b 0a 20 20 20 20 76 61 72 20 73 79 6e 63 49 66 72 61 6d 65 73 20 3d 20 22 22 3b 0a 0a 20 20 20 20 76 61 72 20 47 44 50 52 5f 41 50 50 4c 49 45 53 20 3d 20 22 67 64 70 72 3d 22 3b 0a 20 20 20 20 76 61 72 20 47 44 50 52 20 3d 20 22 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3b 0a 20 20 20 20 76 61 Data Ascii: _consent=${GDPR_STRING} https://visitor.omnitagjs.com/visitor/sync?uid=f04f5c55f88ffea7a3ce5b2d908a6e71&visitor=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY"; var syncIframes = ""; var GDPR_APPLIES = "gdpr="; var GDPR = "gdpr_consent="; va

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.16	49935	52.223.22.214	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	733	OUT	GET /getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID&gdpr=0 HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	557	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Length: 0 Connection: close Location: /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID Cache-Control: no-cache, no-store, must-revalidate P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Set-Cookie: tluid=2271281487850057919730; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Mon, 18 Mar 2024 09:22:27 GMT; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.16	49932	51.222.239.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	659	OUT	GET /match/?int_id=113&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&gdpr=0 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	277	IN	HTTP/1.1 204 No Content p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' cache-control: no-transform, no-cache strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.16	49931	23.83.76.38	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	734	OUT	GET /api/sync?callerId=22&gdpr=0&gdpr_consent= HTTP/1.1 Host: ssbsync.smartadserver.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	270	IN	HTTP/1.1 200 OK content-length: 1054 content-type: text/html date: Tue, 19 Dec 2023 09:22:27 GMT set-cookie: pid=5184721251378344538; expires=Sat, 18 Jan 2025 09:21:27 GMT; domain=smartadserver.com; path=/; samesite=None; secure; samesite=none connection: close
2023-12-19 09:22:27 UTC	1054	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 76 69 73 69 74 6f 72 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 2f 76 69 73 69 74 6f 72 2f 73 79 6e 63 3f 75 69 64 3d 39 32 37 36 61 38 63 38 64 30 31 30 62 37 37 61 66 35 30 31 34 34 63 36 30 30 34 37 62 37 38 31 26 76 69 73 69 74 6f 72 3d 35 31 38 34 37 32 31 32 35 31 33 37 38 33 34 34 35 33 38 26 6e 61 6d 65 3d 53 4d 41 52 54 41 44 53 45 52 56 45 52 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 20 2f 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 73 79 6e 63 2e 6c 6f 6f 70 6d 65 2e 6d 65 2f 3f 72 65 64 69 72 65 63 74 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 72 74 62 2d 63 73 79 6e 63 2e 73 6d 61 72 74 61 Data Ascii: <html><head></head><body><img src="//visitor.omnitagjs.com/visitor/sync?uid=9276a8c8d010b77af50144c60047b781&visitor=5184721251378344538&name=SMARTADSERVER&gdpr=0&gdpr_consent=" /><img src="https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smarta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.16	49920	68.67.161.208	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	589	OUT	GET /bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://acdn.adnxs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018
2023-12-19 09:22:27 UTC	930	IN	HTTP/1.1 200 OK Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: be96865f-341f-48fd-a966-d8e6784fba87 Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:27 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.16	49917	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	628	OUT	GET /cookie-sync/richaudience?gdpr=0&gdpr_consent= HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	398	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:27 GMT location: https://match.prod.bidr.io/cookie-sync/richaudience?gdpr=0&gdpr_consent=&_bee_ppp=1 Server: gunicorn set-cookie: checkForPermission=ok; Domain=bidr.io; expires=Tue, 19 Dec 2023 09:32:27 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.16	49946	172.217.3.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	1301	OUT	GET /pcs/view?xai=AKAOjstNl1lbgRQpJWOFKxGUq3ETGcRmveUALNGcDY2Hibj2JdVDZfu2JdzKdBXcJp-E9lJzAg9ARDhRCYzxZb935I8yWH4A-LmJcIkijJG9Ky9mhyDK1ehOGQYiMSZBGb3IoQbpbyM4KWCyxY_joWfpR7p6GBi5r1SZvbAvrrzFru1U_-V6RFtz6-te4diAZ2meHd5q14YkvPry34GArKV_KTaBdXLe0wYk-mii261ltfPJKkR6l2-6nGxFDuC2KCl1TmG6JYQXxIzYvjJtCxq1jMWkeeV6naxkTBB4G96Au7hXhHvW-4NGnmOH3bmOhScz4MxxcIj7gFYSr3BCtyrZj7qLVH9CL0h3ePzEQdHyZ_bLcxeqk8F9S1aIeS05CwpCq2zbTnq-oX7pphZNx-G7n_rtcOUie4i88FJHlTVJf8eQ9BDl4hsfGzsz&sai=AMfl-YRDGcKP9Htw-WAjDGltiiUrsaAp9wep7651iBkS7YpQdpA3Oza7l5xeUDxb9BtyhRCO9jw-PDly6iCJ0hneGw38GpveIPTAfzin-Y2ioEbJpvPD7Wo3F1vmXZa0jg&sig=Cg0ArKJSzAtXjQncBuS5EAE&uach_m=%5BUACH%5D&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:28 UTC	981	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:27 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Tue, 19-Dec-2023 09:37:27 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Expires: Tue, 19 Dec 2023 09:22:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.16	49929	3.94.183.232	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	728	OUT	GET /usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0 HTTP/1.1 Host: rtb.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	362	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:27 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 2922 Connection: close Server: nginx Set-Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a; Domain=.gumgum.com; Expires=Wed, 18 Dec 2024 09:22:27 GMT; Path=/; Secure; SameSite=None ETag: "017e1e0ec9f4ed2c0db792bd24339dc5e" Timing-Allow-Origin: *
2023-12-19 09:22:27 UTC	2922	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 2e 61 64 6e 78 73 2e 63 6f 6d 2f 67 65 74 75 69 64 3f 68 74 74 70 73 3a 2f 2f 75 73 65 72 73 79 6e 63 2e 67 75 6d 67 75 6d 2e 63 6f 6d 2f 75 73 65 72 73 79 6e 63 3f 62 3d 61 70 6e 26 69 3d 24 55 49 44 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 2f 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 78 2e 62 69 64 73 77 69 74 63 68 2e 6e 65 74 2f 73 79 6e 63 3f 73 73 70 3d 67 75 6d 67 75 6d 32 26 75 73 65 72 5f 69 64 3d 75 5f 63 32 64 32 62 39 33 33 2d 66 63 35 62 2d 34 62 31 35 2d 61 38 32 66 2d 66 36 39 36 36 30 62 63 61 63 37 61 Data Ascii: <html><head><title></title></head><body><img src="https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID" style="display:none;"/><img src="https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.16	49950	23.227.151.202	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	724	OUT	GET /sync.html?aid=750078&gdpr=0&gdpr_consent= HTTP/1.1 Host: s.spotim.market Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	429	IN	HTTP/1.1 200 OK Server: Spotim Date: Tue, 19 Dec 2023 09:22:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1486 Access-Control-Allow-Origin: https://visitor.omnitagjs.com Access-Control-Allow-Credentials: true Connection: Keep-Alive X-Robots-Tag: noindex Set-Cookie: vmuid=36de1d8845678e06; expires=Mon, 19 Feb 2024 09:22:27 GMT; domain=.spotim.market; path=/; secure; SameSite=None Connection: close
2023-12-19 09:22:27 UTC	757	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 28 66 75 6e 63 74 69 6f 6e 28 70 61 72 65 6e 74 29 7b 66 75 6e 63 74 69 6f 6e 20 61 64 64 50 69 78 65 6c 28 6c 69 6e 6b 29 20 7b 76 61 72 20 73 63 20 3d 20 6e 65 77 20 49 6d 61 67 65 28 29 3b 73 63 2e 73 72 63 20 3d 20 6c 69 6e 6b 3b 70 61 72 65 6e 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 63 29 3b 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 64 64 49 66 72 61 6d 65 28 6c 69 6e 6b 29 20 7b 76 61 72 20 69 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d Data Ascii: <!DOCTYPE html><html><head><meta charset="UTF-8"> </head><body><script type="text/javascript">(function(parent){function addPixel(link) {var sc = new Image();sc.src = link;parent.appendChild(sc);};function addIframe(link) {var iframe = document.createElem
2023-12-19 09:22:27 UTC	729	IN	Data Raw: 6e 63 25 33 46 74 25 33 44 61 25 32 36 65 70 25 33 44 36 34 34 36 38 30 25 32 36 65 78 74 75 69 64 25 33 44 25 32 34 55 49 44 25 32 36 74 72 61 66 66 69 63 5f 73 6f 75 72 63 65 25 33 44 73 6e 69 70 70 65 74 25 32 36 73 65 73 73 69 6f 6e 25 33 44 31 34 41 30 46 43 39 33 39 44 36 41 36 34 38 33 25 32 36 73 70 25 33 44 37 35 30 30 37 38 25 32 36 70 62 25 33 44 36 31 32 30 30 34 25 32 36 63 25 33 44 36 34 39 32 38 35 25 32 36 61 25 33 44 36 34 34 36 38 30 25 32 36 64 6f 6d 61 69 6e 25 33 44 76 69 73 69 74 6f 72 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 7b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 7d 22 29 3b 61 64 64 50 69 78 65 6c 28 22 2f 2f 72 74 62 2e 6f 70 65 6e 78 2e 6e 65 74 2f 73 79 6e 63 2f 70 Data Ascii: nc%3Ft%3Da%26ep%3D644680%26extuid%3D%24UID%26traffic_source%3Dsnippet%26session%3D14A0FC939D6A6483%26sp%3D750078%26pb%3D612004%26c%3D649285%26a%3D644680%26domain%3Dvisitor.omnitagjs.com&gdpr=0&gdpr_consent={gdpr_consent}");addPixel("//rtb.openx.net/sync/p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.16	49930	69.194.240.13	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	660	OUT	GET /usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&gdpr=0 HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:27 UTC	842	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:27 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22zdxidn%22%3A%222069.5%22%2C%22nxtrdr%22%3A%22https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:27 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1702977747799 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.16	49912	68.67.181.211	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:27 UTC	751	OUT	GET /getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssbsync.smartadserver.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018
2023-12-19 09:22:28 UTC	1062	IN	HTTP/1.1 302 Found Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=6663647625574893018&gdpr=0&gdpr_consent= AN-X-Request-Uuid: fb37c57b-a1c8-4058-be5e-0bcc6b998b6b Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:28 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.16	49944	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	747	OUT	GET /cookie-sync/pm?gdpr=0&gdpr_consent= HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: checkForPermission=ok
2023-12-19 09:22:28 UTC	388	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:28 GMT location: https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1 Server: gunicorn set-cookie: checkForPermission=ok; Domain=bidr.io; expires=Tue, 19 Dec 2023 09:32:28 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.16	49918	15.197.193.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	728	OUT	GET /track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAEYBSgCMgsIxOyx_tefwDwQBTgB
2023-12-19 09:22:28 UTC	625	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Length: 355 Connection: close server: Kestrel location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent= set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:28 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFGAEgASgCMgsI8vjpgtifwDwQBTgBWghwdWJtYXRpY2AC; expires=Thu, 19 Dec 2024 09:22:28 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:28 UTC	355	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 49 34 4e 44 6b 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 Data Ascii: Redirecting to: <a href="https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent=">https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.16	49958	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	762	OUT	GET /ecm3?ex=smart.com&id=6016766153027957348&gdpr=0&gdpr_consent= HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:28 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: CN9NDXZEH2RPRW4PHMN9 Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:28 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.16	49957	35.244.159.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	887	OUT	GET /w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0 HTTP/1.1 Host: u.openx.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747
2023-12-19 09:22:28 UTC	620	IN	HTTP/1.1 200 OK Vary: Accept, Accept-Encoding Set-Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; Version=1; Expires=Wed, 18-Dec-2024 09:22:28 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None Set-Cookie: pd=v2\|1702977748\|vMgavPkWgy; Version=1; Expires=Wed, 03-Jan-2024 09:22:28 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None Server: OXGW/0.0.0 P3P: CP="CUR ADM OUR NOR STA NID" Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: text/html Content-Length: 831 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:28 UTC	831	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 73 63 72 69 70 74 3e 69 66 28 22 62 72 6f 77 73 69 6e 67 54 6f 70 69 63 73 22 69 6e 20 64 6f 63 75 6d 65 6e 74 26 26 64 6f 63 75 6d 65 6e 74 2e 66 65 61 74 75 72 65 50 6f 6c 69 63 79 2e 61 6c 6c 6f 77 73 46 65 61 74 75 72 65 28 22 62 72 6f 77 73 69 6e 67 2d 74 6f 70 69 63 73 22 29 29 64 6f 63 75 6d 65 6e 74 2e 62 72 6f 77 73 69 6e 67 54 6f 70 69 63 73 28 29 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 61 6d 61 7a 6f 6e 2d 61 64 73 79 73 74 65 6d 2e 63 6f 6d 2f 65 63 6d 33 3f 65 78 3d 6f 70 65 6e 78 2e 63 6f 6d 26 69 64 3d 31 33 64 65 37 64 63 62 2d 35 37 63 34 Data Ascii: <html><head><title>Pixels</title></head><body><script>if("browsingTopics"in document&&document.featurePolicy.allowsFeature("browsing-topics"))document.browsingTopics()</script><img src="https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=13de7dcb-57c4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.16	49951	172.217.3.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	1532	OUT	GET /pcs/view?xai=AKAOjstRTuPiweObBprQtFUB00IgDGeXLsiu-6wFpw5lYrW1CHeKLZPssQfz0tqoMeovpNa_VKpoXxmBd_1QNDfBcEwJyTXgtdofnI1tYcnxLDKbtB43ZG7j-4ih7VKFmTkQDTxyFsvEvos_fpvbKeur3HOsMtVoeSMPoYENZw8zEGsv2YEcmymzaNgpTJiOBODTnlm_m3uNwW2-a0bOq4-nLwAjWZpHW7qz3uaBVqBOl4EXRwMrTC4K68-rBndAH76Mp9gk1EC4XJ32fz2Ko95ryatC-QzECRwHm26gNsxPkvyjp6czGEnxeRQ1yvAbWA-2Cb7B_HXFvvkXZmAl_IBWSaUIqFEN_IMgiIns09CRjuIjP4PExRMgz10vYUE3IK8xW1RrvD_quiXtzk0KFXxxueCKeLpv5pWri03OFmMQ64fMoQhOoV0YIKDURRS5TePvf5U&sai=AMfl-YSNx_0PjW27AJDV0ODAhnB-vXBQz22rbs--xYi9FfphHC9onaz_chcxCfjhznLjn-bGkEZTFYfPhQ-UkiFMcL6bLxjt3aTDCUo181xXPhUT6x6JOWDjxReksvmdgA&sig=Cg0ArKJSzFtEC5S1DR-2EAE&uach_m=%5BUACH%5D&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:28 UTC	981	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:28 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Tue, 19-Dec-2023 09:37:28 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Expires: Tue, 19 Dec 2023 09:22:28 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.16	49952	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	778	OUT	GET /beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6
2023-12-19 09:22:28 UTC	736	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:28 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:28 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:28 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: text/html Vary: Accept-Encoding, User-Agent Content-Length: 1327 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:28 UTC	1327	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 0a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 73 6f 76 72 6e 20 42 65 61 63 6f 6e 20 28 36 20 53 65 6e 74 20 2f 20 35 20 4d 61 78 29 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 69 6d 67 20 63 6c 61 73 73 3d 27 73 6f 76 72 6e 2d 62 65 61 63 6f 6e 2d 70 69 78 65 6c 27 20 73 74 79 6c 65 3d 27 77 69 64 74 68 3a 30 70 78 3b 20 68 65 69 67 68 74 3a 30 70 78 3b 27 20 77 69 64 74 68 3d 27 30 27 20 68 65 69 67 68 74 3d 27 30 27 20 73 72 63 3d 27 68 74 74 70 73 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""https://www.w3.org/TR/html4/strict.dtd"><html><head><title>sovrn Beacon (6 Sent / 5 Max)</title></head><body><img class='sovrn-beacon-pixel' style='width:0px; height:0px;' width='0' height='0' src='https

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.16	49954	104.22.68.131	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	850	OUT	GET /getuid?source=openrtb&zoneCode=openrtb_adyoulike&redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DSMILE_WANTED%26ttl%3D720%26uid%3De77031af9e62c4ae76bee5b9517c4ef4%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: csync.smilewanted.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:28 UTC	980	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: sw_user_params_infos=8sdRREvsw7LjLys0YvGw81rhTgJXHPGulgkosiEv7nFdq9couYKAn7Acp9nrXB3%2BE9mY9DalL7%2B9iQJQiaWqSQETzxb2ORoHNPFOLNmDEN6Mia0dNse%2BBrdIA0FOk2u663O9zL5jwXD4l8ZH4AGLTA%3D%3D; expires=Wed, 18-Dec-2024 15:11:40 GMT; Max-Age=31556952; path=/; domain=smilewanted.com; secure; HttpOnly; SameSite=None Location: https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=SMILE_WANTED&ttl=720&uid=e77031af9e62c4ae76bee5b9517c4ef4&visitor=21b7e4500fc5676f49206403c549f2b8&gdpr=0&gdpr_consent= Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 837e94ce59fd8daf-MIA
2023-12-19 09:22:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.16	49956	172.64.151.101	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	849	OUT	GET /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1 HTTP/1.1 Host: ssum-sec.casalemedia.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMID=ZYFg05BR8MuggUMSNtG2uQAA; CMPS=1526; CMPRO=1526
2023-12-19 09:22:28 UTC	994	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Ray: 837e94ce89460979-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg05BR8MuggUMSNtG2uQAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:28 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=1526; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:28 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lSih2q4NCtgg4I5CnQbaRLOmdEUD0cIh83%2Fq%2Bruu%2FaLctmRKBvlDJ6zuoxmktYMKR80dM9Uq8so6YqpGaZtRVBx26WAZc6Wl2awZNGd4UYbFzDloYhzM3ToYFtRbgtb6EojrlOCR5n5%2Fmg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:28 UTC	375	IN	Data Raw: 37 31 33 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 6d 2e 67 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 70 69 78 65 6c 3f 67 6f 6f 67 6c 65 5f 6e 69 64 3d 69 6e 64 65 78 26 61 6d 70 3b 67 6f 6f 67 6c 65 5f 63 6d 26 61 6d 70 3b 67 6f 6f 67 6c 65 5f 68 6d 3d 5a 59 46 67 30 35 42 52 38 4d 75 67 67 55 4d 53 4e 74 47 32 75 51 41 41 42 66 59 41 41 41 49 42 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 61 6d 70 3b 75 73 5f 70 72 69 76 61 63 79 3d 26 61 6d 70 3b 67 64 70 72 3d 26 61 6d 70 3b 67 70 70 3d 26 61 6d 70 3b 67 70 70 5f 73 69 64 3d 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 Data Ascii: 713<html><head><title></title></head><body><img src="https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZYFg05BR8MuggUMSNtG2uQAABfYAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=" style="display:none"
2023-12-19 09:22:28 UTC	1369	IN	Data Raw: 38 4d 75 67 67 55 4d 53 4e 74 47 32 75 51 41 41 25 32 36 31 35 32 36 26 61 6d 70 3b 67 70 64 72 3d 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 61 6d 70 3b 75 73 5f 70 72 69 76 61 63 79 3d 26 61 6d 70 3b 67 70 70 3d 26 61 6d 70 3b 67 70 70 5f 73 69 64 3d 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 20 77 69 64 74 68 3d 22 30 22 20 68 65 69 67 68 74 3d 22 30 22 20 61 6c 74 3d 22 22 20 62 6f 72 64 65 72 3d 22 30 22 20 2f 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 61 6d 61 7a 6f 6e 2d 61 64 73 79 73 74 65 6d 2e 63 6f 6d 2f 64 63 6d 3f 70 69 64 3d 37 38 61 66 39 31 34 63 2d 65 37 35 35 2d 34 62 39 30 2d 62 64 65 64 2d 31 62 31 37 32 61 65 64 63 37 36 33 26 61 6d 70 3b 75 73 5f 70 72 69 76 61 63 79 3d 26 61 Data Ascii: 8MuggUMSNtG2uQAA%261526&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&a
2023-12-19 09:22:28 UTC	74	IN	Data Raw: 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 20 77 69 64 74 68 3d 22 30 22 20 68 65 69 67 68 74 3d 22 30 22 20 61 6c 74 3d 22 22 20 62 6f 72 64 65 72 3d 22 30 22 20 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: e="display:none" width="0" height="0" alt="" border="0" /></body></html>
2023-12-19 09:22:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.16	49961	52.223.22.214	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	796	OUT	GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tluid=2271281487850057919730
2023-12-19 09:22:28 UTC	511	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Length: 0 Connection: close Location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2271281487850057919730 Cache-Control: no-cache, no-store, must-revalidate P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Set-Cookie: tluid=2271281487850057919730; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Mon, 18 Mar 2024 09:22:28 GMT; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.16	49914	35.211.178.172	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	761	OUT	GET /ul_cb/sync?ssp=richaudience&gdpr=0&gdpr_consent=&user_id=64f4bbfb-8ac7-4d56-b41c-1zz1702977725 HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid_lu=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc
2023-12-19 09:22:28 UTC	689	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //server.cpmstar.com/usersync.aspx?bsw_custom_parameter=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp%3Drichaudience%26user_id%3D%24UID Set-Cookie: tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; path=/; expires=Wed, 18-Dec-2024 09:22:28 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: tuuid_lu=1702977748; path=/; expires=Wed, 18-Dec-2024 09:22:28 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.16	49962	67.202.105.33	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	931	OUT	GET /deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: de.tynt.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:28 UTC	859	IN	HTTP/1.1 307 location: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false expires: Sat, 26 Jul 1997 05:00:00 GMT accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile set-cookie: uid=4Qap4mWBYNTCgISUJp6ICw==;Version=1;Comment=;SameSite=None;Domain=tynt.com;Path=/;Max-Age=31536000;Secure referrer-policy: unsafe-url content-length: 0 date: Tue, 19 Dec 2023 09:22:28 GMT p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.16	49965	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	853	OUT	GET /dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&redir=true&gdpr=0&gdpr_consent= HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:28 UTC	807	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: PJSG9XQ5XWTKHGEH0NWZ Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:28 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:28 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:28 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.16	49970	172.64.151.101	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	939	OUT	GET /usermatch?cb=https%3A%2F%2Fsync.richaudience.com%2F2066127a3f7c6635eb4f6cac536feb5a%2F%3Fgdpr%3D0%26euconsent%3D%26uid%3D&gdpr=0&gdpr_consent=&s=201092&C=1 HTTP/1.1 Host: ssum-sec.casalemedia.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPS=2798; CMPRO=2798
2023-12-19 09:22:28 UTC	1000	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Ray: 837e94d03f5167d4-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:28 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:28 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZdmP1COctGcHOJMgDhqqg9aAjgpXJtkeYy6nu%2Bz4LxZtKkjm%2BA7YQQa0t4b%2BAMbU8UV%2BEemzp4h9MuYCp662VRQHEsmGux%2BUFm84asxeZzeXkQ6yKINNJz7I87%2FVSstoK5sikpNCTgp%2BAA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:28 UTC	369	IN	Data Raw: 37 33 33 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 73 75 6d 2d 73 65 63 2e 63 61 73 61 6c 65 6d 65 64 69 61 2e 63 6f 6d 2f 72 72 75 6d 3f 69 78 69 3d 31 26 61 6d 70 3b 63 6d 5f 64 73 70 5f 69 64 3d 38 35 26 61 6d 70 3b 63 62 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 63 6d 2e 67 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 25 32 46 70 69 78 65 6c 25 33 46 67 6f 6f 67 6c 65 5f 6e 69 64 25 33 44 63 61 73 61 6c 65 5f 6d 65 64 69 61 32 5f 64 62 6d 25 32 36 67 6f 6f 67 6c 65 5f 63 6d 25 32 36 67 6f 6f 67 6c 65 5f 73 63 25 32 36 67 6f 6f 67 6c 65 5f 68 6d 25 33 44 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e Data Ascii: 733<html><head><title></title></head><body><img src="https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D" style="display:n
2023-12-19 09:22:28 UTC	1369	IN	Data Raw: 64 65 64 2d 31 62 31 37 32 61 65 64 63 37 36 33 26 61 6d 70 3b 75 73 5f 70 72 69 76 61 63 79 3d 26 61 6d 70 3b 67 64 70 72 3d 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 61 6d 70 3b 69 64 3d 5a 59 46 67 30 32 6b 44 73 6b 58 41 63 4d 41 42 6b 79 4e 50 61 67 41 41 43 75 34 41 41 41 49 42 26 61 6d 70 3b 67 70 70 3d 26 61 6d 70 3b 67 70 70 5f 73 69 64 3d 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 20 77 69 64 74 68 3d 22 30 22 20 68 65 69 67 68 74 3d 22 30 22 20 61 6c 74 3d 22 22 20 62 6f 72 64 65 72 3d 22 30 22 20 2f 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 6d 2e 67 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 70 69 78 65 6c 3f 67 6f 6f 67 6c 65 5f 6e 69 64 3d 69 6e 64 65 78 26 61 6d 70 3b 67 6f 6f Data Ascii: ded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZYFg02kDskXAcMABkyNPagAACu4AAAIB&gpp=&gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://cm.g.doubleclick.net/pixel?google_nid=index&goo
2023-12-19 09:22:28 UTC	112	IN	Data Raw: 5a 59 46 67 30 32 6b 44 73 6b 58 41 63 4d 41 42 6b 79 4e 50 61 67 41 41 43 75 34 41 41 41 49 42 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 20 77 69 64 74 68 3d 22 30 22 20 68 65 69 67 68 74 3d 22 30 22 20 61 6c 74 3d 22 22 20 62 6f 72 64 65 72 3d 22 30 22 20 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: ZYFg02kDskXAcMABkyNPagAACu4AAAIB" style="display:none" width="0" height="0" alt="" border="0" /></body></html>
2023-12-19 09:22:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.16	49964	63.251.86.49	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	814	OUT	GET /dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent= HTTP/1.1 Host: ap.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJxdkLkRwEAIA3u52AEcv1vzuHePb0hQuOKR4FkV6%2BYg5QzRuNaeyARCMDbIFBQ4%2FLBYbvu5qi2FXLmVnDNJYOLgUdAPnqnABgz7Ep8A%2Byw78aY6dQcOuBGeViPP%2BwHHKUmA
2023-12-19 09:22:28 UTC	528	IN	HTTP/1.1 302 Found Connection: close Date: Tue, 19 Dec 2023 09:22:28 GMT Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=SDJLeVRCWkhEbXo5X1pnUVNvaTJ6X1Y2&gdpr=0 Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6;Version=1;Domain=.lijit.com;Path=/;Max-Age=31536000;Secure; SameSite=None; Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, DELETE, PUT Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Requested-With, Content-Type X-Sovrn-Pod: ad_ap1dca1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.16	49967	68.67.161.208	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	692	OUT	GET /getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D92%263pid%3D%24UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018
2023-12-19 09:22:28 UTC	1024	IN	HTTP/1.1 302 Found Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ce.lijit.com/merge?pid=92&3pid=6663647625574893018&gdpr=0&gdpr_consent= AN-X-Request-Uuid: 22e86a75-cf75-41c4-9dac-f891e94564c0 Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:28 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.16	49984	23.105.14.106	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	823	OUT	GET /redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fdcm%3Fpid%3Df7a5db36-1d5c-4c26-81b6-b4d0807faffb%26id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP/1.1 Host: rtb-csync.smartadserver.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssbsync.smartadserver.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pid=5184721251378344538
2023-12-19 09:22:28 UTC	467	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:28 GMT cache-control: no-cache,no-store location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=5184721251378344538&gdpr=0&gdpr_consent= pragma: no-cache set-cookie: csync=135:TAM_OK; expires=Thu, 19 Dec 2024 09:22:28 GMT; domain=smartadserver.com; path=/; SameSite=None; secure p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.16	49963	50.31.142.95	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	816	OUT	GET /usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_BANNER%26ttl%3D720%26uid%3Dbdef6bd95b7450b4e62a32db8c7d8c9d%26visitor%3D__ZUID__%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: b1sync.zemanta.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:28 UTC	687	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 273 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Thu, 01 Dec 1994 16:00:00 GMT Location: /usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_BANNER%26ttl%3D720%26uid%3Dbdef6bd95b7450b4e62a32db8c7d8c9d%26visitor%3D__ZUID__%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&s=2 P3p: CP="We do not support P3P header." Pragma: no-cache Set-Cookie: zuid=aXQaOqrGBGrZCZrdEc4x; Path=/; Domain=zemanta.com; Expires=Wed, 18 Dec 2024 09:22:28 GMT; Max-Age=31536000; Secure; SameSite=None Date: Tue, 19 Dec 2023 09:22:28 GMT
2023-12-19 09:22:28 UTC	273	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 2f 75 73 65 72 73 79 6e 63 2f 61 64 79 6f 75 6c 69 6b 65 2f 3f 63 62 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 76 69 73 69 74 6f 72 2d 75 73 2d 77 65 73 74 2d 32 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 25 32 46 76 69 73 69 74 6f 72 25 32 46 73 79 6e 63 25 33 46 6e 61 6d 65 25 33 44 5a 45 4d 41 4e 54 41 5f 42 41 4e 4e 45 52 25 32 36 74 74 6c 25 33 44 37 32 30 25 32 36 75 69 64 25 33 44 62 64 65 66 36 62 64 39 35 62 37 34 35 30 62 34 65 36 32 61 33 32 64 62 38 63 37 64 38 63 39 64 25 32 36 76 69 73 69 74 6f 72 25 33 44 5f 5f 5a 55 49 44 5f 5f 25 32 36 67 64 70 72 25 33 44 30 25 32 36 67 64 70 72 5f 63 6f 6e 73 65 6e 74 25 33 44 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 61 6d 70 Data Ascii: <a href="/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_BANNER%26ttl%3D720%26uid%3Dbdef6bd95b7450b4e62a32db8c7d8c9d%26visitor%3D__ZUID__%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&amp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.16	49972	35.163.115.57	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	761	OUT	GET /visitor/sync?uid=9276a8c8d010b77af50144c60047b781&visitor=5184721251378344538&name=SMARTADSERVER&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssbsync.smartadserver.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:28 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:28 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.16	49973	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	744	OUT	GET /ecm3?ex=3lift.com&id=2271281487850057919730 HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:28 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: PFZGTWEF7X3CRXR7MTKT Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:28 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.16	49974	52.223.22.214	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	699	OUT	GET /xuid?mid=7976&xuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&dongle=u6nf&gdpr=0&gdpr_consent= HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tluid=2271281487850057919730
2023-12-19 09:22:28 UTC	449	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: image/gif Content-Length: 37 Connection: close Cache-Control: no-cache, no-store, must-revalidate P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Set-Cookie: tluid=2271281487850057919730; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Mon, 18 Mar 2024 09:22:28 GMT; Secure; SameSite=None
2023-12-19 09:22:28 UTC	37	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.16	49983	23.105.14.106	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	822	OUT	GET /redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP/1.1 Host: rtb-csync.smartadserver.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssbsync.smartadserver.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pid=5184721251378344538
2023-12-19 09:22:28 UTC	466	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:28 GMT cache-control: no-cache,no-store location: https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=5184721251378344538&gdpr=0&gdpr_consent= pragma: no-cache set-cookie: csync=139:0; expires=Thu, 19 Dec 2024 09:22:28 GMT; domain=smartadserver.com; path=/; SameSite=None; secure p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.16	49993	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	758	OUT	GET /cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1 HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: checkForPermission=ok
2023-12-19 09:22:28 UTC	795	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:28 GMT location: https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCYWZVN0xBc0lBQUJOeGdNVUhlQQ&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 Server: gunicorn set-cookie: bito=AABafU7LAsIAABNxgMUHeA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:28 GMT; Path=/; SameSite=None; Secure set-cookie: bitoIsSecure=ok; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:28 GMT; Path=/; SameSite=None; Secure set-cookie: checkForPermission=""; Domain=bidr.io; expires=Thu, 01 May 2008 00:00:00 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.16	49966	69.194.240.13	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	614	OUT	GET /usersync2/rmpssp?sub=sovrn&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:28 UTC	643	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:28 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-e2cc71db-ac9e-4ee9-9211-346b598dca6c-005%22%2C%22zdxidn%22%3A%222069.80%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:28 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://sync.1rx.io/usersync2/rmpssp?sub=sovrn&zcc=1&cb=1702977748695 etag: RXe2cc71dbac9e4ee99211346b598dca6c005 connection: close
2023-12-19 09:22:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.16	49976	35.244.159.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	913	OUT	GET /w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent= HTTP/1.1 Host: us-u.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747
2023-12-19 09:22:28 UTC	622	IN	HTTP/1.1 200 OK Vary: Accept, Accept-Encoding Set-Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; Version=1; Expires=Wed, 18-Dec-2024 09:22:28 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None Set-Cookie: pd=v2\|1702977748\|vMgavPkWgyiK; Version=1; Expires=Wed, 03-Jan-2024 09:22:28 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None Server: OXGW/0.0.0 P3P: CP="CUR ADM OUR NOR STA NID" Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: text/html Content-Length: 988 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:28 UTC	988	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 73 63 72 69 70 74 3e 69 66 28 22 62 72 6f 77 73 69 6e 67 54 6f 70 69 63 73 22 69 6e 20 64 6f 63 75 6d 65 6e 74 26 26 64 6f 63 75 6d 65 6e 74 2e 66 65 61 74 75 72 65 50 6f 6c 69 63 79 2e 61 6c 6c 6f 77 73 46 65 61 74 75 72 65 28 22 62 72 6f 77 73 69 6e 67 2d 74 6f 70 69 63 73 22 29 29 64 6f 63 75 6d 65 6e 74 2e 62 72 6f 77 73 69 6e 67 54 6f 70 69 63 73 28 29 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 65 2e 6c 69 6a 69 74 2e 63 6f 6d 2f 6d 65 72 67 65 3f 70 69 64 3d 37 36 26 33 70 69 64 3d 32 37 65 36 64 66 37 36 2d 61 31 64 61 2d 30 38 65 36 2d 32 64 32 39 2d 34 Data Ascii: <html><head><title>Pixels</title></head><body><script>if("browsingTopics"in document&&document.featurePolicy.allowsFeature("browsing-topics"))document.browsingTopics()</script><img src="https://ce.lijit.com/merge?pid=76&3pid=27e6df76-a1da-08e6-2d29-4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.16	49986	23.105.14.106	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	710	OUT	GET /redir/?issi=1&partnerid=86&partneruserid=6663647625574893018&gdpr=0&gdpr_consent= HTTP/1.1 Host: rtb-csync.smartadserver.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssbsync.smartadserver.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pid=5184721251378344538
2023-12-19 09:22:28 UTC	373	IN	HTTP/1.1 200 OK content-type: image/gif date: Tue, 19 Dec 2023 09:22:28 GMT cache-control: no-cache,no-store pragma: no-cache set-cookie: csync=86:6663647625574893018; expires=Thu, 19 Dec 2024 09:22:28 GMT; domain=smartadserver.com; path=/; SameSite=None; secure transfer-encoding: chunked p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" connection: close
2023-12-19 09:22:28 UTC	54	IN	Data Raw: 32 42 0d 0a 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2BGIF89a!,D;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.16	49980	35.236.220.17	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	613	OUT	GET /lj_match?r=1702977747746&gdpr=0&gdpr_consent= HTTP/1.1 Host: um.simpli.fi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:28 UTC	891	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Type: text/html Content-Length: 142 Connection: close Set-Cookie: suid=09884D8316F241D18C871E186061E89C; Path=/; domain=simpli.fi; Expires=Thu, 19-Dec-24 09:22:28 GMT; SameSite=none; Secure; Set-Cookie: suid_legacy=09884D8316F241D18C871E186061E89C; Path=/; domain=simpli.fi; Expires=Thu, 19-Dec-24 09:22:28 GMT; Secure; Location: https://ce.lijit.com/merge?pid=2&3pid=09884D8316F241D18C871E186061E89C Expires: Mon, 18 Dec 2023 09:22:28 GMT Cache-Control: no-cache Strict-Transport-Security: max-age=63072000; includeSubdomains; preload X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
2023-12-19 09:22:28 UTC	142	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.16	49990	34.111.113.62	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	663	OUT	GET /idsync/ex/receive?partner_id=3371&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:29 UTC	1087	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:28 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:28 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:28 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F Content-Length: 0 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.16	49977	35.71.131.137	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	719	OUT	GET /track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent= HTTP/1.1 Host: data.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAEYBSgCMgsIxOyx_tefwDwQBTgB
2023-12-19 09:22:28 UTC	511	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:28 GMT Content-Length: 223 Connection: close server: Kestrel location: https://ce.lijit.com/merge?pid=27&3pid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent= set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:28 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAEYBSABKAIyCwjE7LH-15_APBAFOAE.; expires=Thu, 19 Dec 2024 09:22:28 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:28 UTC	223	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 65 2e 6c 69 6a 69 74 2e 63 6f 6d 2f 6d 65 72 67 65 3f 70 69 64 3d 32 37 26 33 70 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 68 74 74 70 73 3a 2f 2f 63 65 2e 6c 69 6a 69 74 2e 63 6f 6d 2f 6d 65 72 67 65 3f 70 69 64 3d 32 37 26 33 70 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://ce.lijit.com/merge?pid=27&3pid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent=">https://ce.lijit.com/merge?pid=27&3pid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent=</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.16	50007	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	693	OUT	GET /ecm3?ex=openx.com&id=13de7dcb-57c4-8911-aa9b-7bf1acf99f35&gdpr=0 HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:29 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: V4CV2FF560VRTS7V7WVH Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:29 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.16	49975	69.194.240.13	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	903	OUT	GET /usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1702977747799 HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22zdxidn%22%3A%222069.5%22%2C%22nxtrdr%22%3A%22https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D%22%7D
2023-12-19 09:22:29 UTC	729	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:28 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22zdxidn%22%3A%222069.5%22%2C%22nxtrdr%22%3A%22https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:28 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://ad.turn.com/r/cs?pid=45&rndcb=8394239637 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.16	49982	35.214.128.77	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	741	OUT	GET /?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent= HTTP/1.1 Host: csync.loopme.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssbsync.smartadserver.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.16	49998	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:28 UTC	670	OUT	GET /cookie-sync/richaudience?gdpr=0&gdpr_consent=&_bee_ppp=1 HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: checkForPermission=ok
2023-12-19 09:22:29 UTC	654	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:29 GMT location: https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AACk507LAsIAABM7-sg6gA&gdpr=0 Server: gunicorn set-cookie: bito=AACk507LAsIAABM7-sg6gA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:29 GMT; Path=/; SameSite=None; Secure set-cookie: bitoIsSecure=ok; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:29 GMT; Path=/; SameSite=None; Secure set-cookie: checkForPermission=""; Domain=bidr.io; expires=Thu, 01 May 2008 00:00:00 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.16	49981	35.236.220.17	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	723	OUT	GET /pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: um.simpli.fi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:29 UTC	961	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: text/html Content-Length: 142 Connection: close Set-Cookie: suid=93BC46BA1AC048E6B3FEE9603D02AEE4; Path=/; domain=simpli.fi; Expires=Thu, 19-Dec-24 09:22:29 GMT; SameSite=none; Secure; Set-Cookie: suid_legacy=93BC46BA1AC048E6B3FEE9603D02AEE4; Path=/; domain=simpli.fi; Expires=Thu, 19-Dec-24 09:22:29 GMT; Secure; Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:93BC46BA1AC048E6B3FEE9603D02AEE4 Expires: Mon, 18 Dec 2023 09:22:29 GMT Cache-Control: no-cache Strict-Transport-Security: max-age=63072000; includeSubdomains; preload X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
2023-12-19 09:22:29 UTC	142	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.16	50009	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	631	OUT	GET /cookie-sync/ie HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: checkForPermission=ok
2023-12-19 09:22:29 UTC	367	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:29 GMT location: https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1 Server: gunicorn set-cookie: checkForPermission=ok; Domain=bidr.io; expires=Tue, 19 Dec 2023 09:32:29 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.16	50000	8.28.7.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	947	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; chkChromeAb67Sec=1; pi=159047:2; DPSync3=1704153600%3A201_263%7C1703030400%3A248%7C1703548800%3A265; SyncRTB3=1704153600%3A54_250_71_220_21_13_166_104%7C1703548800%3A223_15
2023-12-19 09:22:29 UTC	744	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:29 GMT; path=/ Set-Cookie: PugT=1702977749; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:29 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:29 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.16	49916	185.184.8.90	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	713	OUT	GET /cm-notify?pi=adyoulike&gdpr=0&gdpr_consent=&tc=1 HTTP/1.1 Host: creativecdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: u=5daBKxwFecmtxHnQb9Qq; g=5daBKxwFecmtxHnQb9Qq_1702977747631; ts=1702977747
2023-12-19 09:22:29 UTC	484	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:29 GMT vary: Accept-Encoding location: https://visitor.omnitagjs.com/visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1 cache-control: no-cache, no-store, must-revalidate, private, max-age=0 pragma: no-cache date: Tue, 19 Dec 2023 09:22:29 GMT expires: Thu, 01 Jan 1970 00:00:00 GMT content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.16	49991	40.76.134.238	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	832	OUT	GET /l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx%205DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&rnd=RND HTTP/1.1 Host: us01.z.antigena.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:29 UTC	176	IN	HTTP/1.1 403 Forbidden Server: Microsoft-Azure-Application-Gateway/v2 Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: text/html Content-Length: 581 Connection: close
2023-12-19 09:22:29 UTC	581	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4d 69 63 72 6f 73 6f 66 74 2d 41 7a 75 72 65 2d 41 70 70 6c 69 63 61 74 69 6f 6e 2d 47 61 74 65 77 61 79 2f 76 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>Microsoft-Azure-Application-Gateway/v2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a pa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.16	50002	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	713	OUT	GET /dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=13de7dcb-57c4-8911-aa9b-7bf1acf99f35 HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:29 UTC	807	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: KP76YJJC1TG1MHNM9JDB Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:29 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:29 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:29 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.16	50001	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	673	OUT	GET /x/ae12848777b41970a5f2?gdpr=0&gdpr_consent= HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:29 UTC	827	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 291 Connection: close x-amz-rid: 224NTA922D38MHG7NHQB Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:29 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:29 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:29 UTC	291	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 69 66 72 61 6d 65 20 77 69 64 74 68 3d 22 31 22 20 68 65 69 67 68 74 3d 22 31 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 73 72 63 3d 22 2f 2f 73 2e 61 6d 61 7a 6f 6e 2d 61 64 73 79 73 74 65 6d 2e 63 6f 6d 2f 76 33 2f 70 72 3f 65 78 6c 69 73 74 3d 73 6f 76 72 6e 26 66 76 3d 31 2e 30 26 61 3d 63 6d 26 63 6d 33 70 70 64 3d 31 26 64 6d 74 3d 33 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 67 64 70 72 3d 30 22 20 73 61 6e 64 62 6f 78 3d 22 61 6c 6c 6f 77 2d 73 61 6d 65 2d 6f 72 69 67 69 6e 20 61 6c 6c Data Ascii: <html><body style="background-color:transparent"><iframe width="1" height="1" frameborder="0" marginwidth="0" marginheight="0" src="//s.amazon-adsystem.com/v3/pr?exlist=sovrn&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr_consent=&gdpr=0" sandbox="allow-same-origin all

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.16	50011	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	768	OUT	GET /dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZYFg05BR8MuggUMSNtG2uQAABfYAAAIB&gpp=&gpp_sid= HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:29 UTC	807	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: PREPRC7CNWZK5DD23F43 Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:29 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:29 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:29 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.16	50022	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	2351	OUT	GET /gampad/ads?pvsid=3694862415250323&correlator=3128165725747980&eid=31079783%2C44807747%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&trt=2&iu_parts=5302%2Cdesktop%2Cdesktop-Web-pt%2CApps%2CProgrampage%2CATF_OOP_Wallpaper&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=1x1&ifi=1&sfv=1-0-40&ists=1&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1702977741711&lmt=1702977741&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fcaffeine.softonic.com.br%2F&vis=1&psz=0x0&msz=0x0&fws=128&ohw=0&ga_vid=430166992.1702977739&ga_sid=1702977742&ga_hid=1147585949&ga_fc=true&td=1&topics=9&tps=9&htps=10&a3p=EhsKDGlkNS1zeW5jLmNvbRiIx4iLyDFIAFICCGQ.&nt=1&psd=WzE1LFsyLFtbIi81MzAyL2Rlc2t0b3AvZGVza3RvcC1XZWItcHQvQXBwcy9Qcm9ncmFtcGFnZS9BVEZfT09QX1dhbGxwYXBlciIsW11dXV0sbnVsbCwzXQ..&dlt=1702977735228&idt=6425&prev_scp=pos%3Dtop%26countryCluster%3DA1%26td-slot%3Dtop-wallpaper%26hvi%3Dfalse%26type%3Doop_display_wallpaper&cust_params=medium%3Dorganic%26campaign%3D%26source%3Dnone%26medium_campaign%3Dorganic%26medium_source%3Dorganic-none%26file%3Df46a4db4-96d4-11e6-b215-00163ec9f5fa%26reviewvecna%3Dfalse%26recat%3Dutilities-tools%26hosted%3Dfalse%26compliant%3D1%26devel%3D0%26locale%3Dpt-BR%26author%3DZhornsoftware%26content%3Drich%26country%3DUS%26region%3DA%26platformId%3Dwindows%26ad_session_id%3Dca334998-1875-4288-9025-8f913da6a89a%26pv%3D1%26ab_upr%3D6%26personalized%3D1&adks=968654847&frm=20 HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:29 UTC	782	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Observe-Browsing-Topics: ?1 Google-LineItem-Id: -2 Google-Creative-Id: -2 Google-MediationGroup-Id: -2 Google-MediationTag-Id: -2 Date: Tue, 19 Dec 2023 09:22:29 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/plain; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:29 UTC	470	IN	Data Raw: 32 65 66 0d 0a 7b 22 2f 35 33 30 32 2f 64 65 73 6b 74 6f 70 2f 64 65 73 6b 74 6f 70 2d 57 65 62 2d 70 74 2f 41 70 70 73 2f 50 72 6f 67 72 61 6d 70 61 67 65 2f 41 54 46 5f 4f 4f 50 5f 57 61 6c 6c 70 61 70 65 72 22 3a 5b 22 68 74 6d 6c 22 2c 30 2c 30 2c 6e 75 6c 6c 2c 30 2c 30 2c 30 2c 31 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 22 49 44 3d 62 37 33 66 64 36 37 32 36 63 33 38 33 35 34 66 3a 54 3d 31 37 30 32 39 37 37 37 34 39 3a 52 54 3d 31 37 30 32 39 37 37 37 34 39 3a 53 3d 41 4c 4e 49 5f 4d 5a 32 58 6a 73 6e 34 64 5f 56 78 39 4b 55 33 51 73 50 42 70 49 39 55 63 4d 78 5f 41 22 2c 31 37 33 36 36 37 33 37 34 39 2c 22 2f 22 2c 22 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 31 5d 2c 5b 22 55 49 44 3d 30 30 30 30 30 64 Data Ascii: 2ef{"/5302/desktop/desktop-Web-pt/Apps/Programpage/ATF_OOP_Wallpaper":["html",0,0,null,0,0,0,1,0,null,null,null,null,[["ID=b73fd6726c38354f:T=1702977749:RT=1702977749:S=ALNI_MZ2Xjsn4d_Vx9KU3QsPBpI9UcMx_A",1736673749,"/","softonic.com.br",1],["UID=00000d
2023-12-19 09:22:29 UTC	288	IN	Data Raw: 4d 77 61 31 30 48 68 73 6f 47 35 43 30 61 22 2c 22 43 4b 66 74 79 72 36 57 6d 34 4d 44 46 54 41 54 69 67 4d 64 74 43 30 4d 5f 41 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 41 41 2d 56 34 71 50 65 69 5a 6b 56 53 63 54 79 38 52 4e 63 63 56 76 42 5a 6c 61 55 63 52 67 30 35 39 66 67 56 55 4c 4e 53 59 6c 65 4a 42 42 51 79 4a 54 47 69 55 35 45 43 49 70 48 75 79 54 6d 38 4c 35 58 4d 64 7a 61 65 6c 53 53 6d 4d 39 77 Data Ascii: Mwa10HhsoG5C0a","CKftyr6Wm4MDFTATigMdtC0M_A",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qPeiZkVScTy8RNccVvBZlaUcRg059fgVULNSYleJBBQyJTGiU5ECIpHuyTm8L5XMdzaelSSmM9w
2023-12-19 09:22:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.16	50015	104.18.25.173	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	810	OUT	GET /i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_user_id=ZYFg05BR8MuggUMSNtG2uQAA HTTP/1.1 Host: a.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:29 UTC	982	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 206 X-Reuse-Index: 219 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=aPnoeUwZcF1voXarrgcIpDnaqqSXaZaEqsMGYkmOQa; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:29 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=aPnoeUwZcF1voXarrgcIpDnaqqSXaZaEqsMGYkmOQa; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:29 GMT; Location: https://s.tribalfusion.com/z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_user_id=ZYFg05BR8MuggUMSNtG2uQAA CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 837e94d60c279add-MIA alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:29 UTC	42	IN	Data Raw: 32 34 0d 0a 3c 68 31 3e 45 72 72 6f 72 20 33 30 32 20 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 68 31 3e 0d 0a Data Ascii: 24<h1>Error 302 Moved Temporarily</h1>
2023-12-19 09:22:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.16	50003	15.197.193.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	774	OUT	GET /track/cmf/openx?oxid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFGAEgASgCMgsI8vjpgtifwDwQBTgBWghwdWJtYXRpY2AC
2023-12-19 09:22:29 UTC	615	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Length: 335 Connection: close server: Kestrel location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0&gdpr_consent= set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:29 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFGAEgAigCMgsI8vjpgtifwDwQBTgBWghwdWJtYXRpY2AC; expires=Thu, 19 Dec 2024 09:22:29 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:29 UTC	335	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 2d 75 2e 6f 70 65 6e 78 2e 6e 65 74 2f 77 2f 31 2e 30 2f 73 64 3f 69 64 3d 35 33 37 30 37 32 39 37 31 26 76 61 6c 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 74 74 64 5f 70 75 69 64 3d 34 62 30 38 30 31 62 36 2d 34 62 36 65 2d 33 32 65 62 2d 36 61 39 35 2d 66 39 36 36 63 34 63 61 35 34 64 35 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 68 74 74 70 73 3a 2f 2f 75 73 2d 75 2e 6f 70 65 6e 78 2e 6e 65 74 2f 77 2f 31 2e 30 2f 73 64 3f 69 64 3d 35 33 37 30 37 32 39 37 31 26 76 61 6c 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 Data Ascii: Redirecting to: <a href="https://us-u.openx.net/w/1.0/sd?id=537072971&val=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0&gdpr_consent=">https://us-u.openx.net/w/1.0/sd?id=537072971&val=134495f3-7e94-4262-b6f5-d75

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.16	50008	15.197.193.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	739	OUT	GET /track/cmf/casale HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFGAEgASgCMgsI8vjpgtifwDwQBTgBWghwdWJtYXRpY2AC
2023-12-19 09:22:29 UTC	641	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Length: 323 Connection: close server: Kestrel location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&expiration=1705569749&gdpr=0&gdpr_consent= set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:29 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUYASACKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.; expires=Thu, 19 Dec 2024 09:22:29 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:29 UTC	323	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 73 75 6d 2d 73 65 63 2e 63 61 73 61 6c 65 6d 65 64 69 61 2e 63 6f 6d 2f 72 75 6d 3f 63 6d 5f 64 73 70 5f 69 64 3d 33 39 26 65 78 74 65 72 6e 61 6c 5f 75 73 65 72 5f 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 65 78 70 69 72 61 74 69 6f 6e 3d 31 37 30 35 35 36 39 37 34 39 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 68 74 74 70 73 3a 2f 2f 64 73 75 6d 2d 73 65 63 2e 63 61 73 61 6c 65 6d 65 64 69 61 2e 63 6f 6d 2f 72 75 6d 3f 63 6d 5f 64 73 70 5f 69 64 3d 33 39 26 65 78 74 65 72 6e 61 6c 5f 75 73 65 72 5f 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 Data Ascii: Redirecting to: <a href="https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&expiration=1705569749&gdpr=0&gdpr_consent=">https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=134495f3-7e94-4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.16	50037	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	768	OUT	GET /dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZYFg02kDskXAcMABkyNPagAACu4AAAIB&gpp=&gpp_sid= HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:29 UTC	807	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: DRWR1XPMM1CM6X9VQ2HS Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:29 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:29 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:29 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.16	50012	44.207.23.148	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	628	OUT	GET /sync/openx/dfcf67f2-dbc2-a0a2-5b42-ef933b9d999c?gdpr=0 HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:29 UTC	778	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNVggWUCEHejoOWrMKg_iWRcNBcNRzwFEgEBAQGygmWLZQAAAAAA_eMAAA&S=AQAAAqnyANlOCxCBeJXDtSFid_M; Expires=Wed, 18 Dec 2024 15:22:29 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2023-12-19 09:22:29 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.16	50016	34.160.19.107	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	646	OUT	GET /cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e HTTP/1.1 Host: dmp.brand-display.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:29 UTC	595	IN	HTTP/1.1 302 Found Server: nginx/1.24.0 Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 119 Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Location: https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=030284df-1cd5-54fc-52df3208 P3p: CP='This is not a P3P policy!' Set-Cookie: _knxq_=030284df-1cd5-54fc-52df3208.1702977749.0.1702977749.1702977749; Path=/; Domain=brand-display.com; Max-Age=63072000; Secure; SameSite=None Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:29 UTC	119	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 73 75 6d 2e 63 61 73 61 6c 65 6d 65 64 69 61 2e 63 6f 6d 2f 63 72 75 6d 3f 63 6d 5f 64 73 70 5f 69 64 3d 31 39 31 26 61 6d 70 3b 65 78 74 65 72 6e 61 6c 5f 75 73 65 72 5f 69 64 3d 30 33 30 32 38 34 64 66 2d 31 63 64 35 2d 35 34 66 63 2d 35 32 64 66 33 32 30 38 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=030284df-1cd5-54fc-52df3208">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.16	50013	54.82.32.1	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	692	OUT	GET /s/31327?bidder_id=14481&bidder_uuid=ZYFg05BR8MuggUMSNtG2uQAA%261526&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:29 UTC	530	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Length: 0 Connection: close Location: /s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZYFg05BR8MuggUMSNtG2uQAA%261526&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=a0aee609296845dea5d3b77df9a421f0 Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:29 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.16	50026	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	3255	OUT	GET /gampad/ads?pvsid=3694862415250323&correlator=363531866443330&eid=31079783%2C44807747%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&trt=2&iu_parts=5302%2Cdesktop%2Cdesktop-Web-pt%2CApps%2CProgrampage%2CATF_MPU_First%2CATF_Notificationbar%2CATF_Leaderboard_First&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5%2C%2F0%2F1%2F2%2F3%2F4%2F6%2C%2F0%2F1%2F2%2F3%2F4%2F7&prev_iu_szs=300x600%7C300x250%7C300x180%7C300x150%7C250x250%7C200x200%7C180x150%7C160x600%7C120x600%2C320x50%2C1x1%7C970x250%7C970x90%7C960x90%7C950x90%7C728x90%7C500x90%7C468x90%7C468x60&fluid=0%2Cheight%2C0&ifi=2&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1702977741720&lmt=1702977741&adxs=939%2C0%2C147&adys=424%2C0%2C258&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=2%7C3%7C4&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fcaffeine.softonic.com.br%2F&vis=1&psz=300x0%7C1263x0%7C970x0&msz=300x0%7C1263x0%7C970x0&fws=512%2C4%2C4&ohw=0%2C1263%2C970&ga_vid=430166992.1702977739&ga_sid=1702977742&ga_hid=1147585949&ga_fc=true&td=1&topics=9&tps=9&htps=10&a3p=EhsKDGlkNS1zeW5jLmNvbRiIx4iLyDFIAFICCGQ.&nt=1&psd=WzE1LFsyLFtbIi81MzAyL2Rlc2t0b3AvZGVza3RvcC1XZWItcHQvQXBwcy9Qcm9ncmFtcGFnZS9BVEZfTVBVX0ZpcnN0IixbXV0sWyIvNTMwMi9kZXNrdG9wL2Rlc2t0b3AtV2ViLXB0L0FwcHMvUHJvZ3JhbXBhZ2UvQVRGX05vdGlmaWNhdGlvbmJhciIsW11dLFsiLzUzMDIvZGVza3RvcC9kZXNrdG9wLVdlYi1wdC9BcHBzL1Byb2dyYW1wYWdlL0FURl9MZWFkZXJib2FyZF9GaXJzdCIsW11dXV0sbnVsbCwzXQ..&dlt=1702977735228&idt=6425&prev_scp=pos%3Dtop%26countryCluster%3DA1%26td-slot%3Dtop-mpu-1%26hvi%3Dfalse%26type%3Dtop_display_mpu%26afcSlotId%3D1217021608%26amznbid%3D2%26amznp%3D2%7Cpos%3Dtop%26countryCluster%3DA1%26td-slot%3Dnative-notificationbar%26hvi%3Dfalse%26type%3Dnative_notificationbar%26devicePlatformId%3Dwindows%7Cpos%3Dtop%26countryCluster%3DA1%26td-slot%3Dtop-leaderboard-1%26hvi%3Dfalse%26type%3Dtop_display_leaderboard%26amznbid%3D2%26amznp%3D2&cust_params=medium%3Dorganic%26campaign%3D%26source%3Dnone%26medium_campaign%3Dorganic%26medium_source%3Dorganic-none%26file%3Df46a4db4-96d4-11e6-b215-00163ec9f5fa%26reviewvecna%3Dfalse%26recat%3Dutilities-tools%26hosted%3Dfalse%26compliant%3D1%26devel%3D0%26locale%3Dpt-BR%26author%3DZhornsoftware%26content%3Drich%26country%3DUS%26region%3DA%26platformId%3Dwindows%26ad_session_id%3Dca334998-1875-4288-9025-8f913da6a89a%26pv%3D1%26ab_upr%3D6%26personalized%3D1&adks=4226504758%2C3804165121%2C1886130427&frm=20 HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:30 UTC	854	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Observe-Browsing-Topics: ?1 Google-LineItem-Id: 5793499325,5540562854,6152614789 Google-Creative-Id: 138364319192,138331392148,138449331653 Google-MediationGroup-Id: -2,-2,-2 Google-MediationTag-Id: -2 Date: Tue, 19 Dec 2023 09:22:29 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/plain; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:30 UTC	398	IN	Data Raw: 37 38 65 37 0d 0a 7b 22 2f 35 33 30 32 2f 64 65 73 6b 74 6f 70 2f 64 65 73 6b 74 6f 70 2d 57 65 62 2d 70 74 2f 41 70 70 73 2f 50 72 6f 67 72 61 6d 70 61 67 65 2f 41 54 46 5f 4d 50 55 5f 46 69 72 73 74 22 3a 5b 22 68 74 6d 6c 22 2c 31 2c 30 2c 6e 75 6c 6c 2c 31 2c 32 35 30 2c 33 30 30 2c 30 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 2c 5b 5b 22 49 44 3d 32 63 35 39 36 62 30 66 34 66 62 35 34 39 34 36 3a 54 3d 31 37 30 32 39 37 37 37 34 39 3a 52 54 3d 31 37 30 32 39 37 37 37 34 39 3a 53 3d 41 4c 4e 49 5f 4d 59 46 79 61 76 32 38 69 4f 59 6c 76 44 55 53 54 67 39 38 76 64 70 75 57 37 78 6d 41 22 2c 31 37 33 36 36 37 33 37 34 39 2c 22 2f 22 2c 22 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 22 2c 31 5d 2c 5b 22 55 49 44 3d 30 30 30 30 30 64 61 62 Data Ascii: 78e7{"/5302/desktop/desktop-Web-pt/Apps/Programpage/ATF_MPU_First":["html",1,0,null,1,250,300,0,0,null,null,null,1,[["ID=2c596b0f4fb54946:T=1702977749:RT=1702977749:S=ALNI_MYFyav28iOYlvDUSTg98vdpuW7xmA",1736673749,"/","softonic.com.br",1],["UID=00000dab
2023-12-19 09:22:30 UTC	1252	IN	Data Raw: 39 38 30 38 31 34 34 5d 2c 5b 32 39 30 39 32 38 36 39 32 30 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 41 4f 72 59 47 73 6e 73 53 49 58 50 73 79 6c 68 31 73 68 30 6a 45 56 50 72 6d 30 55 73 2d 61 63 4e 74 37 30 53 69 73 34 35 31 71 5f 6d 76 73 74 75 46 63 57 49 65 44 75 65 6b 72 4a 6a 67 77 64 78 48 50 67 36 31 4a 35 6c 50 38 30 72 65 70 59 65 58 37 6b 6a 59 46 38 4a 77 4f 56 55 71 6f 30 31 33 4f 77 43 46 4a 75 55 4e 73 22 2c 22 43 4b 4f 4b 7a 37 36 57 6d 34 4d 44 46 51 73 76 69 67 4d 64 43 33 73 4b 69 51 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 Data Ascii: 9808144],[2909286920],null,null,null,null,null,null,null,1,null,null,null,null,null,null,"AOrYGsnsSIXPsylh1sh0jEVPrm0Us-acNt70Sis451q_mvstuFcWIeDuekrJjgwdxHPg61J5lP80repYeX7kjYF8JwOVUqo013OwCFJuUNs","CKOKz76Wm4MDFQsvigMdC3sKiQ",null,null,null,null,null,nu
2023-12-19 09:22:30 UTC	1252	IN	Data Raw: 33 39 37 32 39 32 31 31 30 39 35 32 39 39 35 31 22 2c 22 2d 38 37 39 37 35 38 39 37 38 31 35 37 33 34 35 30 33 33 34 22 2c 22 31 33 33 37 36 37 37 31 38 31 37 36 38 32 39 38 30 38 33 22 2c 22 32 39 39 33 37 31 37 36 36 30 33 35 36 30 35 38 35 32 31 22 2c 22 2d 38 37 33 30 37 37 35 31 32 34 32 30 32 37 30 30 36 39 38 22 2c 22 31 36 36 33 33 37 35 33 31 30 36 34 36 30 33 39 32 30 39 22 2c 22 2d 38 37 34 39 38 30 32 35 31 34 35 39 39 39 34 32 38 39 22 2c 22 37 33 37 39 36 30 31 35 33 30 39 32 36 38 32 34 37 33 39 22 2c 22 35 32 32 32 39 37 34 34 35 32 32 36 38 36 37 31 39 36 30 22 2c 22 2d 35 34 38 32 35 33 39 34 33 35 39 37 38 30 38 38 32 36 38 22 2c 22 32 33 39 33 33 38 38 35 34 33 33 37 35 35 31 36 33 37 35 22 2c 22 2d 34 39 30 39 32 37 30 38 34 32 36 37 Data Ascii: 3972921109529951","-8797589781573450334","1337677181768298083","2993717660356058521","-8730775124202700698","1663375310646039209","-874980251459994289","7379601530926824739","5222974452268671960","-5482539435978088268","2393388543375516375","-490927084267
2023-12-19 09:22:30 UTC	1252	IN	Data Raw: 35 2c 36 33 33 2c 34 33 36 39 2c 34 34 33 2c 37 34 35 2c 31 36 35 31 2c 31 34 31 2c 34 38 36 31 2c 32 38 35 39 2c 33 31 36 31 2c 32 32 35 35 2c 34 35 35 39 2c 33 37 36 35 2c 34 32 30 34 2c 35 38 30 2c 33 32 39 38 2c 32 39 39 36 2c 31 34 38 36 2c 32 30 39 30 2c 35 30 32 36 2c 34 37 32 34 2c 34 35 38 37 2c 34 38 38 39 2c 33 37 33 37 2c 34 33 34 31 2c 31 36 32 33 2c 31 33 32 31 2c 31 31 33 2c 34 31 35 2c 37 31 37 2c 35 31 39 31 2c 33 32 37 30 2c 32 36 36 36 2c 34 34 35 30 2c 33 38 37 34 2c 34 31 37 36 2c 35 30 35 34 2c 34 33 31 33 2c 34 30 31 31 2c 38 35 34 2c 32 35 30 31 2c 31 34 35 38 2c 35 35 32 2c 32 38 30 33 2c 33 39 38 36 2c 32 35 30 2c 36 30 2c 33 36 38 34 2c 34 32 38 38 2c 31 35 37 30 2c 35 30 35 37 2c 39 36 36 2c 36 36 34 2c 32 33 31 31 2c 34 36 31 Data Ascii: 5,633,4369,443,745,1651,141,4861,2859,3161,2255,4559,3765,4204,580,3298,2996,1486,2090,5026,4724,4587,4889,3737,4341,1623,1321,113,415,717,5191,3270,2666,4450,3874,4176,5054,4313,4011,854,2501,1458,552,2803,3986,250,60,3684,4288,1570,5057,966,664,2311,461
2023-12-19 09:22:30 UTC	1252	IN	Data Raw: 33 37 34 33 2c 31 31 33 37 2c 32 32 30 38 2c 32 35 31 30 2c 31 34 33 39 2c 31 37 34 31 2c 38 33 35 2c 35 33 33 2c 39 34 2c 33 39 36 2c 36 39 38 2c 33 38 35 35 2c 34 39 35 31 2c 31 39 30 36 2c 32 36 34 37 2c 34 31 35 37 2c 32 39 34 39 2c 34 36 34 39 2c 35 32 35 33 2c 34 38 31 34 2c 36 37 30 2c 36 36 2c 32 37 38 34 2c 32 33 31 2c 34 32 39 34 2c 33 39 39 32 2c 33 33 38 38 2c 33 38 32 37 2c 33 35 32 35 2c 35 30 35 2c 38 30 37 2c 35 32 38 31 2c 34 34 33 31 2c 34 36 37 37 2c 34 39 37 39 2c 32 30 33 2c 33 32 32 33 2c 32 36 31 39 2c 36 34 32 2c 39 34 34 2c 33 36 36 32 2c 33 33 36 30 2c 34 32 36 36 2c 32 34 35 34 2c 35 31 34 34 2c 34 35 34 30 2c 34 38 34 32 2c 31 32 34 36 2c 35 30 30 37 2c 34 37 30 35 2c 32 38 37 35 2c 33 31 37 37 2c 34 30 38 33 2c 33 36 31 36 2c Data Ascii: 3743,1137,2208,2510,1439,1741,835,533,94,396,698,3855,4951,1906,2647,4157,2949,4649,5253,4814,670,66,2784,231,4294,3992,3388,3827,3525,505,807,5281,4431,4677,4979,203,3223,2619,642,944,3662,3360,4266,2454,5144,4540,4842,1246,5007,4705,2875,3177,4083,3616,
2023-12-19 09:22:30 UTC	1252	IN	Data Raw: 2c 33 35 36 36 2c 32 33 35 38 2c 34 31 37 30 2c 35 31 33 32 2c 36 38 33 2c 37 39 2c 31 38 39 31 2c 32 31 39 33 2c 32 37 39 37 2c 31 35 38 39 2c 34 30 30 35 2c 35 32 39 37 2c 34 39 39 35 2c 34 36 39 33 2c 38 32 30 2c 34 31 34 32 2c 34 35 35 36 2c 33 38 34 30 2c 32 31 36 2c 32 30 32 38 2c 35 31 38 2c 32 39 33 34 2c 35 31 36 30 2c 36 33 30 2c 33 32 38 2c 31 38 33 38 2c 32 36 2c 32 37 34 34 2c 33 30 34 36 2c 35 30 34 38 2c 34 37 34 36 2c 33 37 38 37 2c 33 34 38 35 2c 34 36 35 2c 34 33 39 31 2c 31 30 36 39 2c 31 36 33 2c 31 33 37 31 2c 33 31 38 33 2c 37 36 37 2c 32 35 37 39 2c 34 39 31 31 2c 34 36 30 39 2c 35 32 31 33 2c 33 39 32 34 2c 34 32 32 36 2c 34 34 37 32 2c 33 30 30 2c 32 34 31 34 2c 32 37 31 36 2c 33 33 32 30 2c 34 37 37 34 2c 31 35 30 38 2c 31 38 31 Data Ascii: ,3566,2358,4170,5132,683,79,1891,2193,2797,1589,4005,5297,4995,4693,820,4142,4556,3840,216,2028,518,2934,5160,630,328,1838,26,2744,3046,5048,4746,3787,3485,465,4391,1069,163,1371,3183,767,2579,4911,4609,5213,3924,4226,4472,300,2414,2716,3320,4774,1508,181
2023-12-19 09:22:30 UTC	1252	IN	Data Raw: 2c 34 36 32 35 2c 34 32 36 37 2c 33 36 36 33 2c 37 38 30 2c 33 38 30 30 2c 31 37 36 2c 34 37 38 2c 33 31 39 36 2c 34 37 39 30 2c 33 30 33 31 2c 33 39 33 37 2c 31 38 32 33 2c 33 31 33 2c 31 31 2c 34 36 35 33 2c 36 31 35 2c 35 32 35 37 2c 31 32 33 2c 33 34 34 35 2c 37 32 37 2c 34 39 38 30 2c 34 33 35 31 2c 31 33 33 31 2c 35 32 38 32 2c 34 35 34 31 2c 34 38 34 33 2c 32 32 33 37 2c 35 31 34 35 2c 33 38 38 34 2c 35 36 32 2c 33 35 38 32 2c 32 36 30 2c 32 36 37 36 2c 31 31 36 36 2c 31 37 37 30 2c 38 36 34 2c 34 37 30 36 2c 32 35 31 31 2c 35 30 30 38 2c 33 31 31 35 2c 34 33 32 33 2c 31 36 30 35 2c 31 33 30 33 2c 31 30 30 31 2c 34 38 37 31 2c 36 39 39 2c 33 39 37 2c 35 31 37 33 2c 34 35 36 39 2c 33 32 35 32 2c 35 30 33 36 2c 32 33 34 36 2c 34 37 33 34 2c 32 33 32 Data Ascii: ,4625,4267,3663,780,3800,176,478,3196,4790,3031,3937,1823,313,11,4653,615,5257,123,3445,727,4980,4351,1331,5282,4541,4843,2237,5145,3884,562,3582,260,2676,1166,1770,864,4706,2511,5008,3115,4323,1605,1303,1001,4871,699,397,5173,4569,3252,5036,2346,4734,232
2023-12-19 09:22:30 UTC	1252	IN	Data Raw: 30 33 34 2c 34 33 33 36 2c 33 35 36 37 2c 33 38 36 39 2c 34 37 35 30 2c 35 30 35 32 2c 31 33 31 36 2c 37 31 32 2c 31 30 38 2c 34 31 30 2c 33 35 34 32 2c 33 38 34 34 2c 32 33 33 34 2c 32 32 30 2c 32 36 33 36 2c 34 34 37 33 2c 34 34 34 38 2c 33 32 34 30 2c 34 36 33 38 2c 34 37 37 35 2c 38 32 34 2c 33 30 37 35 2c 34 32 38 33 2c 33 36 37 39 2c 34 39 34 30 2c 35 32 34 32 2c 34 35 30 31 2c 34 38 30 33 2c 31 32 36 33 2c 34 31 31 38 2c 39 36 31 2c 36 35 39 2c 35 35 2c 35 31 30 35 2c 32 39 31 30 2c 33 32 31 32 2c 32 36 30 38 2c 32 33 30 36 2c 34 32 35 35 2c 37 39 36 2c 35 32 37 30 2c 31 34 30 30 2c 34 36 36 36 2c 34 39 36 38 2c 31 39 37 36 2c 34 36 36 2c 37 36 38 2c 36 33 31 2c 33 32 39 2c 32 38 38 32 2c 33 37 38 38 2c 34 30 39 30 2c 35 31 33 33 2c 34 35 32 39 2c Data Ascii: 034,4336,3567,3869,4750,5052,1316,712,108,410,3542,3844,2334,220,2636,4473,4448,3240,4638,4775,824,3075,4283,3679,4940,5242,4501,4803,1263,4118,961,659,55,5105,2910,3212,2608,2306,4255,796,5270,1400,4666,4968,1976,466,768,631,329,2882,3788,4090,5133,4529,
2023-12-19 09:22:30 UTC	1252	IN	Data Raw: 31 35 37 31 2c 32 34 37 37 2c 33 33 38 33 2c 34 36 37 35 2c 34 39 37 37 2c 38 30 32 2c 31 39 38 2c 34 31 32 34 2c 34 34 32 36 2c 32 36 31 34 2c 31 31 30 34 2c 35 30 30 2c 31 34 30 36 2c 34 35 33 38 2c 32 30 31 30 2c 34 38 34 30 2c 35 31 34 32 2c 36 31 32 2c 39 31 34 2c 38 2c 31 38 32 30 2c 33 31 30 2c 33 39 33 34 2c 35 30 33 30 2c 34 37 32 38 2c 33 33 33 30 2c 37 34 39 2c 31 34 35 2c 34 34 37 2c 34 33 37 33 2c 33 34 36 37 2c 32 38 36 33 2c 32 32 35 39 2c 34 35 39 31 2c 34 38 39 33 2c 35 31 39 35 2c 35 30 35 38 2c 33 33 30 32 2c 34 37 35 36 2c 32 36 39 38 2c 33 39 30 36 2c 32 33 39 36 2c 38 38 36 2c 34 39 32 31 2c 34 36 31 39 2c 35 32 32 33 2c 34 33 34 35 2c 33 37 34 31 2c 33 35 37 36 2c 37 32 31 2c 34 31 39 2c 31 31 37 2c 31 36 32 37 2c 31 32 37 39 2c 31 Data Ascii: 1571,2477,3383,4675,4977,802,198,4124,4426,2614,1104,500,1406,4538,2010,4840,5142,612,914,8,1820,310,3934,5030,4728,3330,749,145,447,4373,3467,2863,2259,4591,4893,5195,5058,3302,4756,2698,3906,2396,886,4921,4619,5223,4345,3741,3576,721,419,117,1627,1279,1
2023-12-19 09:22:30 UTC	1252	IN	Data Raw: 2c 32 35 32 31 2c 31 39 31 37 2c 31 33 31 33 2c 34 36 36 30 2c 35 32 36 34 2c 35 31 32 37 2c 34 35 32 33 2c 32 32 31 39 2c 34 38 32 35 2c 33 38 36 36 2c 33 32 36 32 2c 32 39 36 30 2c 32 33 35 36 2c 31 31 34 38 2c 31 34 35 30 2c 34 39 39 30 2c 35 32 39 32 2c 32 34 32 2c 38 34 36 2c 35 34 34 2c 34 36 38 38 2c 33 30 39 37 2c 34 30 30 33 2c 34 33 30 35 2c 33 38 33 38 2c 34 31 34 30 2c 34 34 34 32 2c 33 35 33 36 2c 34 38 35 33 2c 36 38 31 2c 34 35 35 31 2c 31 35 35 39 2c 31 32 35 37 2c 35 33 32 30 2c 31 38 36 31 2c 34 37 31 36 2c 35 30 31 38 2c 33 39 37 35 2c 32 31 34 2c 35 31 36 2c 33 36 37 33 2c 38 31 38 2c 32 34 36 35 2c 31 34 32 32 2c 31 31 32 30 2c 32 34 34 30 2c 32 37 36 37 2c 33 30 34 34 2c 32 37 34 32 2c 33 36 34 38 2c 33 39 35 30 2c 34 32 35 32 2c 35 Data Ascii: ,2521,1917,1313,4660,5264,5127,4523,2219,4825,3866,3262,2960,2356,1148,1450,4990,5292,242,846,544,4688,3097,4003,4305,3838,4140,4442,3536,4853,681,4551,1559,1257,5320,1861,4716,5018,3975,214,516,3673,818,2465,1422,1120,2440,2767,3044,2742,3648,3950,4252,5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.16	50014	207.198.113.203	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	612	OUT	GET /dmp/pixelSync?nid=48 HTTP/1.1 Host: pixel-sync.sitescout.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:29 UTC	339	IN	HTTP/1.1 302 set-cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; Domain=.sitescout.com; Expires=Wed, 18-Dec-2024 09:22:29 GMT; Path=/; Secure; SameSite=None location: https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=48 content-length: 0 date: Tue, 19 Dec 2023 09:22:29 GMT server: A connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.16	49999	162.55.236.225	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	739	OUT	GET /056f32ee5cf49404607e368bd8d3f2af/?gdpr=0&euconsent=&uid=9f860467-d79c-45d4-bcf9-51ad3d856e68 HTTP/1.1 Host: sync.richaudience.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pdid=64f4bbfb-8ac7-4d56-b41c-1zz1702977725; raibs=1
2023-12-19 09:22:29 UTC	438	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Tue, 19 Dec 2023 09:22:09 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.2.4 P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: avcid-imd-uid=9f860467-d79c-45d4-bcf9-51ad3d856e68; expires=Mon, 18 Mar 2024 09:22:09 GMT; Max-Age=7776000; path=/; domain=.richaudience.com; secure; HttpOnly; SameSite=None
2023-12-19 09:22:29 UTC	106	IN	Data Raw: 35 66 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 5fPNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.16	50042	74.119.119.150	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	564	OUT	GET /dis/usersync.aspx?r=70&p=120&cp=adyoulike&cu=1&url=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fis_cookie_sync_uid%3Dtrue%26uid%3D4246a50e6cf42e85f26c381a4b7701fb%26name%3DCRITEO%26visitor%3D%40%40CRITEO_USERID%40%40 HTTP/1.1 Host: dis.criteo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:29 UTC	441	IN	HTTP/1.1 200 OK content-type: image/gif date: Tue, 19 Dec 2023 09:22:29 GMT server: Kestrel cache-control: no-cache expires: Tue, 19 Dec 2023 00:00:00 GMT pragma: no-cache transfer-encoding: chunked x-errorlevel: 0 p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" cross-origin-resource-policy: cross-origin server-processing-duration-in-ticks: 392531 strict-transport-security: max-age=31536000; preload; connection: close
2023-12-19 09:22:29 UTC	54	IN	Data Raw: 32 42 0d 0a 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2BGIF89a!,D;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.16	50017	67.202.105.32	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	974	OUT	GET /deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 HTTP/1.1 Host: hde.tynt.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uid=4Qap4mWBYNTCgISUJp6ICw==
2023-12-19 09:22:30 UTC	1033	IN	HTTP/1.1 200 cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false expires: Sat, 26 Jul 1997 05:00:00 GMT accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile set-cookie: pids=%5B%7B%22p%22%3A%22797f54a72d%22%2C%22f%22%3A1%2C%22ts%22%3A1702977749920%7D%2C%7B%22p%22%3A%224bee518595%22%2C%22f%22%3A1%2C%22ts%22%3A1702977749920%7D%2C%7B%22p%22%3A%227daaa56bb0%22%2C%22f%22%3A1%2C%22ts%22%3A1702977749920%7D%2C%7B%22p%22%3A%2224c05c7b76%22%2C%22f%22%3A1%2C%22ts%22%3A1702977749920%7D%2C%7B%22p%22%3A%22d26852f088%22%2C%22f%22%3A1%2C%22ts%22%3A1702977749920%7D%2C%7B%22p%22%3A%22f9a4a8fd15%22%2C%22f%22%3A1%2C%22ts%22%3A1702977749920%7D%5D;Version=1;Comment=;SameSite=None;Domain=tynt.com;Path=/;Max-Age=7776000;Secure referrer-policy: unsafe-url content-type: text/html content-length: 1710 date: Tue, 19 Dec 2023 09:22:29 GMT p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" connection: close
2023-12-19 09:22:30 UTC	1710	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 69 2c 64 3d 64 6f 63 75 6d 65 6e 74 2c 70 3d 22 75 6e 73 61 66 65 2d 75 72 6c 22 2c 65 2c 73 2c 74 2c 75 3d 5b 22 68 74 74 70 73 3a 2f 2f 73 73 63 2d 63 6d 73 2e 33 33 61 63 72 6f 73 73 2e 63 6f 6d 2f 70 73 2f 3f 5f 3d 31 37 30 32 39 37 37 37 34 39 39 32 30 2e 26 72 69 3d 30 30 31 35 61 30 30 30 30 33 48 6c 6a 48 79 41 41 4a 26 67 64 70 72 5f 35 38 3d 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 75 73 5f 70 72 69 76 61 63 79 3d 26 72 75 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 76 69 73 69 74 6f 72 2d 75 73 2d 77 65 73 74 2d 32 2e 6f 6d 6e 69 Data Ascii: <!doctype html><html><head></head><body><script>(function(){var i,d=document,p="unsafe-url",e,s,t,u=["https://ssc-cms.33across.com/ps/?_=1702977749920.&ri=0015a00003HljHyAAJ&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fvisitor-us-west-2.omni

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.16	50049	104.18.36.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	824	OUT	GET /rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:29 UTC	1227	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Length: 0 Connection: close Location: https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZYFg02kDskXAcMABkyNPagAA CF-Ray: 837e94d8ad09b3e5-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:29 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPS=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:29 GMT; Max-Age=7776000; Secure; SameSite=None Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:29 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j5jmmzHf2sbKjHxg4oMFTS9kYvPWIAovZibafiQS2UmkTNOTbyeEJV20X5Rn0QFXR%2F88GMrvewPP4qVAlVFxEG%2BcldVTga7IVRnsT%2Bg0gdr3s4pGp%2Fi33Wi9LJf26Gzf0J2iwm7KYfPi6g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.16	50036	172.64.151.101	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	916	OUT	GET /usermatch?us_privacy=1---&d=https%3A%2F%2Fcaffeine.softonic.com.br%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F HTTP/1.1 Host: ssum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://js-sec.indexww.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:29 UTC	990	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Ray: 837e94d8be458dfa-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:29 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:29 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MbfVfP2QGYA9Neb4PC6eXDHGUW4p0iQSr%2Bk%2BowMFTTSz3Alp0knHl4NvxN36Pbz4UncB3P4rO5mx40ruXCCuGfAGki5Pk59H9LsyiNFCRifkdMQLuiEwKJVJdYscn8j8NdUrVtV9OZFNOw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:29 UTC	379	IN	Data Raw: 37 64 31 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 2e 61 64 6e 78 73 2e 63 6f 6d 2f 67 65 74 75 69 64 3f 68 74 74 70 73 3a 2f 2f 64 73 75 6d 2d 73 65 63 2e 63 61 73 61 6c 65 6d 65 64 69 61 2e 63 6f 6d 2f 63 72 75 6d 3f 63 6d 5f 64 73 70 5f 69 64 3d 34 36 26 61 6d 70 3b 65 78 74 65 72 6e 61 6c 5f 75 73 65 72 5f 69 64 3d 24 55 49 44 26 61 6d 70 3b 75 73 5f 70 72 69 76 61 63 79 3d 31 2d 2d 2d 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 20 77 69 64 74 68 3d 22 30 22 20 68 65 69 67 68 74 3d 22 30 22 20 61 6c 74 3d 22 22 20 62 6f 72 64 65 72 3d 22 30 22 20 2f 3e 3c 69 6d 67 20 73 72 63 Data Ascii: 7d1<html><head><title></title></head><body><img src="https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&us_privacy=1---" style="display:none" width="0" height="0" alt="" border="0" /><img src
2023-12-19 09:22:29 UTC	1369	IN	Data Raw: 70 70 3d 26 61 6d 70 3b 67 70 70 5f 73 69 64 3d 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 20 77 69 64 74 68 3d 22 30 22 20 68 65 69 67 68 74 3d 22 30 22 20 61 6c 74 3d 22 22 20 62 6f 72 64 65 72 3d 22 30 22 20 2f 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 2e 73 74 69 63 6b 79 61 64 73 74 76 2e 63 6f 6d 2f 75 73 65 72 2d 72 65 67 69 73 74 65 72 69 6e 67 3f 64 61 74 61 50 72 6f 76 69 64 65 72 49 64 3d 31 30 32 35 26 61 6d 70 3b 75 73 65 72 49 64 3d 5a 59 46 67 30 32 6b 44 73 6b 58 41 63 4d 41 42 6b 79 4e 50 61 67 41 41 43 75 34 41 41 41 49 42 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 61 6d 70 3b 75 73 5f 70 72 69 76 61 63 79 3d 31 2d 2d 2d 26 61 6d 70 3b 67 64 70 72 3d 26 61 6d 70 3b 67 70 70 3d Data Ascii: pp=&gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://ads.stickyadstv.com/user-registering?dataProviderId=1025&userId=ZYFg02kDskXAcMABkyNPagAACu4AAAIB&gdpr_consent=&us_privacy=1---&gdpr=&gpp=
2023-12-19 09:22:29 UTC	260	IN	Data Raw: 26 61 6d 70 3b 67 70 70 5f 73 69 64 3d 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 20 77 69 64 74 68 3d 22 30 22 20 68 65 69 67 68 74 3d 22 30 22 20 61 6c 74 3d 22 22 20 62 6f 72 64 65 72 3d 22 30 22 20 2f 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 6e 64 65 78 77 77 2e 63 6f 6d 2f 68 74 2f 68 74 77 2d 70 69 78 65 6c 2e 67 69 66 3f 5a 59 46 67 30 32 6b 44 73 6b 58 41 63 4d 41 42 6b 79 4e 50 61 67 41 41 25 32 36 32 37 39 38 3d 26 61 6d 70 3b 75 73 5f 70 72 69 76 61 63 79 3d 31 2d 2d 2d 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 20 77 69 64 74 68 3d 22 30 22 20 68 65 69 67 68 74 3d 22 30 22 20 61 6c 74 3d 22 22 20 62 6f 72 64 65 72 3d 22 30 22 20 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 Data Ascii: &gpp_sid=" style="display:none" width="0" height="0" alt="" border="0" /><img src="https://cdn.indexww.com/ht/htw-pixel.gif?ZYFg02kDskXAcMABkyNPagAA%262798=&us_privacy=1---" style="display:none" width="0" height="0" alt="" border="0" /></body></ht
2023-12-19 09:22:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.16	50034	68.67.181.211	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	923	OUT	GET /bounce?%2Fgetuid%3Fhttps%253A%252F%252Fvisitor-us-west-2.omnitagjs.com%252Fvisitor%252Fsync%253Fname%253DXandr%252B%2525E2%252580%252593%252BInvest%252BDSP%2526ttl%253D720%2526uid%253D48d5713d5c563cba2049f505b2d944b6%2526visitor%253D%2524UID%2526gdpr%253D0%2526gdpr_consent%253D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018
2023-12-19 09:22:30 UTC	1144	IN	HTTP/1.1 302 Found Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=6663647625574893018&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= AN-X-Request-Uuid: d57b47e1-a01e-4e73-9b04-c9ad9c3cc44f Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:29 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.16	50059	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	881	OUT	GET /cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: bitoIsSecure=ok; bito=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:30 UTC	594	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:30 GMT location: https://bh.contextweb.com/bh/rtset?ev=AACk507LAsIAABM7-sg6gA&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Csyn%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0 Server: gunicorn set-cookie: bito=AACk507LAsIAABM7-sg6gA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:30 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.16	50035	68.67.181.211	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	940	OUT	GET /bounce?%2Fgetuid%3Fhttps%253A%252F%252Fvisitor-us-west-2.omnitagjs.com%252Fvisitor%252Fsync%253Fname%253DXandr%252B%2525E2%252580%252593%252BInvest%252BDSP%252B-%252BBanner%2526ttl%253D720%2526uid%253D75d56568a11564bfb79a01d2fa9fdb29%2526visitor%253D%2524UID%2526gdpr%253D0%2526gdpr_consent%253D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018
2023-12-19 09:22:30 UTC	1153	IN	HTTP/1.1 302 Found Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=6663647625574893018&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= AN-X-Request-Uuid: f48aa402-7ea0-47e7-b1e7-4b0f8c6aa0e8 Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:29 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.16	50029	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	1198	OUT	GET /pcs/view?xai=AKAOjsvsnASaC-WJAIa4dpNXbOvXaR38eH0MKD_V9HkpTl6-s_-pDi3imX72Ebc7M0YMLhO-Gt6TgrmeI_y6FRgvLts71CCwjQdNCPi_JzhjEKx3R3NFG6JXOwo_ztqWoIB8dUGYclD8cBewvoMxTtPSN7iNh9czNErlmOiFZ3dwqoOjV0pK8OCfnuKWN20iPkagjhvh5WLeJ6M_pr1394pye0FydAvERYxr5odc9q8V5aaijS7js6WUUmu4EuQFq7rbQ_4RPozZGl5L_8f7UoD1bcCkiZJB3hMzZPX9VO73DI_EFdLKTFjwM6xNVc9qCKjjrtii0-xOHQmm2wzHOzXh4kXq171XED75KDcOKC7MJ3w-1esSTf_9XgdG_DMss325kRzeJ6VZd3xbqOCRsx9ozcg3nSdIeqVNu0MEWIX_akJcC-1eBJj4Rjj87rBfhZm-CuirSeSi&sai=AMfl-YRPPcLfgAnLmu-HcYTh435wxVnqQ27PveSaL0rmf2EjfGRfHnkQE_aMED0KZPVWzGtQFMqfzXpnK1hr0EB9TAGF2AM14mLbvU2rs_GyMgtqSZk_Vn9o_13x7K1XCw&sig=Cg0ArKJSzPbmLxxj6AvAEAE&uach_m=%5BUACH%5D&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:30 UTC	792	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:30 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.16	50032	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	1209	OUT	GET /pcs/view?xai=AKAOjsuBo2OGG1kJXBWi--r68AbKF--cLAMouyohqXwjwBhkHR4kG1Cb2WgB5PLvD-OfKuN6SAX0bSdcs-8Tnk2D-WPP5lqoYT4G8faTdX9aCokMdvZMtFKcGzW9QlYdwh1d__3W-pHSYME8rdFxA8wfBNJdm_H1YOZ476dR5asV8ll4Pu_aLWm6sp-8QFGyDYh57kE46dYBjbgPafvDC0LFTQck-KE6t9IfGvdFa2X1mQyzfCbWvuUZdcJ5yrdmAjRCdcvlWkJOE6yKJNkESS2i7Saetk3Fsmh8JJH4ClBThvijAPUVVp0gPs-TRu175BQ7GUho0HuH09q_D_ZWyGdB8d_7b5Dg0VdjBrJ-cg2CU2laNQldh60WZXhqfYpdws3Bdb4hTQGSB_JlUqE-2lgCcl1ZstMfZki2tGOt-QM_bf-2-sg-tGY3RGrUClicJ7GtFkjczZv0dDBPpSm-pf4&sai=AMfl-YS4BAe5YTqjEGJxf8MDUyACDwFtzRMzflTyVfNMZ2khzVS5W5V6WEv6mjKBvO8v7p4DyNfZ63qwpAc6OtjjcfbYACcPNdnIEhL12R32MMue5_FHUqdknHoydawIoA&sig=Cg0ArKJSzO8YgrMzDerzEAE&uach_m=%5BUACH%5D&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:30 UTC	792	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:30 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.16	50039	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:29 UTC	1856	OUT	GET /td/auctionwinner?status=nowinner&isContextualWinner=1&hasXfpAds=1&winner_qid=CK-u3ruWm4MDFdDuKAUd1xQP4Q&xfpQid=CJnE3LuWm4MDFdDuKAUd1xQP4Q&ecrs=Aee5mYxb7JdvCRsYbAlCMN4aqdWvjGE71UFLNEb6N2gD11oqzGXW2W-TjHHZ-SS3GqbfSF_-rMBxaj_SUmk0e03TwnyCx_ro4GTe095EBojydfOrF97VUt9A_iPo_66zhPXUTLOc8QJ0CvaB1JbtfcfS36RLaNea_4VZa6dQhiVIqfVLg8noSruVT0GcdLNJeb9jeB_nRHMcq5HU9YPG3k9mzCSYxA1smzt7ZCyNYN3pS0_NIVOB00mGn2b8E8nXAhVoKnbg-x06oCBpAR66rP578CtqIwS3WIi08Mu9lWE-zrnKMg2rs9regM2NNSkISrh-2tv3M3oa2bXhVwJ2mYs5UTGZostoy9PQlkQ5oA3fDfl0tLiYKH_EEuQe91lFrb8dQ9HzaJL6XL4m41WVN7Eu1OizUyMy4tL5qWcbYSHLyR5_AOpNoR6QMbzoi3xpxPdDgsMJdkM4zBDdu34OqFCT9_pV8ejuPHM32JiDsjobR1iCroIyrAcmQLeLpoU3H9d5SkBTGKjGyeJ_1hA6ixWtD7tKoWARjXf0UG6LABQGvAOpY_Bqm7Evq5UsjMwneTP_OKQw23Z221Bp22XgnTSH1GrOeDmaRys-IK93XwnDpkMcr06mNGoH51dEDcCtRRL2xZr68nqnFkvMMPA21f3Iq1Ecmhce2yKDH0KJc-727kQPtZz49kwKV8HC0IsQSMvAOVRTNW0lNM5ZahQv2wSDYzvtJgvQg7HyyAewfjo-cNoBlNdcpsgggmx5_VqC2rjx59gGmjzgOoiPKpgbDAi_8dLo8x0K6g38VgVGHmDTevFouGuh6CMe8e0CJUys6v0xAVr8pIHRZj5gQnl-iCiYcb0DmyQVCm7GeDhMhYsrSaa4-OabY2gVdl87EDvnWQcKePwFvAnVKSjdxgAAbvOZXiCSTKf_8xE_UMwbRcx6AYZKibhR05FWzXvnzns20dho6XNe9VFIKzxceCvKJkipi4X9E32-_GlG6ypKV1SVgmc0IZpix726YG9IfDFz9bZqscuDjPQkBStUpMpgE61DAXg&cid=CAQSOwAvHhf_trxtd5X6ykyKo_UFREQYOgbuBeLqQudwTTX-y5kH5rDfx0tVDY-ID5fQKwdgHu5nCrLJl60oGAE&applied_timeout_ms=0&duration_ms=30 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:30 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:30 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.16	50060	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	663	OUT	GET /cookie-sync/aul?_bee_ppp=1 HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: bito=AABafU7LAsIAABNxgMUHeA; bitoIsSecure=ok
2023-12-19 09:22:30 UTC	444	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:30 GMT location: https://visitor.omnitagjs.com/visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AABafU7LAsIAABNxgMUHeA&name=BEESWAX Server: gunicorn set-cookie: bito=AABafU7LAsIAABNxgMUHeA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:30 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.16	50038	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	1850	OUT	GET /td/auctionwinner?status=nowinner&isContextualWinner=1&hasXfpAds=1&winner_qid=CK2u3ruWm4MDFdDuKAUd1xQP4Q&xfpQid=CJfE3LuWm4MDFdDuKAUd1xQP4Q&ecrs=Aee5mYxVJddiSWZUyZvUNnyzFJssqB0FMy1xuqU_IoKd8B-2kGoovgTv1Bf5FR-amt9i6XuXjpVDsrC3ePcjt3uAOuAd2WmzA-buF5xEbepZfWT3AZKsMni53n6aDGBL5uEMqogy1Mh6JqHAykKy-HTGpr5wkEhhjLotHuLl--kOF5i5F1zjv1vwb1nrZAMt5YPVcOPhe07ZKqzKRj4BJwHi2hLLyplVG1EgEYsz5FuDiHQxyMHk6-507Q_Mtu_JyW8W3EPVQ9Y3Bz7IgZmoXP5_WDkqGRYjr3-kVswfEbxYPt0eS2FyTX1_rY-OoEOasMd57Laplw7XGDel8_tqEO5PkC-DGtOQ41ZpAnejagkGb5r2Dz34n3DlsdIKHxaNDFDgmMT0PRto3VT4BecT-ge5bvGEQXgoB-tnToqmowTznbUqja8Y9f9Lm8UF8sIu1PiwDnQq1rOv3eY3-LlhyET_niBC_xHv4NTQpAB8ZmYbXBlqgIffcI2ENeI9o7fe3CQkXHDsDxrfw96QN7VyNFkEnCkkNGr1htlCuigOwGrr_iH2todoygc_gQDlyO5khUqwTUMWJjvfUgEKx_KB4g4W46lMA5rwyJGTLex3bEVEqm0VSgyspm6Y-jz2MC7o3m6X3sq3r4XSG6jz5hmSJbD_dCwlw_ht2_wOIGVAngZDcAIf_sfy0cUjJzhmOXG5APMLHG9eJLFsHZ0QQCFi44OfRovd4dhEfVnS5ZSogmlOKpE9AlIbntr4-V0hHh78QqlC7YGN-Z0halzGYGdkAtt7HUQT3NXMja-IBsIYGJnDMc5b22w-h6AdMqJAjZrw5moZKg0q_-SZxpyzuKM_oJF2xpFxf852pdu-eURICJoVC_8YEIngXcjPDNH_ToyO7eY_ynEyweJ_HGrjCxGmlw-al5leY_YC5nY6mcd2BbtV47dPwjSQqxo7iRL6sVDX6EX_t2mrFOyBKbRFaGMb0U5ah5gNQ1wOine6k89s1j1wcUoL2IYiMTDN_8l1z7ajLDRZ8jqIrFQvZkOwi56lXw&cid=CAQSOwAvHhf_trxtd5X6ykyKo_UFREQYOgbuBeLqQudwTTX-y5kH5rDfx0tVDY-ID5fQKwdgHu5nCrLJl60oGAE&applied_timeout_ms=0&duration_ms=6 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:30 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:30 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.16	50028	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	1182	OUT	GET /pcs/view?xai=AKAOjstNl1lbgRQpJWOFKxGUq3ETGcRmveUALNGcDY2Hibj2JdVDZfu2JdzKdBXcJp-E9lJzAg9ARDhRCYzxZb935I8yWH4A-LmJcIkijJG9Ky9mhyDK1ehOGQYiMSZBGb3IoQbpbyM4KWCyxY_joWfpR7p6GBi5r1SZvbAvrrzFru1U_-V6RFtz6-te4diAZ2meHd5q14YkvPry34GArKV_KTaBdXLe0wYk-mii261ltfPJKkR6l2-6nGxFDuC2KCl1TmG6JYQXxIzYvjJtCxq1jMWkeeV6naxkTBB4G96Au7hXhHvW-4NGnmOH3bmOhScz4MxxcIj7gFYSr3BCtyrZj7qLVH9CL0h3ePzEQdHyZ_bLcxeqk8F9S1aIeS05CwpCq2zbTnq-oX7pphZNx-G7n_rtcOUie4i88FJHlTVJf8eQ9BDl4hsfGzsz&sai=AMfl-YRDGcKP9Htw-WAjDGltiiUrsaAp9wep7651iBkS7YpQdpA3Oza7l5xeUDxb9BtyhRCO9jw-PDly6iCJ0hneGw38GpveIPTAfzin-Y2ioEbJpvPD7Wo3F1vmXZa0jg&sig=Cg0ArKJSzAtXjQncBuS5EAE&uach_m=%5BUACH%5D&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:30 UTC	792	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:30 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.16	50051	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	631	OUT	GET /cookie-sync/ie HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: checkForPermission=ok
2023-12-19 09:22:30 UTC	367	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:30 GMT location: https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1 Server: gunicorn set-cookie: checkForPermission=ok; Domain=bidr.io; expires=Tue, 19 Dec 2023 09:32:30 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.16	50075	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	716	OUT	GET /dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=13de7dcb-57c4-8911-aa9b-7bf1acf99f35 HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://us-u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:30 UTC	807	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: NY76TFX678CVB9QD7B0N Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:30 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:30 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:30 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.16	50027	44.207.23.148	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	738	OUT	GET /sync/openx/dfcf67f2-dbc2-a0a2-5b42-ef933b9d999c?gdpr=0 HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://us-u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNVggWUCEHejoOWrMKg_iWRcNBcNRzwFEgEBAQGygmWLZQAAAAAA_eMAAA&S=AQAAAqnyANlOCxCBeJXDtSFid_M
2023-12-19 09:22:30 UTC	778	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNVggWUCEHejoOWrMKg_iWRcNBcNRzwFEgEBAQGygmWLZQAAAAAA_eMAAA&S=AQAAAqnyANlOCxCBeJXDtSFid_M; Expires=Wed, 18 Dec 2024 15:22:30 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2023-12-19 09:22:30 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.16	50031	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	1195	OUT	GET /pcs/view?xai=AKAOjss0-uKgOW2vkn6PWXoOFSxW2WqZ_aLAW_y3jSk6QAp_JBSIWd0_detORsRq9vZaMGw3iCd3rJvKLoeZ3omJW71P3-XA4g2cgVmC1uqXfsddDY75rRCM-AXB7q52aXDmcP4OhcgVQVRMbvt6m8gQ3iw7SovJcDSU8vr0a9MiAoV8V1Iy2T-oInDtKV6vtP8BMU1ypLA9jXYxIa9XeVAuxCYlt9uf41tOqXip9je3wiVsFoPrJfwEDukrTLzHCdoyHR6oAHBOvJDiM_c74geoVvouIe6BIw9hSOjXUJZKHGu8MfOkYLPx-0_gkLk9wikzqcjQTlGAZ63hl3kAfUMNaubfet35YabOTnTHHLD8xbXPUjzzNS2C0z5LrSnWRjrydlIwrqtw45c2PcMlhirIXkYKSEu142P1wUg9IMy7HdT8c1qF2cIyGfLMZoO_&sai=AMfl-YRPtfWx-oCZzKdDRDAyRhmVFjzK8ykbs8YlgQDJOgiHnlbF3dejVi5pvSoyGro5UzOYPs5W60HJ4BWqBGlTxfxprOUtrb2SMC875eSZX80x1dPM_AA-UUpH9tu5mg&sig=Cg0ArKJSzCZY-2UmEhQhEAE&uach_m=%5BUACH%5D&urlfix=1&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:30 UTC	792	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:30 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.16	50053	34.96.71.22	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	651	OUT	GET /s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP/1.1 Host: s.company-target.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:30 UTC	688	IN	HTTP/1.1 302 Found Access-Control-Allow-Methods: GET,OPTIONS Access-Control-Allow-Origin: *.casalemedia.com Content-Type: text/html; charset=utf-8 Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1718788950&external_user_id=ae8c4288-8303-465e-8690-01650b07f760 Set-Cookie: tuuid=ae8c4288-8303-465e-8690-01650b07f760; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Set-Cookie: tuuid_lu=1702977750\|ix:0; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Length: 157 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:30 UTC	157	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 73 75 6d 2d 73 65 63 2e 63 61 73 61 6c 65 6d 65 64 69 61 2e 63 6f 6d 2f 63 72 75 6d 3f 63 6d 5f 64 73 70 5f 69 64 3d 31 38 26 61 6d 70 3b 65 78 70 69 72 61 74 69 6f 6e 3d 31 37 31 38 37 38 38 39 35 30 26 61 6d 70 3b 65 78 74 65 72 6e 61 6c 5f 75 73 65 72 5f 69 64 3d 61 65 38 63 34 32 38 38 2d 38 33 30 33 2d 34 36 35 65 2d 38 36 39 30 2d 30 31 36 35 30 62 30 37 66 37 36 30 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1718788950&external_user_id=ae8c4288-8303-465e-8690-01650b07f760">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.16	50044	54.82.32.1	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	692	OUT	GET /s/31327?bidder_id=14481&bidder_uuid=ZYFg02kDskXAcMABkyNPagAA%262798&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:30 UTC	530	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Length: 0 Connection: close Location: /s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZYFg02kDskXAcMABkyNPagAA%262798&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=862509da372042b1b2d97a918fb6e1dd Set-Cookie: lidid=862509da-3720-42b1-b2d9-7a918fb6e1dd; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:30 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.16	50045	35.236.220.17	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	661	OUT	GET /pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID HTTP/1.1 Host: um.simpli.fi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:30 UTC	921	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Type: text/html Content-Length: 142 Connection: close Set-Cookie: suid=230C3A6911DC4BB0ABF9299139F39B54; Path=/; domain=simpli.fi; Expires=Thu, 19-Dec-24 09:22:30 GMT; SameSite=none; Secure; Set-Cookie: suid_legacy=230C3A6911DC4BB0ABF9299139F39B54; Path=/; domain=simpli.fi; Expires=Thu, 19-Dec-24 09:22:30 GMT; Secure; Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=230C3A6911DC4BB0ABF9299139F39B54 Expires: Mon, 18 Dec 2023 09:22:30 GMT Cache-Control: no-cache Strict-Transport-Security: max-age=63072000; includeSubdomains; preload X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
2023-12-19 09:22:30 UTC	142	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.16	50047	15.197.193.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	809	OUT	GET /track/cmf/openx?oxid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://us-u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUYASACKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.
2023-12-19 09:22:30 UTC	647	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Length: 335 Connection: close server: Kestrel location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0&gdpr_consent= set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:30 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUYASADKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.; expires=Thu, 19 Dec 2024 09:22:30 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:30 UTC	335	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 2d 75 2e 6f 70 65 6e 78 2e 6e 65 74 2f 77 2f 31 2e 30 2f 73 64 3f 69 64 3d 35 33 37 30 37 32 39 37 31 26 76 61 6c 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 74 74 64 5f 70 75 69 64 3d 34 62 30 38 30 31 62 36 2d 34 62 36 65 2d 33 32 65 62 2d 36 61 39 35 2d 66 39 36 36 63 34 63 61 35 34 64 35 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 68 74 74 70 73 3a 2f 2f 75 73 2d 75 2e 6f 70 65 6e 78 2e 6e 65 74 2f 77 2f 31 2e 30 2f 73 64 3f 69 64 3d 35 33 37 30 37 32 39 37 31 26 76 61 6c 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 Data Ascii: Redirecting to: <a href="https://us-u.openx.net/w/1.0/sd?id=537072971&val=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0&gdpr_consent=">https://us-u.openx.net/w/1.0/sd?id=537072971&val=134495f3-7e94-4262-b6f5-d75

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.16	50057	68.67.161.208	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	707	OUT	GET /getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D0%26gdpr_consent%3D%26uid%3D$UID HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018
2023-12-19 09:22:30 UTC	1029	IN	HTTP/1.1 302 Found Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=6663647625574893018 AN-X-Request-Uuid: 216b35ed-68af-48f3-bf0c-56c86c40df29 Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:30 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.16	50052	50.31.142.95	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	855	OUT	GET /usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_BANNER%26ttl%3D720%26uid%3Dbdef6bd95b7450b4e62a32db8c7d8c9d%26visitor%3D__ZUID__%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&s=2 HTTP/1.1 Host: b1sync.zemanta.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: zuid=aXQaOqrGBGrZCZrdEc4x
2023-12-19 09:22:30 UTC	623	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 221 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Thu, 01 Dec 1994 16:00:00 GMT Location: https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_BANNER&ttl=720&uid=bdef6bd95b7450b4e62a32db8c7d8c9d&visitor=aXQaOqrGBGrZCZrdEc4x&gdpr=0&gdpr_consent=&gdpr=0 P3p: CP="We do not support P3P header." Pragma: no-cache Set-Cookie: zuid=aXQaOqrGBGrZCZrdEc4x; Path=/; Domain=zemanta.com; Expires=Wed, 18 Dec 2024 09:22:30 GMT; Max-Age=31536000; Secure; SameSite=None Date: Tue, 19 Dec 2023 09:22:30 GMT
2023-12-19 09:22:30 UTC	221	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 76 69 73 69 74 6f 72 2d 75 73 2d 77 65 73 74 2d 32 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 2f 76 69 73 69 74 6f 72 2f 73 79 6e 63 3f 6e 61 6d 65 3d 5a 45 4d 41 4e 54 41 5f 42 41 4e 4e 45 52 26 61 6d 70 3b 74 74 6c 3d 37 32 30 26 61 6d 70 3b 75 69 64 3d 62 64 65 66 36 62 64 39 35 62 37 34 35 30 62 34 65 36 32 61 33 32 64 62 38 63 37 64 38 63 39 64 26 61 6d 70 3b 76 69 73 69 74 6f 72 3d 61 58 51 61 4f 71 72 47 42 47 72 5a 43 5a 72 64 45 63 34 78 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 61 6d 70 3b 67 64 70 72 3d 30 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_BANNER&ttl=720&uid=bdef6bd95b7450b4e62a32db8c7d8c9d&visitor=aXQaOqrGBGrZCZrdEc4x&gdpr=0&gdpr_consent=&gdpr=0">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.16	50061	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	688	OUT	GET /cookie-sync/ie?_bee_ppp=1 HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: bitoIsSecure=ok; bito=AACk507LAsIAABM7-sg6gA; checkForPermission=ok
2023-12-19 09:22:30 UTC	434	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:30 GMT location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AACk507LAsIAABM7-sg6gA&expiration=1704187350 Server: gunicorn set-cookie: bito=AACk507LAsIAABM7-sg6gA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:30 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.16	50073	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	687	OUT	GET /cookie-sync/svr?gdpr=0&gdpr_consent= HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: bitoIsSecure=ok; bito=AACk507LAsIAABM7-sg6gA; checkForPermission=ok
2023-12-19 09:22:30 UTC	389	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:30 GMT location: https://ce.lijit.com/merge?3pid=AACk507LAsIAABM7-sg6gA&pid=85&gdpr=0 Server: gunicorn set-cookie: bito=AACk507LAsIAABM7-sg6gA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:30 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.16	50048	131.153.148.26	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	788	OUT	GET /usersync.aspx?bsw_custom_parameter=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp%3Drichaudience%26user_id%3D%24UID HTTP/1.1 Host: server.cpmstar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:30 UTC	633	IN	HTTP/1.1 302 Found Cache-Control: private,no-store, no-cache, must-revalidate Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: Thu, 01 Jan 1970 00:00:00 GMT Location: https://x.bidswitch.net/sync?dsp_id=440&ssp=richaudience&user_id=I83HFE23AH5WvEMCwkME0 Server: Microsoft-IIS/10.0 Set-Cookie: USER_ID=%23%cd%c7%14M%b7%00%7eV%bcC%02%c2C%04; domain=.server.cpmstar.com; expires=Sun, 12-Jan-2025 09:22:30 GMT; path=/; secure; SameSite=None P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADM DEVa PSAa PSDa OUR OTR IND UNI NAV STA" Date: Tue, 19 Dec 2023 09:22:30 GMT Connection: close Content-Length: 211
2023-12-19 09:22:30 UTC	211	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 78 2e 62 69 64 73 77 69 74 63 68 2e 6e 65 74 2f 73 79 6e 63 3f 64 73 70 5f 69 64 3d 34 34 30 26 61 6d 70 3b 73 73 70 3d 72 69 63 68 61 75 64 69 65 6e 63 65 26 61 6d 70 3b 75 73 65 72 5f 69 64 3d 49 38 33 48 46 45 32 33 41 48 35 57 76 45 4d 43 77 6b 4d 45 30 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://x.bidswitch.net/sync?dsp_id=440&ssp=richaudience&user_id=I83HFE23AH5WvEMCwkME0">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.16	50080	8.28.7.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	1144	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:93BC46BA1AC048E6B3FEE9603D02AEE4 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; chkChromeAb67Sec=1; pi=159047:2; DPSync3=1704153600%3A201_263%7C1703030400%3A248%7C1703548800%3A265; SyncRTB3=1704153600%3A54_250_71_220_21_13_166_104%7C1703548800%3A223_15; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; PugT=1702977749
2023-12-19 09:22:30 UTC	745	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:29 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:29 GMT; path=/ Set-Cookie: PugT=1702977749; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:29 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:30 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.16	50064	34.200.65.202	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	680	OUT	GET /ups/58292/sync?_origin=1&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&redir=true&gdpr=0&gdpr_consent= HTTP/1.1 Host: ups.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:30 UTC	624	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Length: 0 Strict-Transport-Security: max-age=31536000 P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Location: https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&redir=true&gdpr=0&gdpr_consent=&verify=true Age: 0 Connection: close Server: ATS/9.1.10.94 Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:30 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.16	50071	80.77.87.166	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	796	OUT	GET /73c1e1bfc3bde354d60b80e601ae3914.gif?puid=[UID]&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D164%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=&coppa= HTTP/1.1 Host: cs.admanmedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:30 UTC	592	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Length: 0 Connection: close Set-Cookie: admtr=72801ad7-cfff-40c4-85ce-2c79e9709f58; path=/; domain=.admanmedia.com; expires=Tue, 02 Jan 2024 09:11:11 GMT;SameSite=None;Secure Set-Cookie: ac_r=CS253; path=/; domain=.admanmedia.com; expires=Tue, 02 Jan 2024 09:11:11 GMT;SameSite=None;Secure Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Location: https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=72801ad7-cfff-40c4-85ce-2c79e9709f58

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.16	50062	51.222.239.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	719	OUT	GET /match/?int_id=106&redir=1&ot_initiated=1 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:30 UTC	556	IN	HTTP/1.1 302 Found cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:48; domain=onetag-sys.com; SameSite=None; Secure; location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjIFiRm47h951NLHqVLuP2oR_-XIHPuWRNw content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.16	50063	35.163.115.57	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	824	OUT	GET /visitor/sync?uid=9f93135e824096b627ff609f5cdee636&visitor=36de1d8845678e06&name=OPENWEB HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://s.spotim.market/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:30 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:30 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.16	50046	35.211.178.172	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	712	OUT	GET /ul_cb/sync?ssp=adyoulike&gdpr=0&gdpr_consent= HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977748
2023-12-19 09:22:30 UTC	592	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //sync-dmp.mobtrakk.com/match/bidswitch?id=${user_id}&gdpr=0&consent=&usp=&ssp=adyoulike&bsw=132eab48-61bf-4eaf-9a69-4fb4f080c8bc Set-Cookie: tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; path=/; expires=Wed, 18-Dec-2024 09:22:30 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: tuuid_lu=1702977750; path=/; expires=Wed, 18-Dec-2024 09:22:30 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.16	50083	15.197.193.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	784	OUT	GET /track/cmb/generic?ttd_pid=k2j3gqp&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFGAEgASgCMgsI8vjpgtifwDwQBTgBWghwdWJtYXRpY2AC
2023-12-19 09:22:30 UTC	607	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Length: 319 Connection: close server: Kestrel location: https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=134495f3-7e94-4262-b6f5-d7524e6fbdd7&name=THE_TRADE_DESK set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:30 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFGAEgAigCMgsI8vjpgtifwDwQBTgBWghwdWJtYXRpY2AC; expires=Thu, 19 Dec 2024 09:22:30 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:30 UTC	319	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 76 69 73 69 74 6f 72 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 2f 76 69 73 69 74 6f 72 2f 73 79 6e 63 3f 75 69 64 3d 38 31 32 32 66 64 61 63 36 30 35 31 37 62 31 65 66 65 31 33 38 39 36 31 32 66 33 64 66 62 33 34 26 76 69 73 69 74 6f 72 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 6e 61 6d 65 3d 54 48 45 5f 54 52 41 44 45 5f 44 45 53 4b 22 3e 68 74 74 70 73 3a 2f 2f 76 69 73 69 74 6f 72 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 2f 76 69 73 69 74 6f 72 2f 73 79 6e 63 3f 75 69 64 3d 38 31 32 32 66 64 61 63 36 30 35 31 37 62 31 65 66 65 31 33 38 39 36 31 32 66 33 64 66 62 33 34 26 76 69 73 69 Data Ascii: Redirecting to: <a href="https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=134495f3-7e94-4262-b6f5-d7524e6fbdd7&name=THE_TRADE_DESK">https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.16	50093	172.64.151.101	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	743	OUT	GET /crum?cm_dsp_id=191&external_user_id=030284df-1cd5-54fc-52df3208 HTTP/1.1 Host: dsum.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:30 UTC	974	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e94de1ec0747a-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:30 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:30 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jw1pf6IuzcHk%2Fow6aVfb8RNBhQmCiIZflgtjLX08ldWJ0ghBaESlYm1SVBiZFTfjfnNLnj1adevNMKno7yO9NYyzOt9%2Fzp%2B%2FkPXRc8qEfBg1ec7RrFAge0gliHHuNq8njF2Op2eo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:30 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.16	50091	192.178.50.66	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	1413	OUT	GET /pcs/view?xai=AKAOjstRTuPiweObBprQtFUB00IgDGeXLsiu-6wFpw5lYrW1CHeKLZPssQfz0tqoMeovpNa_VKpoXxmBd_1QNDfBcEwJyTXgtdofnI1tYcnxLDKbtB43ZG7j-4ih7VKFmTkQDTxyFsvEvos_fpvbKeur3HOsMtVoeSMPoYENZw8zEGsv2YEcmymzaNgpTJiOBODTnlm_m3uNwW2-a0bOq4-nLwAjWZpHW7qz3uaBVqBOl4EXRwMrTC4K68-rBndAH76Mp9gk1EC4XJ32fz2Ko95ryatC-QzECRwHm26gNsxPkvyjp6czGEnxeRQ1yvAbWA-2Cb7B_HXFvvkXZmAl_IBWSaUIqFEN_IMgiIns09CRjuIjP4PExRMgz10vYUE3IK8xW1RrvD_quiXtzk0KFXxxueCKeLpv5pWri03OFmMQ64fMoQhOoV0YIKDURRS5TePvf5U&sai=AMfl-YSNx_0PjW27AJDV0ODAhnB-vXBQz22rbs--xYi9FfphHC9onaz_chcxCfjhznLjn-bGkEZTFYfPhQ-UkiFMcL6bLxjt3aTDCUo181xXPhUT6x6JOWDjxReksvmdgA&sig=Cg0ArKJSzFtEC5S1DR-2EAE&uach_m=%5BUACH%5D&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:31 UTC	792	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:30 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.16	50096	35.244.159.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	788	OUT	GET /w/1.0/sd?id=537072971&val=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0&gdpr_consent= HTTP/1.1 Host: us-u.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK
2023-12-19 09:22:30 UTC	568	IN	HTTP/1.1 200 OK Vary: Accept Set-Cookie: univ_id=537072971\|134495f3-7e94-4262-b6f5-d7524e6fbdd7\|1702977750811797; Version=1; Expires=Wed, 03-Jan-2024 09:22:30 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None Server: OXGW/0.0.0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Expires: Mon, 26 Jul 1997 05:00:00 GMT Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Type: image/gif Content-Length: 43 Cache-Control: private, max-age=0, no-cache Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:30 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.16	50094	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	778	OUT	GET /merge?pid=76&3pid=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://us-u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D
2023-12-19 09:22:30 UTC	865	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:30 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:30 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:30 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:30 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:30 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.16	50066	34.111.113.62	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	749	OUT	GET /idsync/ex/receive/check?partner_id=3371&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e
2023-12-19 09:22:31 UTC	1227	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:30 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:30 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:30 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:30 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=2fbacb1a-cf7e-4185-bc55-8155b145136e%252C%252C&gdpr=0&gdpr_consent= Content-Length: 0 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.16	50068	74.121.140.211	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	703	OUT	GET /sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: sync.mathtag.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:31 UTC	642	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Type: image/gif Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Server: MT3 1237 600843f master iad iad-pixel-x12 config_version:"2575" Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" set-cookie: uuid=7a2e6581-60d7-4800-933d-354f6ed2801e; domain=.mathtag.com; path=/; expires=Wed, 15-Jan-2025 09:22:31 GMT; SameSite=None; Secure location: https://onetag-sys.com/match/?int_id=1&uid=7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= Expires: Tue, 19 Dec 2023 09:22:29 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.16	50106	35.211.178.172	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	756	OUT	GET /sync?ssp=gumgum2&user_id=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977748
2023-12-19 09:22:31 UTC	315	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&ssp=gumgum2&gdpr=0&gdpr_consent=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.16	50089	104.18.25.173	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	872	OUT	GET /z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_user_id=ZYFg05BR8MuggUMSNtG2uQAA HTTP/1.1 Host: s.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ANON_ID=aPnoeUwZcF1voXarrgcIpDnaqqSXaZaEqsMGYkmOQa
2023-12-19 09:22:31 UTC	905	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 209 X-Reuse-Index: 1435 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=alnsXDtZdPuem7SpBmPo7WiLw5VjMZbMU1mO0RZaP4nvdBsZaZaOVoVF01ql5S0HjhMClbMNqFswa24lfMTnj; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:31 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=alnsXDtZdPuem7SpBmPo7WiLw5VjMZbMU1mO0RZaP4nvdBsZaZaOVoVF01ql5S0HjhMClbMNqFswa24lfMTnj; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:31 GMT; Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662089849815167 CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 837e94df9ba96dd4-MIA alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:31 UTC	42	IN	Data Raw: 32 34 0d 0a 3c 68 31 3e 45 72 72 6f 72 20 33 30 32 20 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 68 31 3e 0d 0a Data Ascii: 24<h1>Error 302 Moved Temporarily</h1>
2023-12-19 09:22:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.16	50084	104.18.36.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	797	OUT	GET /rum?cm_dsp_id=39&external_user_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&expiration=1705569749&gdpr=0&gdpr_consent= HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:31 UTC	984	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e94dfa86167c0-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:31 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:31 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Oznmi7m3SLOf%2Fil3eqYrUsP6tDjeFju5J3CPOmKR0StMrsUjX8srUTNQKXvWLjreGGCU4kmT2AIIKDivqDlacuqkM4P83JmmL0RaLsNvKBunHLFK9BXLvaJiCKsIXjaY%2FR%2FXuPXyVKZlog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:31 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.16	49911	8.28.7.81	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	1321	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=27079344&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; chkChromeAb67Sec=1; DPSync3=1704153600%3A201_263%7C1703030400%3A248%7C1703548800%3A265; SyncRTB3=1704153600%3A54_250_71_220_21_13_166_104%7C1703548800%3A223_15; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; PugT=1702977749; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4
2023-12-19 09:22:31 UTC	947	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=2; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=156011:4; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1704153600%3A260_259_201_263_262_261%7C1703030400%3A248%7C1703548800%3A265; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: SyncRTB3=1704153600%3A178_21_166_13_231_48_22_54_104_220_3_250_71%7C1703548800%3A15_223%7C1703808000%3A63; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Length: 1419 Connection: close
2023-12-19 09:22:31 UTC	1419	IN	Data Raw: 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 74 68 72 74 6c 65 2e 63 6f 6d 2f 69 6e 73 79 6e 63 3f 76 78 69 69 5f 70 69 64 3d 31 30 30 36 37 26 76 78 69 69 5f 70 64 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 75 73 2d 75 2e 6f 70 65 6e 78 2e 6e 65 74 2f 77 2f 31 2e 30 2f 73 64 3f 69 64 3d 35 34 30 32 34 35 31 39 33 26 76 61 6c 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 Data Ascii: PubMatic.loadAsyncImagePixel('https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://us-u.openx.net/w/1.0/sd?id=540245193&val=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.16	50072	82.145.213.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:30 UTC	605	OUT	GET /pub/sync?pubid=pub10101531197440 HTTP/1.1 Host: t.adx.opera.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:31 UTC	790	IN	HTTP/1.1 302 Found Server: Tengine Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 155 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://onetag-sys.com/match/?gdpr=&gdpr_consent=%24%7BGDPR_STRING%7D&int_id=168&uid=OPUfcf5109a1a63427ca17f2e650a5ade17 Pragma: no-cache Set-Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17; Path=/; Domain=adx.opera.com; Max-Age=31536000; Secure; SameSite=None
2023-12-19 09:22:31 UTC	155	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 6e 65 74 61 67 2d 73 79 73 2e 63 6f 6d 2f 6d 61 74 63 68 2f 3f 67 64 70 72 3d 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 25 32 34 25 37 42 47 44 50 52 5f 53 54 52 49 4e 47 25 37 44 26 61 6d 70 3b 69 6e 74 5f 69 64 3d 31 36 38 26 61 6d 70 3b 75 69 64 3d 4f 50 55 66 63 66 35 31 30 39 61 31 61 36 33 34 32 37 63 61 31 37 66 32 65 36 35 30 61 35 61 64 65 31 37 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://onetag-sys.com/match/?gdpr=&gdpr_consent=%24%7BGDPR_STRING%7D&int_id=168&uid=OPUfcf5109a1a63427ca17f2e650a5ade17">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.16	50081	8.28.7.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	1099	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; chkChromeAb67Sec=1; DPSync3=1704153600%3A201_263%7C1703030400%3A248%7C1703548800%3A265; SyncRTB3=1704153600%3A54_250_71_220_21_13_166_104%7C1703548800%3A223_15; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; PugT=1702977749
2023-12-19 09:22:31 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:31 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.16	50126	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	759	OUT	GET /merge?pid=92&3pid=6663647625574893018&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D
2023-12-19 09:22:31 UTC	848	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:31 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_92=6663647625574893018; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:31 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.16	50119	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	695	OUT	GET /ecm3?ex=index.com&id=ZYFg05BR8MuggUMSNtG2uQAABfYAAAIB HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:31 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: 398XYX61HY2PC536AJE2 Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:31 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.16	50099	15.197.193.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	879	OUT	GET /track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFGAEgAigCMgsI8vjpgtifwDwQBTgBWghwdWJtYXRpY2AC
2023-12-19 09:22:31 UTC	544	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Length: 193 Connection: close server: Kestrel location: https://usersync.gumgum.com/usersync?b=ttd&i=134495f3-7e94-4262-b6f5-d7524e6fbdd7 set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:31 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFGAEgASgCMgsI5LnzodifwDwQBTgBWgZndW1ndW1gAg..; expires=Thu, 19 Dec 2024 09:22:31 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:31 UTC	193	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 72 73 79 6e 63 2e 67 75 6d 67 75 6d 2e 63 6f 6d 2f 75 73 65 72 73 79 6e 63 3f 62 3d 74 74 64 26 69 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 22 3e 68 74 74 70 73 3a 2f 2f 75 73 65 72 73 79 6e 63 2e 67 75 6d 67 75 6d 2e 63 6f 6d 2f 75 73 65 72 73 79 6e 63 3f 62 3d 74 74 64 26 69 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://usersync.gumgum.com/usersync?b=ttd&i=134495f3-7e94-4262-b6f5-d7524e6fbdd7">https://usersync.gumgum.com/usersync?b=ttd&i=134495f3-7e94-4262-b6f5-d7524e6fbdd7</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.16	50090	207.198.113.203	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	686	OUT	GET /dmp/pixelSync?cookieQ=1&nid=48 HTTP/1.1 Host: pixel-sync.sitescout.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646
2023-12-19 09:22:31 UTC	1100	IN	HTTP/1.1 302 cache-control: max-age=0,no-cache,no-store pragma: no-cache expires: Tue, 11 Oct 1977 12:34:56 GMT p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml" set-cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; Domain=.sitescout.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Path=/; Secure; SameSite=None set-cookie: _ssuma=eyIyNCI6MTcwMjk3Nzc1MTM3MCwiMzkiOjE3MDI5Nzc3NTEzNzAsIjciOjE3MDI5Nzc3NTEzNzB9; Domain=.sitescout.com; Expires=Thu, 18-Jan-2024 09:22:31 GMT; Path=/; Secure; SameSite=None location: https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553%26partner_url%3Dhttps%253A%252F%252Fr.casalemedia.com%252Frum%253Fcm_dsp_id%253D64%2526external_user_id%253D6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553%2526gdpr%253D0%2526gdpr_consent%253D content-length: 0 date: Tue, 19 Dec 2023 09:22:30 GMT server: A connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.16	50085	54.82.32.1	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	804	OUT	GET /s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZYFg05BR8MuggUMSNtG2uQAA%261526&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=a0aee609296845dea5d3b77df9a421f0 HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:31 UTC	623	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Length: 0 Connection: close Location: https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D Set-Cookie: _li_ss=CggKBgjSARDiFg; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:31 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:31 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 2 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.16	50055	52.89.73.205	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	818	OUT	GET /visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=6663647625574893018&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:31 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:31 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.16	50116	52.89.73.205	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	809	OUT	GET /visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=6663647625574893018&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:31 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 5 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:31 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.16	50114	35.190.80.1	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	561	OUT	OPTIONS /report/v3?s=j5jmmzHf2sbKjHxg4oMFTS9kYvPWIAovZibafiQS2UmkTNOTbyeEJV20X5Rn0QFXR%2F88GMrvewPP4qVAlVFxEG%2BcldVTga7IVRnsT%2Bg0gdr3s4pGp%2Fi33Wi9LJf26Gzf0J2iwm7KYfPi6g%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://dsum-sec.casalemedia.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:31 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Tue, 19 Dec 2023 09:22:31 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.16	50082	8.28.7.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	1157	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEC26mZVWsxRGoE5JvegKkkg&google_cver=1 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; chkChromeAb67Sec=1; DPSync3=1704153600%3A201_263%7C1703030400%3A248%7C1703548800%3A265; SyncRTB3=1704153600%3A54_250_71_220_21_13_166_104%7C1703548800%3A223_15; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; PugT=1702977749
2023-12-19 09:22:31 UTC	669	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:30 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:30 GMT; path=/ Set-Cookie: PugT=1702977750; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:30 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:31 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.16	50102	162.55.236.225	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	738	OUT	GET /2066127a3f7c6635eb4f6cac536feb5a/?gdpr=0&euconsent=&uid=ZYFg02kDskXAcMABkyNPagAACu4AAAIB HTTP/1.1 Host: sync.richaudience.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pdid=64f4bbfb-8ac7-4d56-b41c-1zz1702977725; raibs=1
2023-12-19 09:22:31 UTC	434	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Tue, 19 Dec 2023 09:22:11 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.2.4 P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: avcid-inx-uid=ZYFg02kDskXAcMABkyNPagAACu4AAAIB; expires=Mon, 18 Mar 2024 09:22:11 GMT; Max-Age=7776000; path=/; domain=.richaudience.com; secure; HttpOnly; SameSite=None
2023-12-19 09:22:31 UTC	106	IN	Data Raw: 35 66 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 5fPNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.16	50140	44.207.23.148	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	716	OUT	GET /sync/gumgum?gdpr=0&gdpr_consent= HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNVggWUCEHejoOWrMKg_iWRcNBcNRzwFEgEBAQGygmWLZQAAAAAA_eMAAA&S=AQAAAqnyANlOCxCBeJXDtSFid_M
2023-12-19 09:22:31 UTC	852	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Length: 0 Connection: close Location: https://usersync.gumgum.com/usersync?b=oth&i=y-SstFR3RE2pey1bTXUivUmXFmI8lWJgK8WXb.~A Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNVggWUCEHejoOWrMKg_iWRcNBcNRzwFEgEBAQGygmWLZQAAAAAA_eMAAA&S=AQAAAqnyANlOCxCBeJXDtSFid_M; Expires=Wed, 18 Dec 2024 15:22:31 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
239	192.168.2.16	50117	35.163.115.57	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	795	OUT	GET /visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1 HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:31 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:31 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.16	50127	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	742	OUT	GET /merge?pid=80&3pid=LQC4ZCPI-1J-ELT2&gdpr=0 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D
2023-12-19 09:22:31 UTC	845	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:31 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:31 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.16	50098	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	803	OUT	GET /ecm3?ex=pubmatic.com&id=PM_UID5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:31 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: MEK2VC1163AYXH6P5660 Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:31 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
242	192.168.2.16	50095	35.244.159.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	823	OUT	GET /w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP/1.1 Host: us-u.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK
2023-12-19 09:22:31 UTC	556	IN	HTTP/1.1 302 Found Vary: Accept, Accept-Encoding Set-Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; Version=1; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None Server: OXGW/0.0.0 P3P: CP="CUR ADM OUR NOR STA NID" Location: https://usersync.gumgum.com/usersync?b=opx&i=bc35a5c6-637b-0abd-0dee-e98b0c9a5593 Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.16	50097	44.207.23.148	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	650	OUT	GET /sync/pubmatic/5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F?gdpr=0&gdpr_consent= HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:31 UTC	778	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNdggWUCEGgZ7-OHWnhpd_y1hM3JF_oFEgEBAQGygmWLZQAAAAAA_eMAAA&S=AQAAAuJCGKQ8Wg2FxQdZfDJiexY; Expires=Wed, 18 Dec 2024 15:22:31 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2023-12-19 09:22:31 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.16	50133	51.222.239.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	690	OUT	GET /match/?int_id=98&gdpr=0&gdpr_consent=&uid=6663647625574893018 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:31 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:49; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.16	50120	35.236.220.17	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	660	OUT	GET /lj_match?r=1702977748222&gdpr=0&gdpr_consent= HTTP/1.1 Host: um.simpli.fi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: suid=93BC46BA1AC048E6B3FEE9603D02AEE4
2023-12-19 09:22:31 UTC	623	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: text/html Content-Length: 142 Connection: close Location: https://ce.lijit.com/merge?pid=2&3pid=93BC46BA1AC048E6B3FEE9603D02AEE4 Expires: Mon, 18 Dec 2023 09:22:31 GMT Cache-Control: no-cache Strict-Transport-Security: max-age=63072000; includeSubdomains; preload X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
2023-12-19 09:22:31 UTC	142	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
246	192.168.2.16	50124	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	750	OUT	GET /merge?pid=2&3pid=09884D8316F241D18C871E186061E89C HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D
2023-12-19 09:22:31 UTC	860	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:31 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:31 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.16	50134	8.2.110.134	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	653	OUT	GET /77781087eb9a0621642f9ebec6beb8d1.gif?puid=[UID]&redir=[RED]&gdpr=0&gdpr_consent= HTTP/1.1 Host: cs.krushmedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:31 UTC	559	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Length: 0 Connection: close Set-Cookie: krm_usr=ae67145e-4e6a-59f0-a89d-071ebeee2681; path=/; domain=.krushmedia.com; expires=Tue, 02 Jan 2024 09:22:31 GMT;SameSite=None;Secure Set-Cookie: krm_r=572; path=/; domain=.krushmedia.com; expires=Tue, 02 Jan 2024 09:22:31 GMT;SameSite=None;Secure Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Location: https://x.bidswitch.net/sync?ssp=krushmedia&user_id=ae67145e-4e6a-59f0-a89d-071ebeee2681

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.16	50131	35.186.253.211	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	940	OUT	GET /sync/prebid?gdpr=0&gdpr_consent={gdpr_consent}&r=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D482928%26extuid%3D%24%7BUID%7D%26traffic_source%3Dsnippet%26session%3D14A0FC939D6A6483%26sp%3D750078%26pb%3D612004%26c%3D656033%26a%3D482928%26domain%3Dvisitor.omnitagjs.com HTTP/1.1 Host: rtb.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://s.spotim.market/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK
2023-12-19 09:22:31 UTC	545	IN	HTTP/1.1 302 Found Cache-Control: private, max-age=0, no-cache, must-revalidate Content-Type: text/html; charset=utf-8 Location: https://sync.spotim.market/csync?t=a&ep=482928&extuid=72d68e79-f2f1-0102-0119-397345919658&traffic_source=snippet&session=14A0FC939D6A6483&sp=750078&pb=612004&c=656033&a=482928&domain=visitor.omnitagjs.com P3p: CP="CUR ADM OUR NOR STA NID" Pragma: no-cache Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Length: 264 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:31 UTC	264	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 73 70 6f 74 69 6d 2e 6d 61 72 6b 65 74 2f 63 73 79 6e 63 3f 74 3d 61 26 61 6d 70 3b 65 70 3d 34 38 32 39 32 38 26 61 6d 70 3b 65 78 74 75 69 64 3d 37 32 64 36 38 65 37 39 2d 66 32 66 31 2d 30 31 30 32 2d 30 31 31 39 2d 33 39 37 33 34 35 39 31 39 36 35 38 26 61 6d 70 3b 74 72 61 66 66 69 63 5f 73 6f 75 72 63 65 3d 73 6e 69 70 70 65 74 26 61 6d 70 3b 73 65 73 73 69 6f 6e 3d 31 34 41 30 46 43 39 33 39 44 36 41 36 34 38 33 26 61 6d 70 3b 73 70 3d 37 35 30 30 37 38 26 61 6d 70 3b 70 62 3d 36 31 32 30 30 34 26 61 6d 70 3b 63 3d 36 35 36 30 33 33 26 61 6d 70 3b 61 3d 34 38 32 39 32 38 26 61 6d 70 3b 64 6f 6d 61 69 6e 3d 76 69 73 69 74 6f 72 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 22 3e 46 6f 75 Data Ascii: <a href="https://sync.spotim.market/csync?t=a&ep=482928&extuid=72d68e79-f2f1-0102-0119-397345919658&traffic_source=snippet&session=14A0FC939D6A6483&sp=750078&pb=612004&c=656033&a=482928&domain=visitor.omnitagjs.com">Fou

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.16	50115	52.89.73.205	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	787	OUT	GET /visitor/sync?name=SMILE_WANTED&ttl=720&uid=e77031af9e62c4ae76bee5b9517c4ef4&visitor=21b7e4500fc5676f49206403c549f2b8&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:31 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:31 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.16	50130	35.211.178.172	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	815	OUT	GET /sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:31 UTC	254	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //p.rfihub.com/cm?in=1&pub=20513&ssp=pubmatic&gdpr=0&gdpr_consent=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.16	50118	35.163.115.57	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	733	OUT	GET /visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AABafU7LAsIAABNxgMUHeA&name=BEESWAX HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:31 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 3 X-Kong-Proxy-Latency: 1 Via: kong/2.8.3
2023-12-19 09:22:31 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.16	50129	35.71.131.137	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	803	OUT	GET /track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent= HTTP/1.1 Host: data.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUYASACKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.
2023-12-19 09:22:31 UTC	591	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Length: 223 Connection: close server: Kestrel location: https://ce.lijit.com/merge?pid=27&3pid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent= set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:31 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUYASADKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.; expires=Thu, 19 Dec 2024 09:22:31 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:31 UTC	223	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 65 2e 6c 69 6a 69 74 2e 63 6f 6d 2f 6d 65 72 67 65 3f 70 69 64 3d 32 37 26 33 70 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 68 74 74 70 73 3a 2f 2f 63 65 2e 6c 69 6a 69 74 2e 63 6f 6d 2f 6d 65 72 67 65 3f 70 69 64 3d 32 37 26 33 70 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://ce.lijit.com/merge?pid=27&3pid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent=">https://ce.lijit.com/merge?pid=27&3pid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent=</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.16	50141	50.31.142.95	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	777	OUT	GET /usersync/gumgum/?puid=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__ HTTP/1.1 Host: b1sync.zemanta.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: zuid=aXQaOqrGBGrZCZrdEc4x
2023-12-19 09:22:31 UTC	521	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 103 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Thu, 01 Dec 1994 16:00:00 GMT Location: https://usersync.gumgum.com/usersync?b=zem&i=aXQaOqrGBGrZCZrdEc4x&gdpr=0 P3p: CP="We do not support P3P header." Pragma: no-cache Set-Cookie: zuid=aXQaOqrGBGrZCZrdEc4x; Path=/; Domain=zemanta.com; Expires=Wed, 18 Dec 2024 09:22:31 GMT; Max-Age=31536000; Secure; SameSite=None Date: Tue, 19 Dec 2023 09:22:31 GMT
2023-12-19 09:22:31 UTC	103	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 72 73 79 6e 63 2e 67 75 6d 67 75 6d 2e 63 6f 6d 2f 75 73 65 72 73 79 6e 63 3f 62 3d 7a 65 6d 26 61 6d 70 3b 69 3d 61 58 51 61 4f 71 72 47 42 47 72 5a 43 5a 72 64 45 63 34 78 26 61 6d 70 3b 67 64 70 72 3d 30 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://usersync.gumgum.com/usersync?b=zem&i=aXQaOqrGBGrZCZrdEc4x&gdpr=0">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.16	50107	35.244.159.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	791	OUT	GET /w/1.0/sd?id=537072971&val=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0&gdpr_consent= HTTP/1.1 Host: us-u.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://us-u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK
2023-12-19 09:22:31 UTC	568	IN	HTTP/1.1 200 OK Vary: Accept Set-Cookie: univ_id=537072971\|134495f3-7e94-4262-b6f5-d7524e6fbdd7\|1702977751750893; Version=1; Expires=Wed, 03-Jan-2024 09:22:31 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None Server: OXGW/0.0.0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Expires: Mon, 26 Jul 1997 05:00:00 GMT Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 43 Cache-Control: private, max-age=0, no-cache Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:31 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.16	50128	198.148.27.131	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	927	OUT	GET /bh/rtset?ev=AACk507LAsIAABM7-sg6gA&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Csyn%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0 HTTP/1.1 Host: bh.contextweb.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:31 UTC	1115	IN	HTTP/1.1 302 Found Connection: close P3P: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT" Accept-CH: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version CW-Server: bh-deployment-db744d8c7-lxqx8 Cache-Control: private, max-age=0, no-cache, no-store Expires: -1 Content-Language: en-US Set-Cookie: V=Vuo4P91tX0Wh;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Fri, 13-Dec-2024 09:22:31 GMT;Max-Age=31104000;SameSite=None Set-Cookie: pb_rtb_ev=3-1oms\|7dN.0.AACk507LAsIAABM7-sg6gA;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Wed, 18-Dec-2024 09:22:31 GMT;Max-Age=31536000;SameSite=None Location: https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Csyn%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AACk507LAsIAABM7-sg6gA&pid=558502&do=add&gdpr=0 Server: Jetty(10.0.14) Strict-Transport-Security: max-age=15768000 Set-Cookie: INGRESSCOOKIE=214026fc1f0bd606; path=/; HttpOnly; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.16	50108	52.223.22.214	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	984	OUT	GET /getuid?redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D644680%26extuid%3D%24UID%26traffic_source%3Dsnippet%26session%3D14A0FC939D6A6483%26sp%3D750078%26pb%3D612004%26c%3D649285%26a%3D644680%26domain%3Dvisitor.omnitagjs.com&gdpr=0&gdpr_consent={gdpr_consent} HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://s.spotim.market/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tluid=2271281487850057919730
2023-12-19 09:22:32 UTC	103	IN	HTTP/1.1 400 Bad Request Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.16	50113	54.239.38.253	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	738	OUT	GET /s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=5184721251378344538&gdpr=0&gdpr_consent= HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssbsync.smartadserver.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:32 UTC	807	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: T1Y2MJJH5JHN6GV8TYQ8 Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:31 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:31 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:32 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.16	50135	52.20.73.112	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	717	OUT	GET /pixel.gif?ch=185&cm=H2KyTBZHDmz9_ZgQSoi2z_V6&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent= HTTP/1.1 Host: aorta.clickagy.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:31 UTC	930	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Type: text/plain Content-Length: 0 Connection: close server: Aorta/20231215.627d1920a X-Aorta-Host: 1d57791de44b X-Aorta-Region: us-east-1 access-control-allow-credentials: true access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction access-control-expose-headers: Set-Cookie access-control-allow-methods: POST, GET, OPTIONS access-control-allow-origin: * access-control-max-age: 31536000 cache-control: no-cache, no-store, must-revalidate expect: 0 Location: https://ce.lijit.com/merge?pid=84&3pid=ZYFg1ybZKqdSngqUsIytTAGV set-cookie: cb=ZYFg1ybZKqdSngqUsIytTAGV; Max-Age=63027504; Expires=Wed, 17 Dec 2025 21:00:55 GMT; Path=/; Domain=.clickagy.com; SameSite=None; Secure set-cookie: chs=[{"ch":"185","t":"2023-12-19 09:22:31"}]; Max-Age=63027504; Expires=Wed, 17 Dec 2025 21:00:55 GMT; SameSite=None; Secure

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.16	50145	52.86.247.227	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	752	OUT	GET /d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.ipredictive.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:31 UTC	549	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:31 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=6d575774-a2c7-43b3-8920-b16815799026&gdpr=0&gdpr_consent= Set-Cookie: cu=6d575774-a2c7-43b3-8920-b16815799026\|1702977751835; Path=/; Domain=ipredictive.com; Expires=Wed, 18 Dec 2024 09:22:31 GMT; Max-Age=31536000; SameSite=None; Secure X-CI-RTID: 90528b80-43ea-4aac-a84b-25b3a6eede0b Content-Length: 205 Connection: Close
2023-12-19 09:22:31 UTC	205	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 71 63 7a 30 78 4a 6d 4e 76 5a 47 55 39 4d 7a 49 31 4d 43 5a 30 62 44 30 78 4d 6a 6b 32 4d 44 41 3d 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 36 64 35 37 35 37 37 34 2d 61 32 63 37 2d 34 33 62 33 2d 38 39 32 30 2d 62 31 36 38 31 35 37 39 39 30 32 36 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=6d575774-a2c7-43b3-8920-b16815799026&gdpr=0&gdpr_consent=">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.16	50147	169.197.150.7	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	716	OUT	GET /usersync/141?gdpr=0&gdpr_consent= HTTP/1.1 Host: match.deepintent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:32 UTC	528	IN	HTTP/1.1 200 OK p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI' set-cookie: CDIUSER=di_979c85533fdc4607be2b6; Max-Age=47260800; SameSite=None; Expires=Wed, 18 Jun 2025 09:22:31 GMT; Domain=deepintent.com; Secure; Path=/ set-cookie: CDIPARTNERS=%7B%221%22%3A%2220231219%22%7D; Max-Age=47260800; SameSite=None; Expires=Wed, 18 Jun 2025 09:22:31 GMT; Domain=deepintent.com; Secure; Path=/ content-type: image/gif content-length: 0 date: Tue, 19 Dec 2023 09:22:30 GMT server: a connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.16	50144	34.200.65.202	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	799	OUT	GET /ups/58292/sync?_origin=1&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&redir=true&gdpr=0&gdpr_consent=&verify=true HTTP/1.1 Host: ups.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE
2023-12-19 09:22:32 UTC	740	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:31 GMT Content-Length: 0 Strict-Transport-Security: max-age=31536000 Set-Cookie: IDSYNC=18z8~2fox;Version=1;Domain=.analytics.yahoo.com;Path=/;Max-Age=31536000;Expires=Wed, 18-Dec-2024 09:22:31 GMT;Secure;SameSite=None P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-O5tWUOxE2uVdZ2jpuKv8kVzN9wV5VWw-~A&gdpr=0 Age: 0 Connection: close Server: ATS/9.1.10.94 Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:31 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.16	50164	68.67.161.208	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	847	OUT	GET /getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018
2023-12-19 09:22:32 UTC	1090	IN	HTTP/1.1 302 Found Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6663647625574893018&gdpr=0&gdpr_consent= AN-X-Request-Uuid: 342fa638-c286-4fd7-ba25-1a8f4f8d6a81 Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:32 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.16	50160	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	776	OUT	GET /merge?pid=27&3pid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D
2023-12-19 09:22:32 UTC	865	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:31 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:31 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:32 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.16	50121	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	742	OUT	GET /merge?pid=83&3pid=LQC4ZCY6-1I-JWAU&gdpr=0 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D
2023-12-19 09:22:32 UTC	845	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:32 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:32 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:32 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:32 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:32 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.16	50105	68.67.181.211	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	665	OUT	GET /getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018
2023-12-19 09:22:32 UTC	1009	IN	HTTP/1.1 302 Found Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://usersync.gumgum.com/usersync?b=apn&i=6663647625574893018 AN-X-Request-Uuid: f62ff62f-583e-4761-a6ee-fd51235ccad8 Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:32 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.16	50088	162.55.236.225	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	766	OUT	GET /5cabe097b3ebe2daf96e0f4655657171/?uid=AACk507LAsIAABM7-sg6gA&gdpr=0 HTTP/1.1 Host: sync.richaudience.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pdid=64f4bbfb-8ac7-4d56-b41c-1zz1702977725; raibs=1; avcid-imd-uid=9f860467-d79c-45d4-bcf9-51ad3d856e68
2023-12-19 09:22:32 UTC	424	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Tue, 19 Dec 2023 09:22:12 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.2.4 P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: avcid-bsx-uid=AACk507LAsIAABM7-sg6gA; expires=Mon, 18 Mar 2024 09:22:12 GMT; Max-Age=7776000; path=/; domain=.richaudience.com; secure; HttpOnly; SameSite=None
2023-12-19 09:22:32 UTC	106	IN	Data Raw: 35 66 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 5fPNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.16	50161	15.197.193.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	739	OUT	GET /track/cmf/casale HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFGAEgASgCMgsI8vjpgtifwDwQBTgBWghwdWJtYXRpY2AC
2023-12-19 09:22:32 UTC	641	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Length: 323 Connection: close server: Kestrel location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&expiration=1705569752&gdpr=0&gdpr_consent= set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:32 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCOinofvBn8A8EAUYASACKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.; expires=Thu, 19 Dec 2024 09:22:32 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:32 UTC	323	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 73 75 6d 2d 73 65 63 2e 63 61 73 61 6c 65 6d 65 64 69 61 2e 63 6f 6d 2f 72 75 6d 3f 63 6d 5f 64 73 70 5f 69 64 3d 33 39 26 65 78 74 65 72 6e 61 6c 5f 75 73 65 72 5f 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 65 78 70 69 72 61 74 69 6f 6e 3d 31 37 30 35 35 36 39 37 35 32 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 68 74 74 70 73 3a 2f 2f 64 73 75 6d 2d 73 65 63 2e 63 61 73 61 6c 65 6d 65 64 69 61 2e 63 6f 6d 2f 72 75 6d 3f 63 6d 5f 64 73 70 5f 69 64 3d 33 39 26 65 78 74 65 72 6e 61 6c 5f 75 73 65 72 5f 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 Data Ascii: Redirecting to: <a href="https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&expiration=1705569752&gdpr=0&gdpr_consent=">https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=134495f3-7e94-4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.16	50125	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:31 UTC	748	OUT	GET /merge?3pid=AACk507LAsIAABM7-sg6gA&pid=85&gdpr=0 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D
2023-12-19 09:22:32 UTC	851	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:32 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:32 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:32 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:32 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:32 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.16	50132	52.89.73.205	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	784	OUT	GET /visitor/sync?name=ZEMANTA_BANNER&ttl=720&uid=bdef6bd95b7450b4e62a32db8c7d8c9d&visitor=aXQaOqrGBGrZCZrdEc4x&gdpr=0&gdpr_consent=&gdpr=0 HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:32 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 5 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:32 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
270	192.168.2.16	50143	54.224.142.7	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	612	OUT	GET /sync?nid=1&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:32 UTC	1332	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:32 GMT Location: https://usersync.gumgum.com/usersync?b=sta&i=0-187fc9bc-38fc-5637-6fac-194e6af1e6a7$ip$102.129.152.212 Set-Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDYwYWsBjABOgT87-jmQgT2Kk9R.YP0GM6Dzysfx9AjdWmFHI2mThHMImg%2FnQtGxlraX18w; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDYwYWsBjABOgT87-jmQgT2Kk9R.YP0GM6Dzysfx9AjdWmFHI2mThHMImg%2FnQtGxlraX18w; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Content-Length: 129 Connection: Close
2023-12-19 09:22:32 UTC	129	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 72 73 79 6e 63 2e 67 75 6d 67 75 6d 2e 63 6f 6d 2f 75 73 65 72 73 79 6e 63 3f 62 3d 73 74 61 26 61 6d 70 3b 69 3d 30 2d 31 38 37 66 63 39 62 63 2d 33 38 66 63 2d 35 36 33 37 2d 36 66 61 63 2d 31 39 34 65 36 61 66 31 65 36 61 37 24 69 70 24 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://usersync.gumgum.com/usersync?b=sta&i=0-187fc9bc-38fc-5637-6fac-194e6af1e6a7$ip$102.129.152.212">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
271	192.168.2.16	50158	35.244.159.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	726	OUT	GET /w/1.0/sd?id=537072991&val=CAESELPt7UfyJF1YSMpdjYoT4B8&google_cver=1 HTTP/1.1 Host: us-u.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK
2023-12-19 09:22:32 UTC	366	IN	HTTP/1.1 200 OK Vary: Accept Server: OXGW/0.0.0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Expires: Mon, 26 Jul 1997 05:00:00 GMT Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Type: image/gif Content-Length: 43 Cache-Control: private, max-age=0, no-cache Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:32 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
272	192.168.2.16	50157	15.197.193.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	833	OUT	GET /track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=2fbacb1a-cf7e-4185-bc55-8155b145136e%252C%252C&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFGAEgAigCMgsI8vjpgtifwDwQBTgBWghwdWJtYXRpY2AC
2023-12-19 09:22:32 UTC	655	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Length: 359 Connection: close server: Kestrel location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=2fbacb1a-cf7e-4185-bc55-8155b145136e%2C%2C set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:32 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhQKBXRhcGFkEgsIuL-T_MGfwDwQBRgBIAEoAjILCPC1lqnYn8A8EAU4AVoFdGFwYWRgAg..; expires=Thu, 19 Dec 2024 09:22:32 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:32 UTC	359	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 74 61 70 61 64 2e 63 6f 6d 2f 69 64 73 79 6e 63 2f 65 78 2f 72 65 63 65 69 76 65 3f 70 61 72 74 6e 65 72 5f 69 64 3d 31 38 33 30 26 70 61 72 74 6e 65 72 5f 64 65 76 69 63 65 5f 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 74 74 64 5f 70 75 69 64 3d 32 66 62 61 63 62 31 61 2d 63 66 37 65 2d 34 31 38 35 2d 62 63 35 35 2d 38 31 35 35 62 31 34 35 31 33 36 65 25 32 43 25 32 43 22 3e 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 74 61 70 61 64 2e 63 6f 6d 2f 69 64 73 79 6e 63 2f 65 78 2f 72 65 63 65 69 76 65 3f 70 61 72 74 6e 65 72 5f 69 64 3d 31 38 33 30 26 70 61 72 74 6e 65 Data Ascii: Redirecting to: <a href="https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=2fbacb1a-cf7e-4185-bc55-8155b145136e%2C%2C">https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partne

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
273	192.168.2.16	49913	74.119.119.150	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	756	OUT	GET /dis/usersync.aspx?r=6&p=70&cp=Rubicon&cu=1&url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D6434%26nid%3D2149%26put%3D%40%40CRITEO_USERID%40%40&gdpr=0&us_privacy=1--- HTTP/1.1 Host: dis.criteo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:32 UTC	687	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:31 GMT server: Kestrel cache-control: no-cache expires: Tue, 19 Dec 2023 00:00:00 GMT location: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=bcf55414-01bc-4254-873e-0589d6530dae&gdpr=0&us_privacy=1--- pragma: no-cache set-cookie: uid=bcf55414-01bc-4254-873e-0589d6530dae; expires=Sun, 12 Jan 2025 09:22:32 GMT; domain=.criteo.com; path=/; secure; samesite=none x-errorlevel: 0 p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" cross-origin-resource-policy: cross-origin server-processing-duration-in-ticks: 1358875 strict-transport-security: max-age=31536000; preload; connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
274	192.168.2.16	50123	69.194.240.13	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	843	OUT	GET /usersync2/rmpssp?sub=sovrn&zcc=1&cb=1702977748695 HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22zdxidn%22%3A%222069.5%22%2C%22nxtrdr%22%3A%22https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D%22%7D
2023-12-19 09:22:32 UTC	645	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:32 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22zdxidn%22%3A%222069.80%22%2C%22nxtrdr%22%3Afalse%7D; path=/; expires=Wed, 18 Dec 2024 09:22:32 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://ad.turn.com/r/cs?pid=45&rndcb=2543585301 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
275	192.168.2.16	50165	169.197.150.7	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	677	OUT	GET /usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D HTTP/1.1 Host: match.deepintent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:32 UTC	528	IN	HTTP/1.1 200 OK p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI' set-cookie: CDIUSER=di_2f52f13f92ee430baf4d1; Max-Age=47260800; SameSite=None; Expires=Wed, 18 Jun 2025 09:22:32 GMT; Domain=deepintent.com; Secure; Path=/ set-cookie: CDIPARTNERS=%7B%221%22%3A%2220231219%22%7D; Max-Age=47260800; SameSite=None; Expires=Wed, 18 Jun 2025 09:22:32 GMT; Domain=deepintent.com; Secure; Path=/ content-type: image/gif content-length: 0 date: Tue, 19 Dec 2023 09:22:31 GMT server: a connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
276	192.168.2.16	50146	52.86.247.227	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	763	OUT	GET /d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP/1.1 Host: sync.ipredictive.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:32 UTC	460	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:32 GMT Location: https://usersync.gumgum.com/usersync?b=vnt&i=92ceaf34-27c5-4c21-b9d3-66c038610988 Set-Cookie: cu=92ceaf34-27c5-4c21-b9d3-66c038610988\|1702977752212; Path=/; Domain=ipredictive.com; Expires=Wed, 18 Dec 2024 09:22:32 GMT; Max-Age=31536000; SameSite=None; Secure X-CI-RTID: bda50f51-6562-48d5-85c4-32dfa082b303 Content-Length: 108 Connection: Close
2023-12-19 09:22:32 UTC	108	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 72 73 79 6e 63 2e 67 75 6d 67 75 6d 2e 63 6f 6d 2f 75 73 65 72 73 79 6e 63 3f 62 3d 76 6e 74 26 61 6d 70 3b 69 3d 39 32 63 65 61 66 33 34 2d 32 37 63 35 2d 34 63 32 31 2d 62 39 64 33 2d 36 36 63 30 33 38 36 31 30 39 38 38 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://usersync.gumgum.com/usersync?b=vnt&i=92ceaf34-27c5-4c21-b9d3-66c038610988">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
277	192.168.2.16	50159	5.161.124.197	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	691	OUT	GET /match/bidswitch?id=${user_id}&gdpr=0&consent=&usp=&ssp=adyoulike&bsw=132eab48-61bf-4eaf-9a69-4fb4f080c8bc HTTP/1.1 Host: sync-dmp.mobtrakk.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:32 UTC	394	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Length: 0 Connection: close Location: https://sync-dmp.mobtrakk.com/match/bidswitch?id=%24%7Buser_id%7D&gdpr=0&consent=&usp=&ssp=adyoulike&bsw=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&chk=1 Set-Cookie: chk=1; path=/; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
278	192.168.2.16	50168	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	703	OUT	GET /ecm3?id=H2KyTBZHDmz9_ZgQSoi2z_V6&ex=sovrn.com&gdpr=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:32 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: PVSERMYVFPNWGHGGHGTA Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:32 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
279	192.168.2.16	50178	142.250.189.130	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	1242	OUT	GET /pagead/viewthroughconversion/631321069/?random=1702977738859&cv=11&fst=1702977738859&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma=0&tcfd=10000&u_w=1280&u_h=1024&url=https%3A%2F%2Fcaffeine.softonic.com.br%2F&hn=www.googleadservices.com&frm=0&tiba=Caffeine%20-%20Download&us_privacy=1---&auid=133230612.1702977737&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:32 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:32 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:32 UTC	549	IN	Data Raw: 38 39 61 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 89a(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2023-12-19 09:22:32 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2023-12-19 09:22:32 UTC	408	IN	Data Raw: 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 32 39 37 36 34 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 62 65 33 62 74 30 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 25 32 46 5c 78 32 36 66 72 6d 5c 78 33 64 30 5c 78 32 36 74 69 62 61 5c 78 33 64 43 61 66 66 65 69 6e 65 25 32 30 2d 25 32 30 44 6f 77 6e 6c 6f 61 64 5c 78 32 36 64 61 74 61 5c 78 33 64 65 76 65 6e 74 25 33 44 67 74 61 67 2e 63 6f 6e 66 69 67 5c 78 32 36 66 6d 74 Data Ascii: 1\x26fst\x3d1702976400000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45be3bt0\x26u_w\x3d1280\x26u_h\x3d1024\x26url\x3dhttps%3A%2F%2Fcaffeine.softonic.com.br%2F\x26frm\x3d0\x26tiba\x3dCaffeine%20-%20Download\x26data\x3devent%3Dgtag.config\x26fmt
2023-12-19 09:22:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
280	192.168.2.16	50170	8.28.7.81	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	1379	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=35419668&p=159047&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; PugT=1702977749; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; chkChromeAb67Sec=2; pi=156011:4; DPSync3=1704153600%3A260_259_201_263_262_261%7C1703030400%3A248%7C1703548800%3A265; SyncRTB3=1704153600%3A178_21_166_13_231_48_22_54_104_220_3_250_71%7C1703548800%3A15_223%7C1703808000%3A63
2023-12-19 09:22:32 UTC	1075	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=3; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=159047:4; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: SyncRTB3=1704067200%3A46_55_165_5_233_240_8_176%7C1703462400%3A2%7C1703548800%3A15_223%7C1703808000%3A63%7C1704153600%3A13_48_220_35_21_54_178_3_250_22_231_104_71_166; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Mon, 18 Dec 2023 10:32:58 GMT Transfer-Encoding: chunked Connection: close
2023-12-19 09:22:32 UTC	2361	IN	Data Raw: 39 32 64 0d 0a 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 73 79 6e 63 68 72 6f 73 63 72 69 70 74 2e 64 65 6c 69 76 65 72 79 65 6e 67 69 6e 65 2e 61 64 73 77 69 7a 7a 2e 63 6f 6d 2f 73 79 6e 63 4d 65 3f 70 61 72 74 6e 65 72 44 6f 6d 61 69 6e 3d 6d 72 74 6e 73 76 72 2e 63 6f 6d 26 69 64 54 79 70 65 3d 63 6f 6f 6b 69 65 26 70 61 72 74 6e 65 72 55 73 65 72 49 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 69 64 73 79 6e 63 2e 72 6c 63 64 6e Data Ascii: 92dPubMatic.loadAsyncImagePixel('https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://idsync.rlcdn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
281	192.168.2.16	50142	34.227.128.134	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	689	OUT	GET /sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=5184721251378344538&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.sharethrough.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssbsync.smartadserver.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:32 UTC	320	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Type: image/png Content-Length: 68 Connection: close Set-Cookie: stx_user_id=8e71ecfd-8285-4086-9d46-6047ffd70504; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:32 GMT; Path=/; Domain=.sharethrough.com; Secure; SameSite=None Cache-Control: no-cache
2023-12-19 09:22:32 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0b 49 44 41 54 78 da 63 f8 ff 1f 00 03 00 01 ff 6f 81 ab b6 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxcoIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
282	192.168.2.16	50169	35.244.159.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	820	OUT	GET /w/1.0/sd?id=540245193&val=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: us-u.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK; univ_id=537072971\|134495f3-7e94-4262-b6f5-d7524e6fbdd7\|1702977750811797
2023-12-19 09:22:32 UTC	366	IN	HTTP/1.1 200 OK Vary: Accept Server: OXGW/0.0.0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Expires: Mon, 26 Jul 1997 05:00:00 GMT Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Type: image/gif Content-Length: 43 Cache-Control: private, max-age=0, no-cache Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:32 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
283	192.168.2.16	50181	35.214.128.77	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	763	OUT	GET /?pubid=11480&redirect=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3D68c72dd412a8d0f3f6d2276db2509939%26name%3DLOOPME%26visitor%3D%7Bdevice_id%7D%0A&gdpr=0&gdpr_consent= HTTP/1.1 Host: csync.loopme.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
284	192.168.2.16	50174	52.4.146.202	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	648	OUT	GET /sync?pid=187&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.bfmio.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:32 UTC	420	IN	HTTP/1.1 204 Date: Tue, 19 Dec 2023 09:22:32 GMT Set-Cookie: __187_cid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Domain=.bfmio.com; Max-Age=31536000; Expires=Wed, 18-Dec-2024 04:22:32 GMT-0500; Path=/; SameSite=None; Secure Set-Cookie: __io_cid=4a09afa63729de6df81ef736e4d03489526044c6; Domain=.bfmio.com; Max-Age=31536000; Expires=Wed, 18-Dec-2024 04:22:32 GMT-0500; Path=/; SameSite=None; Secure Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
285	192.168.2.16	50200	104.26.3.70	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	594	OUT	GET /px.gif?ch=2 HTTP/1.1 Host: ad-delivery.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:32 UTC	1230	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-GUploader-UploadID: ABPtcPoneNYke7fO2kzH0x2YRcqOyFvMbvpKdkHDnNQbhurKfj2gEAJMTj8CoElGm6RQbaLonIYqKBdkTg x-goog-generation: 1620242732037093 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 43 x-goog-hash: crc32c=cpEfJQ== x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace Expires: Thu, 30 Nov 2023 08:00:14 GMT Cache-Control: public, max-age=86400 Age: 1646797 Last-Modified: Wed, 05 May 2021 19:25:32 GMT ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3" CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uvhQj7n3f5M2ejnNH02XFK4tIZCXcXZmth5rtic%2Fp9m8uKnHzkdN7cXaAZmUNLA%2FLKWKDog%2FQyzYOLyZvjjaea4HDm5SIJ5uPZuoAzN5tizabHuYLyGT3MWd8YjAS8argA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 837e94eabb0d7421-MIA
2023-12-19 09:22:32 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
286	192.168.2.16	50190	198.148.27.131	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	678	OUT	GET /bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent= HTTP/1.1 Host: bh.contextweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:32 UTC	981	IN	HTTP/1.1 302 Found Connection: close P3P: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT" Accept-CH: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version CW-Server: bh-deployment-db744d8c7-h7vkg Cache-Control: private, max-age=0, no-cache, no-store Expires: -1 Content-Language: en-US Set-Cookie: V=UJ0Gt3SdkRY8;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Fri, 13-Dec-2024 09:22:32 GMT;Max-Age=31104000;SameSite=None Set-Cookie: pb_rtb_ev=3-1oms\|7dW.0.1;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Wed, 18-Dec-2024 09:22:32 GMT;Max-Age=31536000;SameSite=None Location: https://ce.lijit.com/merge?pid=49&3pid=UJ0Gt3SdkRY8&ev=1&pid=558511&gdpr_consent=&gdpr=0 Server: Jetty(10.0.14) Strict-Transport-Security: max-age=15768000 Set-Cookie: INGRESSCOOKIE=054ca09029710143; path=/; HttpOnly; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
287	192.168.2.16	50223	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	711	OUT	GET /dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0&us_privacy=1--- HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:32 UTC	895	IN	HTTP/1.1 302 Found Server: Server Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Length: 0 Connection: close x-amz-rid: RFACRG4K2E75YBVB5TPQ Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:32 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:32 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Location: https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=Tw4728KPQIaXIzG5auIVXg&rk=usync-na&gdpr=0 Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
288	192.168.2.16	50195	35.172.99.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	785	OUT	GET /usersync?b=ttd&i=134495f3-7e94-4262-b6f5-d7524e6fbdd7 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:32 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:32 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
289	192.168.2.16	50193	162.248.18.32	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	1523	OUT	GET /AdServer/ImgSync?p=159706&pu=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: image8.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; PugT=1702977749; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; chkChromeAb67Sec=2; pi=156011:4; DPSync3=1704153600%3A260_259_201_263_262_261%7C1703030400%3A248%7C1703548800%3A265; SyncRTB3=1704153600%3A178_21_166_13_231_48_22_54_104_220_3_250_71%7C1703548800%3A15_223%7C1703808000%3A63
2023-12-19 09:22:32 UTC	1147	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Location: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: SyncRTB3=1704153600%3A250_178_13_231_22_54_21_166_220_3_71_55_48_104%7C1703808000%3A63%7C1703548800%3A15_223; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: ipc=159706^https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D^2^0; domain=pubmatic.com; path=/; max-age=3; SameSite=None; secure; Set-Cookie: pi=159706:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=3; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Length: 104 Connection: close
2023-12-19 09:22:32 UTC	104	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2d 73 79 6e 63 2e 73 69 74 65 73 63 6f 75 74 2e 63 6f 6d 2f 64 6d 70 2f 70 69 78 65 6c 53 79 6e 63 3f 6e 69 64 3d 33 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
290	192.168.2.16	50167	35.211.178.172	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	703	OUT	GET /sync?ssp=fmx&us_privacy=&gdpr=0&gdpr_consent= HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977748
2023-12-19 09:22:32 UTC	253	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=fmx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
291	192.168.2.16	50197	23.105.12.143	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	795	OUT	GET /api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid] HTTP/1.1 Host: ssbsync-global.smartadserver.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pid=5184721251378344538; csync=86:6663647625574893018
2023-12-19 09:22:32 UTC	173	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:32 GMT location: https://onetag-sys.com/match/?int_id=107&uid=5184721251378344538 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
292	192.168.2.16	50179	34.96.105.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	610	OUT	GET /v1/api/sync/sovrn?gdpr=0&gdpr_consent= HTTP/1.1 Host: tr.blismedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:33 UTC	277	IN	HTTP/1.1 204 No Content Set-Cookie: b=658160D81C50604C154D07C7BLIS;Version=1;Domain=blismedia.com;Path=/;Max-Age=31540000;SameSite=None;Secure Date: Tue, 19 Dec 2023 09:22:32 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
293	192.168.2.16	50198	8.28.7.84	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	1292	OUT	GET /AdServer/SPug?partnerID=159047&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage4.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; PugT=1702977749; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; chkChromeAb67Sec=2; pi=156011:4; DPSync3=1704153600%3A260_259_201_263_262_261%7C1703030400%3A248%7C1703548800%3A265; SyncRTB3=1704153600%3A178_21_166_13_231_48_22_54_104_220_3_250_71%7C1703548800%3A15_223%7C1703808000%3A63
2023-12-19 09:22:33 UTC	408	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:30:20 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: SPugT=1702942220; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:30:20 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
294	192.168.2.16	50176	38.98.69.175	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	604	OUT	GET /sn.ashx?&gdpr=0&gdpr_consent= HTTP/1.1 Host: pmp.mxptint.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:33 UTC	718	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33645_10DEE0DD2_1DEE3DE&r=https://pmp.mxptint.net/sn.ashx?ak=1 P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE" P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE" Set-Cookie: mxpim=R33645_10DEE0DD2_1DEE3DE.1.0000000000000000658160D8; domain=mxptint.net; expires=Fri, 19-Dec-2025 09:22:32 GMT; path=/; secure; SameSite=None Date: Tue, 19 Dec 2023 09:22:32 GMT Connection: close Content-Length: 301 Strict-Transport-Security: max-age=-385982552; includeSubDomains
2023-12-19 09:22:33 UTC	301	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 71 63 7a 30 78 4a 6d 4e 76 5a 47 55 39 4d 6a 63 30 4e 43 5a 30 62 44 30 78 4e 54 63 32 4f 44 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 52 33 33 36 34 35 5f 31 30 44 45 45 30 44 44 32 5f 31 44 45 45 33 44 45 26 61 6d 70 3b 72 3d 68 74 74 70 73 3a 2f 2f 70 6d 70 2e 6d 78 70 74 69 6e 74 2e 6e 65 74 2f Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33645_10DEE0DD2_1DEE3DE&r=https://pmp.mxptint.net/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
295	192.168.2.16	50188	207.198.113.203	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	770	OUT	GET /dmp/pixelSync?nid=23&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel-sync.sitescout.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; _ssuma=eyIyNCI6MTcwMjk3Nzc1MTM3MCwiMzkiOjE3MDI5Nzc3NTEzNzAsIjciOjE3MDI5Nzc3NTEzNzB9
2023-12-19 09:22:33 UTC	771	IN	HTTP/1.1 302 cache-control: max-age=0,no-cache,no-store pragma: no-cache expires: Tue, 11 Oct 1977 12:34:56 GMT p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml" set-cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; Domain=.sitescout.com; Expires=Wed, 18-Dec-2024 09:22:33 GMT; Path=/; Secure; SameSite=None set-cookie: _ssuma=eyIyNCI6MTcwMjk3Nzc1MTM3MCwiNDgiOjE3MDI5Nzc3NTMwMTUsIjM5IjoxNzAyOTc3NzUxMzcwLCI3IjoxNzAyOTc3NzUxMzcwfQ; Domain=.sitescout.com; Expires=Thu, 18-Jan-2024 09:22:33 GMT; Path=/; Secure; SameSite=None location: https://ce.lijit.com/merge?pid=16&3pid=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent= content-length: 0 date: Tue, 19 Dec 2023 09:22:32 GMT server: A connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
296	192.168.2.16	50153	35.163.115.57	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	754	OUT	GET /visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=134495f3-7e94-4262-b6f5-d7524e6fbdd7&name=THE_TRADE_DESK HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:33 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:33 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 1 Via: kong/2.8.3
2023-12-19 09:22:33 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
297	192.168.2.16	50173	34.230.139.192	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:32 UTC	655	OUT	GET /api/v1/dsync/Martin?exid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: crb.kargo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:33 UTC	456	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:33 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0 Expires: Thu, 01 Jan 1970 00:00:00 UTC Pragma: no-cache Set-Cookie: ktcid=655d224e-6e9b-0d65-583b-6a0c46f32bd0; Path=/; Domain=kargo.com; Expires=Wed, 18 Dec 2024 09:22:33 GMT; Max-Age=31536000; HttpOnly; Secure; SameSite=None Vary: Origin X-Accel-Expires: 0
2023-12-19 09:22:33 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
298	192.168.2.16	50189	51.222.239.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	829	OUT	GET /match/?int_id=113&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:33 UTC	549	IN	HTTP/1.1 302 Found cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:51; domain=onetag-sys.com; SameSite=None; Secure; location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
299	192.168.2.16	50192	185.184.8.90	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	780	OUT	GET /cm-notify?pi=gumgum HTTP/1.1 Host: creativecdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: u=5daBKxwFecmtxHnQb9Qq; g=5daBKxwFecmtxHnQb9Qq_1702977747631; ts=1702977747
2023-12-19 09:22:33 UTC	397	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:33 GMT vary: Accept-Encoding location: https://usersync.gumgum.com/usersync?b=rth&i=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s&pi=gumgum cache-control: no-cache, no-store, must-revalidate, private, max-age=0 pragma: no-cache date: Tue, 19 Dec 2023 09:22:33 GMT expires: Thu, 01 Jan 1970 00:00:00 GMT content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
300	192.168.2.16	50204	35.190.90.30	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	682	OUT	GET /t/v2/sync?tagid=V2_790378&src.visitorId=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&ssp=gumgum2&gdpr=0&gdpr_consent= HTTP/1.1 Host: odr.mookie1.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:33 UTC	884	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:33 GMT Server: Apache P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml" X-Application-Context: application Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: id=10595773663510815956; Domain=.mookie1.com; Expires=Fri, 17-Jan-2025 09:22:33 GMT; Path=/; SameSite=None; Secure Set-Cookie: mdata=1\|10595773663510815956\|1702977753177; Domain=.mookie1.com; Expires=Fri, 17-Jan-2025 09:22:33 GMT; Path=/; SameSite=None; Secure Set-Cookie: ov=518597ba867079cab9f2723332aab614; Domain=.mookie1.com; Expires=Fri, 17-Jan-2025 09:22:33 GMT; Path=/; SameSite=None; Secure Content-Type: image/gif;charset=UTF-8 Content-Length: 43 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:33 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
301	192.168.2.16	50206	192.178.50.70	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	831	OUT	GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:33 UTC	742	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-doubleclick-media" Report-To: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} Content-Length: 1078 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 19 Dec 2023 09:22:33 GMT Expires: Wed, 20 Dec 2023 09:22:33 GMT Cache-Control: public, max-age=86400 Last-Modified: Tue, 08 May 2012 13:08:06 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:33 UTC	510	IN	Data Raw: 00 00 01 00 02 00 10 10 10 00 00 00 00 00 28 01 00 00 26 00 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 4e 01 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii: (& N(
2023-12-19 09:22:33 UTC	568	IN	Data Raw: 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
302	192.168.2.16	50163	211.120.53.201	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	696	OUT	GET /aux/idsync?proto=gumgum HTTP/1.1 Host: tg.socdm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:33 UTC	830	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:33 GMT Content-Length: 0 Connection: close Cache-Control: private Location: https://usersync.gumgum.com/usersync?b=sus&i=ZYFg2cCo5ssAAIowlkUAAAAA P3P: CP="See also http://www.scaleout.jp/privacy/" Set-Cookie: SOC=ZYFg2cCo5ssAAIowlkUAAAAA; path=/; expires=Thu, 18-Dec-25 09:22:33 GMT; domain=socdm.com; secure; SameSite=None X-SO-Ads-Time: 2 X-SO-HostName: m-ad421.dc4p.scaleout.jp X-SO-LB-Hostname: a-tgng40007.dc2p.scaleout.jp X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"102.129.152.212","key":"ZYFg2cCo5ssAAIowlkUAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad421"} X-SO-Key: ZYFg2cCo5ssAAIowlkUAAAAA X-SO-IP: 102.129.152.212 X-SO-Cluster-ID: 0 X-SO-Upstream-ID: m-ad421

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
303	192.168.2.16	50209	35.172.99.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	686	OUT	GET /usersync?b=oth&i=y-SstFR3RE2pey1bTXUivUmXFmI8lWJgK8WXb.~A HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:33 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:33 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:33 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
304	192.168.2.16	50221	15.197.193.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	793	OUT	GET /track/cmf/rubicon?gdpr=0&us_privacy=1--- HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUYASADKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.
2023-12-19 09:22:33 UTC	656	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:33 GMT Content-Length: 289 Connection: close server: Kestrel location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent=&expires=30 set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:33 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUYASAEKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.; expires=Thu, 19 Dec 2024 09:22:33 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:33 UTC	289	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 72 75 62 69 63 6f 6e 70 72 6f 6a 65 63 74 2e 63 6f 6d 2f 74 61 70 2e 70 68 70 3f 76 3d 38 39 38 31 26 6e 69 64 3d 32 33 30 37 26 70 75 74 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 65 78 70 69 72 65 73 3d 33 30 22 3e 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 72 75 62 69 63 6f 6e 70 72 6f 6a 65 63 74 2e 63 6f 6d 2f 74 61 70 2e 70 68 70 3f 76 3d 38 39 38 31 26 6e 69 64 3d 32 33 30 37 26 70 75 74 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 67 Data Ascii: Redirecting to: <a href="https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent=&expires=30">https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=134495f3-7e94-4262-b6f5-d7524e6fbdd7&g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
305	192.168.2.16	50177	35.190.80.1	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	494	OUT	POST /report/v3?s=j5jmmzHf2sbKjHxg4oMFTS9kYvPWIAovZibafiQS2UmkTNOTbyeEJV20X5Rn0QFXR%2F88GMrvewPP4qVAlVFxEG%2BcldVTga7IVRnsT%2Bg0gdr3s4pGp%2Fi33Wi9LJf26Gzf0J2iwm7KYfPi6g%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 562 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:33 UTC	562	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 30 36 31 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 73 73 75 6d 2d 73 65 63 2e 63 61 73 61 6c 65 6d 65 64 69 61 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 31 38 2e 33 36 2e 31 35 35 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 33 30 32 2c 22 74 79 70 65 22 3a 22 6f 6b 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c Data Ascii: [{"age":0,"body":{"elapsed_time":1061,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://ssum-sec.casalemedia.com/","sampling_fraction":0.01,"server_ip":"104.18.36.155","status_code":302,"type":"ok"},"type":"network-error","url
2023-12-19 09:22:33 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Tue, 19 Dec 2023 09:22:33 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
306	192.168.2.16	50182	198.148.27.131	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	719	OUT	GET /bh/rtset?pid=558355&ev=1&us_privacy=${us_privacy}&gpp=$&gpp_sid=$&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP/1.1 Host: bh.contextweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	1002	IN	HTTP/1.1 302 Found Connection: close P3P: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT" Accept-CH: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version CW-Server: bh-deployment-db744d8c7-d4chf Cache-Control: private, max-age=0, no-cache, no-store Expires: -1 Content-Language: en-US Set-Cookie: V=xHDGeFAGG4q9;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Fri, 13-Dec-2024 09:22:33 GMT;Max-Age=31104000;SameSite=None Set-Cookie: pb_rtb_ev=3-1oms\|7bq.0.1;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Wed, 18-Dec-2024 09:22:33 GMT;Max-Age=31536000;SameSite=None Location: https://rtb.gumgum.com/usersync?b=pln&i=xHDGeFAGG4q9&ev=1&gpp_sid=$&gpp=$&us_privacy=${us_privacy}&pid=558355 Server: Jetty(10.0.14) Strict-Transport-Security: max-age=15768000 Set-Cookie: INGRESSCOOKIE=363b52ae67c8a57f; path=/; HttpOnly; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
307	192.168.2.16	50175	54.198.64.103	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	615	OUT	GET /CookieSyncPubMatic&gdpr=0&gdpr_consent= HTTP/1.1 Host: rtb.adentifi.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:33 UTC	128	IN	HTTP/1.1 204 No Content Date: Tue, 19 Dec 2023 09:22:33 GMT Content-Type: text/plain Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
308	192.168.2.16	50183	35.172.99.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	802	OUT	GET /usersync?b=rth&i=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s&pi=gumgum HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:33 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:33 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:33 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
309	192.168.2.16	50233	207.198.113.203	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	781	OUT	GET /dmp/pixelSync?nid=1&gdpr=0&us_privacy=1--- HTTP/1.1 Host: pixel-sync.sitescout.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; _ssuma=eyIyNCI6MTcwMjk3Nzc1MTM3MCwiMzkiOjE3MDI5Nzc3NTEzNzAsIjciOjE3MDI5Nzc3NTEzNzB9
2023-12-19 09:22:33 UTC	805	IN	HTTP/1.1 302 cache-control: max-age=0,no-cache,no-store pragma: no-cache expires: Tue, 11 Oct 1977 12:34:56 GMT p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml" set-cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; Domain=.sitescout.com; Expires=Wed, 18-Dec-2024 09:22:33 GMT; Path=/; Secure; SameSite=None set-cookie: _ssuma=eyIyNCI6MTcwMjk3Nzc1MTM3MCwiMTUiOjE3MDI5Nzc3NTM5MTMsIjM5IjoxNzAyOTc3NzUxMzcwLCI3IjoxNzAyOTc3NzUxMzcwfQ; Domain=.sitescout.com; Expires=Thu, 18-Jan-2024 09:22:33 GMT; Path=/; Secure; SameSite=None location: https://pixel.rubiconproject.com/tap.php?v=7430&nid=2238&put=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&expires=360&gdpr=0&gdpr_consent= content-length: 0 date: Tue, 19 Dec 2023 09:22:33 GMT server: A connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
310	192.168.2.16	50187	54.224.142.7	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	620	OUT	GET /sync?nid=33&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	1416	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:33 GMT Location: https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-187fc9bc-38fc-5637-6fac-194e6af1e6a7$ip$102.129.152.212&name=STACKADAPT&gdpr=0&gdpr_consent= Set-Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Content-Length: 221 Connection: Close
2023-12-19 09:22:34 UTC	221	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 76 69 73 69 74 6f 72 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 2f 76 69 73 69 74 6f 72 2f 73 79 6e 63 3f 75 69 64 3d 37 34 61 31 65 63 33 62 36 31 65 37 32 39 32 35 31 39 33 63 66 63 65 65 65 61 31 62 30 36 30 38 26 61 6d 70 3b 76 69 73 69 74 6f 72 3d 30 2d 31 38 37 66 63 39 62 63 2d 33 38 66 63 2d 35 36 33 37 2d 36 66 61 63 2d 31 39 34 65 36 61 66 31 65 36 61 37 24 69 70 24 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 26 61 6d 70 3b 6e 61 6d 65 3d 53 54 41 43 4b 41 44 41 50 54 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-187fc9bc-38fc-5637-6fac-194e6af1e6a7$ip$102.129.152.212&name=STACKADAPT&gdpr=0&gdpr_consent=">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
311	192.168.2.16	50258	67.202.105.21	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	1339	OUT	GET /ps/?us_privacy=&ts=1702977749920.7&ri=25&ru=https%3A%2F%2Fads.pubmatic.com%2FAdServer%2Fjs%2Fuser_sync.html%3F%26p%3D156423%26us_privacy%3D%24%7BUS_PRIVACY%7D%26predirect%3Dhttps%253A%252F%252Fevents-ssc.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D25%2526external_user_id%253D HTTP/1.1 Host: ssc-cms.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:34 UTC	727	IN	HTTP/1.1 302 p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" set-cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632; Domain=.33across.com; Expires=Wed, 18-Dec-2024 09:22:34 GMT; Path=/; Secure; SameSite=None referrer-policy: unsafe-url pragma: no-cache cache-control: no-store, no-cache, must-revalidate expires: Thu, 01-Jan-70 00:00:01 GMT x-33x-status: 40000000008200000A server: 33XP009 location: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D content-length: 0 date: Tue, 19 Dec 2023 09:22:34 GMT connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
312	192.168.2.16	50191	23.83.76.38	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	779	OUT	GET /api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent= HTTP/1.1 Host: ssbsync.smartadserver.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pid=5184721251378344538; csync=86:6663647625574893018
2023-12-19 09:22:34 UTC	173	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:33 GMT location: https://usersync.gumgum.com/usersync?b=sad&i=5184721251378344538 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
313	192.168.2.16	50214	104.26.3.70	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	615	OUT	GET /px.gif?ch=1&e=0.5345028333417046 HTTP/1.1 Host: ad-delivery.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	1221	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-GUploader-UploadID: ABPtcPqSUlaP8J1FUQ6pzB1wYO7trXZdND3G9ypy0wOjPHG4usZjEHpFrUSkqEI7OAhZ9-T190o x-goog-generation: 1620242732037093 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 43 x-goog-hash: crc32c=cpEfJQ== x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace Expires: Tue, 21 Nov 2023 14:38:03 GMT Cache-Control: public, max-age=86400 Age: 2403135 Last-Modified: Wed, 05 May 2021 19:25:32 GMT ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3" CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kFgzWhsdAczWSZf4QQ%2B3CbAWUR7VKf5ZYtFxyuBVF7bbRe4FvG9JE7UY3jtsgi4Gfn7FkuvpXstGLnkGDVWV%2BKjNCi02KWMWzc0NNrWsSXSScqeB4SZe2Omey3i1in3jSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 837e94f29bce3371-MIA
2023-12-19 09:22:34 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
314	192.168.2.16	50203	8.28.7.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	1632	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6663647625574893018&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; chkChromeAb67Sec=2; pi=156011:4; DPSync3=1704153600%3A260_259_201_263_262_261%7C1703030400%3A248%7C1703548800%3A265; SyncRTB3=1704153600%3A178_21_166_13_231_48_22_54_104_220_3_250_71%7C1703548800%3A15_223%7C1703808000%3A63; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; PugT=1702977750
2023-12-19 09:22:34 UTC	614	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:32 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:32 GMT; path=/ Set-Cookie: PugT=1702977752; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:32 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:34 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
315	192.168.2.16	50202	35.207.24.140	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:33 UTC	607	OUT	GET /sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP/1.1 Host: rtb.mfadsrvr.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	704	IN	HTTP/1.1 302 Moved Temporarily Cache-Control: no-cache, no-store, must-revalidate Content-Length: 0 Date: Tue, 19 Dec 2023 09:22:34 GMT Location: https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent= Set-Cookie: tuuid=5aea8bca-e090-4802-94d3-585fd3816e26; path=/; expires=Thu, 18-Dec-2025 09:22:34 GMT; domain=.mfadsrvr.com; samesite=none; secure Set-Cookie: c=1702977754; path=/; expires=Thu, 18-Dec-2025 09:22:34 GMT; domain=.mfadsrvr.com; samesite=none; secure Set-Cookie: tuuid_lu=1702977754; path=/; expires=Thu, 18-Dec-2025 09:22:34 GMT; domain=.mfadsrvr.com; samesite=none; secure Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
316	192.168.2.16	50199	108.157.162.90	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	603	OUT	GET /configs/3177 HTTP/1.1 Host: config.aps.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:35 UTC	379	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 532 Connection: close Server: CloudFront Date: Tue, 19 Dec 2023 09:22:34 GMT Cache-Control: max-age=3600 X-Cache: Miss from cloudfront Via: 1.1 f9f02d3907f9c06631bedd83ea6a3cf6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P3 X-Amz-Cf-Id: -Du1LIrW9vCZ431-p03Fvv408qyKF8t0beCGZCsZolIX0phWWXqi4A==
2023-12-19 09:22:35 UTC	532	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 74 72 79 20 7b 63 6f 6e 73 74 20 61 63 63 6f 75 6e 74 49 64 20 3d 20 22 33 31 37 37 22 3b 77 69 6e 64 6f 77 2e 5f 61 70 73 20 3d 20 77 69 6e 64 6f 77 2e 5f 61 70 73 20 7c 7c 20 6e 65 77 20 4d 61 70 28 29 3b 69 66 20 28 21 5f 61 70 73 2e 68 61 73 28 61 63 63 6f 75 6e 74 49 64 29 29 20 7b 5f 61 70 73 2e 73 65 74 28 61 63 63 6f 75 6e 74 49 64 2c 20 7b 20 71 75 65 75 65 3a 20 6e 65 77 20 41 72 72 61 79 28 29 2c 20 73 74 6f 72 65 3a 20 6e 65 77 20 4d 61 70 28 29 20 7d 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 72 65 63 6f 72 64 28 6e 61 6d 65 2c 20 64 65 74 61 69 6c 29 20 7b 5f 61 70 73 2e 67 65 74 28 61 63 63 6f 75 6e 74 49 64 29 2e 71 75 65 75 65 2e 70 75 73 68 28 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 6e 74 28 6e 61 6d 65 Data Ascii: (function () {try {const accountId = "3177";window._aps = window._aps \|\| new Map();if (!_aps.has(accountId)) {_aps.set(accountId, { queue: new Array(), store: new Map() });}function record(name, detail) {_aps.get(accountId).queue.push(new CustomEvent(name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
317	192.168.2.16	50282	172.240.127.128	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	832	OUT	GET /match?bidder_id=44774&callback_url=%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3Dbf39a6af2a15b80f82f7ff725f351919%26visitor%3D%24%7BUSER_ID%7D%26name%3DBETWEENX%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_CONSENT%7D&gdpr=0&consent= HTTP/1.1 Host: ads.betweendigital.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	1028	IN	HTTP/1.1 302 Found location: /match?bidder_id=44774&callback_url=%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3Dbf39a6af2a15b80f82f7ff725f351919%26visitor%3D%24%7BUSER_ID%7D%26name%3DBETWEENX%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_CONSENT%7D&gdpr=0&consent=&crf=1&rts=-1984640480482933979 cache-control: no-cache, no-store, max-age=0, must-revalidate set-cookie: dc=was1; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:34 GMT; Path=/; Domain=.betweendigital.com; SameSite=None; Secure set-cookie: tuuid=a3da91b6-5988-5361-96e0-e2aef3618274; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:34 GMT; Path=/; Domain=.betweendigital.com; SameSite=None; Secure set-cookie: ut=ZYFg2gACJsh-9n31eSZJXTIvmopRDe1OWGS7LQ==; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:34 GMT; Path=/; Domain=.betweendigital.com; SameSite=None; Secure set-cookie: ss=1; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:34 GMT; Path=/; Domain=.betweendigital.com; SameSite=None; Secure content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
318	192.168.2.16	50172	44.197.22.251	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	659	OUT	GET /insync?vxii_pid=10067&vxii_pdid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: thrtle.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	570	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 211 Connection: close Location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&vxii_pid=12&vxii_pid1=10067&vxii_rcid=18084528-0860-4dcc-9aff-4aa340ba369a P3p: CP="NOI OUR BUS UNI COM NAV" Set-Cookie: mc=eyJpZCI6IjE4MDg0NTI4LTA4NjAtNGRjYy05YWZmLTRhYTM0MGJhMzY5YSIsImwiOjE3MDI5Nzc3NTQxMzksInQiOjF9; Path=/; Domain=thrtle.com; Expires=Tue, 19 Dec 2023 09:22:34 GMT; Max-Age=17280000; Secure; SameSite=None
2023-12-19 09:22:34 UTC	211	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 72 74 6c 65 2e 63 6f 6d 2f 69 6e 73 79 6e 63 3f 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 61 6d 70 3b 76 78 69 69 5f 70 64 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 26 61 6d 70 3b 76 78 69 69 5f 70 69 64 3d 31 32 26 61 6d 70 3b 76 78 69 69 5f 70 69 64 31 3d 31 30 30 36 37 26 61 6d 70 3b 76 78 69 69 5f 72 63 69 64 3d 31 38 30 38 34 35 32 38 2d 30 38 36 30 2d 34 64 63 63 2d 39 61 66 66 2d 34 61 61 33 34 30 62 61 33 36 39 61 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&vxii_pid=12&vxii_pid1=10067&vxii_rcid=18084528-0860-4dcc-9aff-4aa340ba369a">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
319	192.168.2.16	50242	192.132.33.69	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	660	OUT	GET /pixel/cookiesync?source=c91bfcce-bb43-46f7-b14e-567c0a4332b3&gdpr=0&us_privacy=1--- HTTP/1.1 Host: bttrack.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	580	IN	HTTP/1.1 302 Found Cache-Control: private,no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://pixel.rubiconproject.com/tap.php?v=71772&nid=3664&put=595fce4a-490f-4f40-a00c-a7a6a90a5827 Set-Cookie: GLOBALID=2uKlc8-sIBd984cSkD72DtjK9bfIrLaH3EaccEUCHlhD8_uP_CjxhO295jvemgz1HpbM-824srMC4Q2; domain=.bttrack.com; expires=Mon, 18-Mar-2024 09:21:49 GMT; path=/; secure; SameSite=None X-ServerName: Track002-iad Date: Tue, 19 Dec 2023 09:21:49 GMT Connection: close Content-Length: 223 Strict-Transport-Security: max-age=31536000;
2023-12-19 09:22:34 UTC	223	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 72 75 62 69 63 6f 6e 70 72 6f 6a 65 63 74 2e 63 6f 6d 2f 74 61 70 2e 70 68 70 3f 76 3d 37 31 37 37 32 26 61 6d 70 3b 6e 69 64 3d 33 36 36 34 26 61 6d 70 3b 70 75 74 3d 35 39 35 66 63 65 34 61 2d 34 39 30 66 2d 34 66 34 30 2d 61 30 30 63 2d 61 37 61 36 61 39 30 61 35 38 32 37 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://pixel.rubiconproject.com/tap.php?v=71772&nid=3664&put=595fce4a-490f-4f40-a00c-a7a6a90a5827">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
320	192.168.2.16	50280	172.67.38.106	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	614	OUT	GET /api/1.0/id5-api.js HTTP/1.1 Host: cdn.id5-sync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 3pi=; id5=007d896a-8f1e-732b-999f-36c629c57f99#1702977742775#1
2023-12-19 09:22:34 UTC	623	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: text/javascript;charset=utf-8 Content-Length: 154672 Connection: close x-amz-id-2: GdwFxLMpK0xnrzf2NOBL4JBefpeiZefj6IBJDWOdOwwthbrRq0GHjIqBzidg1JYvIIlarGdC1PUHbNIKa+Q+ew== x-amz-request-id: GAFJP2DRB2ZNDGDF Last-Modified: Thu, 07 Dec 2023 12:57:20 GMT ETag: "7229163a9092e2cee472ddee92dcb6ba" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=3600 CF-Cache-Status: HIT Age: 1857 Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains; preload Server: cloudflare CF-RAY: 837e94f34d32b3cd-MIA
2023-12-19 09:22:34 UTC	746	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 40 69 64 35 69 6f 2f 69 64 35 2d 61 70 69 2e 6a 73 0a 20 2a 20 40 76 65 72 73 69 6f 6e 20 76 31 2e 30 2e 35 35 0a 20 2a 20 40 6c 69 6e 6b 20 68 74 74 70 73 3a 2f 2f 69 64 35 2e 69 6f 2f 0a 20 2a 20 40 6c 69 63 65 6e 73 65 20 41 70 61 63 68 65 2d 32 2e 30 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 72 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 69 66 28 72 5b 65 5d 29 72 65 74 75 72 6e 20 72 5b 65 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 72 5b 65 5d 3d 7b 69 3a 65 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 6e 5b 65 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 74 2e 6c 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 6f 2e Data Ascii: /** * @id5io/id5-api.js * @version v1.0.55 * @link https://id5.io/ * @license Apache-2.0 */!function(n){var r={};function o(e){if(r[e])return r[e].exports;var t=r[e]={i:e,l:!1,exports:{}};return n[e].call(t.exports,t,t.exports,o),t.l=!0,t.exports}o.
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 72 79 70 74 6f 2e 72 61 6e 64 6f 6d 55 55 49 44 28 29 3b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 31 65 36 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 7d 2c 67 2e 73 65 6d 61 6e 74 69 63 56 65 72 73 69 6f 6e 43 6f 6d 70 61 72 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 5e 5c 5c 64 2b 28 5c 5c 2e 5c 5c 64 2b 28 5c 5c 2e 5c 5c 64 2b 29 7b 30 2c 31 7d 29 7b 30 2c 31 7d 24 22 3b 69 66 28 21 65 2e 6d 61 74 63 68 28 6e 29 7c 7c 21 74 2e 6d 61 74 63 68 28 6e 29 29 72 65 74 75 72 6e 3b 76 61 72 20 72 3d 65 2e 73 70 6c 69 74 28 22 2e 22 29 2c 6f 3d 74 2e 73 70 6c 69 74 28 22 2e 22 29 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 70 61 72 73 65 49 6e 74 28 65 29 7c 7c 30 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e Data Ascii: rypto.randomUUID();return"".concat(1e6*Math.random()\|0)},g.semanticVersionCompare=function(e,t){var n="^\\d+(\\.\\d+(\\.\\d+){0,1}){0,1}$";if(!e.match(n)\|\|!t.match(n))return;var r=e.split("."),o=t.split("."),n=function(e){return parseInt(e)\|\|0},e=function
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 6e 2e 68 72 65 66 3d 65 3a 6e 2e 68 72 65 66 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 3b 74 3d 74 26 26 22 64 65 63 6f 64 65 53 65 61 72 63 68 41 73 53 74 72 69 6e 67 22 69 6e 20 74 26 26 74 2e 64 65 63 6f 64 65 53 65 61 72 63 68 41 73 53 74 72 69 6e 67 3b 72 65 74 75 72 6e 7b 68 72 65 66 3a 6e 2e 68 72 65 66 2c 70 72 6f 74 6f 63 6f 6c 3a 28 6e 2e 70 72 6f 74 6f 63 6f 6c 7c 7c 22 22 29 2e 72 65 70 6c 61 63 65 28 2f 3a 24 2f 2c 22 22 29 2c 68 6f 73 74 6e 61 6d 65 3a 6e 2e 68 6f 73 74 6e 61 6d 65 2c 70 6f 72 74 3a 2b 6e 2e 70 6f 72 74 2c 70 61 74 68 6e 61 6d 65 3a 6e 2e 70 61 74 68 6e 61 6d 65 2e 72 65 70 6c 61 63 65 28 2f 5e 28 3f 21 5c 2f 29 2f 2c 22 2f 22 29 2c 73 65 61 72 63 68 3a 74 3f 6e 2e 73 65 61 72 63 68 3a 66 75 6e 63 74 Data Ascii: n.href=e:n.href=decodeURIComponent(e);t=t&&"decodeSearchAsString"in t&&t.decodeSearchAsString;return{href:n.href,protocol:(n.protocol\|\|"").replace(/:$/,""),hostname:n.hostname,port:+n.port,pathname:n.pathname.replace(/^(?!\/)/,"/"),search:t?n.search:funct
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 28 6e 2e 73 65 61 72 63 68 7c 7c 22 22 29 2c 68 61 73 68 3a 28 6e 2e 68 61 73 68 7c 7c 22 22 29 2e 72 65 70 6c 61 63 65 28 2f 5e 23 2f 2c 22 22 29 2c 68 6f 73 74 3a 6e 2e 68 6f 73 74 7c 7c 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 7d 7d 28 65 2c 6f 29 2c 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 73 2e 73 65 61 72 63 68 2c 6e 29 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 28 65 2e 70 72 6f 74 6f 63 6f 6c 7c 7c 22 68 74 74 70 22 29 2b 22 3a 2f 2f 22 2b 28 65 2e 68 6f 73 74 7c 7c 65 2e 68 6f 73 74 6e 61 6d 65 2b 28 65 2e 70 6f 72 74 3f 22 3a 22 2e 63 6f 6e 63 61 74 28 65 2e 70 6f 72 74 29 3a 22 22 29 29 2b 28 65 2e 70 61 74 68 6e 61 6d 65 7c 7c 22 22 29 2b 28 65 2e 73 65 61 72 63 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 66 Data Ascii: (n.search\|\|""),hash:(n.hash\|\|"").replace(/^#/,""),host:n.host\|\|window.location.host}}(e,o),Object.assign(s.search,n),e=function(e){return(e.protocol\|\|"http")+"://"+(e.host\|\|e.hostname+(e.port?":".concat(e.port):""))+(e.pathname\|\|"")+(e.search?"?".concat(f
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 41 72 72 61 79 28 6e 29 3b 66 6f 72 28 3b 6e 2d 2d 3b 29 72 5b 6e 5d 3d 5b 74 5b 6e 5d 2c 65 5b 74 5b 6e 5d 5d 5d 3b 72 65 74 75 72 6e 20 72 7d 3b 76 61 72 20 75 3d 6d 28 31 29 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 72 65 74 75 72 6e 28 6c 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c Data Ascii: Array(n);for(;n--;)r[n]=[t[n],e[t[n]]];return r};var u=m(1);function l(e){return(l="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 52 65 66 6c 65 63 74 7c 7c 21 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 29 72 65 74 75 72 6e 21 31 3b 69 66 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 2e 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 50 72 6f 78 79 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 Data Ascii: efined"==typeof Reflect\|\|!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}();return function(){v
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 74 26 26 72 28 65 2e 70 72 6f 74 6f 74 79 70 65 2c 74 29 2c 6e 26 26 72 28 65 2c 6e 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 22 70 72 6f 74 6f 74 79 70 65 22 2c 7b 77 72 69 74 61 62 6c 65 3a 21 31 7d 29 2c 65 7d 6e 2e 64 28 74 2c 22 61 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 29 2c 6e 2e 64 28 74 2c 22 63 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 29 2c 6e 2e 64 28 74 2c 22 62 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 29 3b 76 61 72 20 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 63 28 74 68 69 73 2c 65 29 7d 72 65 74 75 72 6e 20 Data Ascii: r)}}function u(e,t,n){return t&&r(e.prototype,t),n&&r(e,n),Object.defineProperty(e,"prototype",{writable:!1}),e}n.d(t,"a",function(){return l}),n.d(t,"c",function(){return f}),n.d(t,"b",function(){return d});var l=function(){function e(){c(this,e)}return
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 74 29 2c 72 3d 30 3b 72 3c 74 3b 72 2b 2b 29 6e 5b 72 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 3b 28 65 3d 74 68 69 73 2e 5f 64 65 6c 65 67 61 74 65 29 2e 65 72 72 6f 72 2e 61 70 70 6c 79 28 65 2c 5b 74 68 69 73 2e 5f 70 72 65 66 69 78 5d 2e 63 6f 6e 63 61 74 28 6e 29 29 7d 7d 5d 29 2c 6f 7d 28 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 6e 28 31 39 29 2c 72 3d 28 6e 28 31 32 29 2c 6e 28 31 36 29 2c 6e 28 31 29 29 3b 6e 2e 64 28 74 2c 22 68 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 61 7d 29 2c 6e 2e 64 28 74 2c 22 69 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 63 7d 29 3b 76 61 72 20 69 3d 6e 28 33 29 3b 6e 2e 64 28 74 2c 22 61 22 2c 66 75 Data Ascii: t),r=0;r<t;r++)n[r]=arguments[r];(e=this._delegate).error.apply(e,[this._prefix].concat(n))}}]),o}()},function(e,t,n){"use strict";var o=n(19),r=(n(12),n(16),n(1));n.d(t,"h",function(){return r.a}),n.d(t,"i",function(){return r.c});var i=n(3);n.d(t,"a",fu
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 29 3b 6e 3d 6e 65 77 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 28 74 68 69 73 2c 65 29 7d 76 61 72 20 74 2c 6e 2c 72 3b 72 65 74 75 72 6e 20 74 3d 65 2c 28 6e 3d 5b 7b 6b 65 79 3a 22 63 72 65 61 74 65 49 6e 73 74 61 6e 63 65 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 6f 2e 61 28 65 2c 7b 7d 2c 72 2c 6e 2c 74 29 7d 7d 5d 29 26 26 70 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 29 2c 72 Data Ascii: );n=new(function(){function e(){!function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}(this,e)}var t,n,r;return t=e,(n=[{key:"createInstance",value:function(e,t,n,r){return new o.a(e,{},r,n,t)}}])&&p(t.prototype,n),r
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 74 26 26 73 28 65 2e 70 72 6f 74 6f 74 79 70 65 2c 74 29 2c 6e 26 26 73 28 65 2c 6e 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 22 70 72 6f 74 6f 74 79 70 65 22 2c 7b 77 72 69 74 61 62 6c 65 3a 21 31 7d 29 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 2c 74 29 7b 69 66 28 21 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 6e 29 7b 76 61 72 20 72 3d 70 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 Data Ascii: r)}}function u(e,t,n){return t&&s(e.prototype,t),n&&s(e,n),Object.defineProperty(e,"prototype",{writable:!1}),e}function l(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function c(n){var r=p();return function(){var e,t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
321	192.168.2.16	50262	67.202.105.21	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	1185	OUT	GET /ps/?_=1702977749920.&ri=0015a00003HljHyAAJ&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: ssc-cms.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:34 UTC	690	IN	HTTP/1.1 302 p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" set-cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632; Domain=.33across.com; Expires=Wed, 18-Dec-2024 09:22:34 GMT; Path=/; Secure; SameSite=None referrer-policy: unsafe-url pragma: no-cache cache-control: no-store, no-cache, must-revalidate expires: Thu, 01-Jan-70 00:00:01 GMT x-33x-status: 100000000008200000A server: 33XP016 location: https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=33ACROSS&ttl=720&uid=2f9442d7df2189f76c8b593d5f54ce95&visitor=212294706585447&gdpr=0&gdpr_consent= content-length: 0 date: Tue, 19 Dec 2023 09:22:33 GMT connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
322	192.168.2.16	50248	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	721	OUT	GET /ecm3?id=LQC4ZCY6-1I-JWAU&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1--- HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:34 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: GQ07XMWXEXWT61XE2ARZ Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:34 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
323	192.168.2.16	50249	35.211.178.172	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	729	OUT	GET /sync?dsp_id=440&ssp=richaudience&user_id=I83HFE23AH5WvEMCwkME0 HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:34 UTC	555	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/?uid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&us_ps= Set-Cookie: custom_data=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: bsw_origin_init=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
324	192.168.2.16	50264	63.251.86.49	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	1013	OUT	GET /dsp/google/cookiematch/dv?gdpr=0&gdpr_consent= HTTP/1.1 Host: ap.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:34 UTC	532	IN	HTTP/1.1 302 Found Connection: close Date: Tue, 19 Dec 2023 09:22:34 GMT Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=SDJLeVRCWkhEbXo5X1pnUVNvaTJ6X1Y2&gdpr=0 Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6;Version=1;Domain=.lijit.com;Path=/;Max-Age=31536000;Secure; SameSite=None; Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, DELETE, PUT Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Requested-With, Content-Type X-Sovrn-Pod: ad_ap1dca1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
325	192.168.2.16	50238	185.184.8.90	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	695	OUT	GET /cm-notify?pi=sovrn&gdpr=0&gdpr_consent= HTTP/1.1 Host: creativecdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: u=5daBKxwFecmtxHnQb9Qq; g=5daBKxwFecmtxHnQb9Qq_1702977747631; ts=1702977747
2023-12-19 09:22:34 UTC	411	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:34 GMT vary: Accept-Encoding location: https://ce.lijit.com/merge?pid=86&3pid=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s&pi=sovrn&gdpr=0&gdpr_consent= cache-control: no-cache, no-store, must-revalidate, private, max-age=0 pragma: no-cache date: Tue, 19 Dec 2023 09:22:34 GMT expires: Thu, 01 Jan 1970 00:00:00 GMT content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
326	192.168.2.16	50253	85.114.159.93	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	625	OUT	GET /cookie/?ssp=7&gdpr=0&us_privacy=1--- HTTP/1.1 Host: dsp.adfarm1.adition.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	473	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:34 GMT Transfer-Encoding: chunked Connection: close p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI" Set-Cookie: UserID1=7314233759250446487; Max-Age=7776000; domain=.adfarm1.adition.com; Path=/; SameSite=None; Secure Location: https://pixel.rubiconproject.com/tap.php?v=101732&nid=3822&put=7314233759250446487&expires=730&gdpr=0
2023-12-19 09:22:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
327	192.168.2.16	50263	44.207.23.148	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	777	OUT	GET /sync/rubicon/6aUxQoa0TJsGmCbJQA9npcn5EUdSAgOZEtemQ7w0kco?csrc=&gdpr=0&us_privacy=1--- HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE
2023-12-19 09:22:34 UTC	873	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Length: 0 Connection: close Location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-OAWcs_VE2oJoaRBc1dERnNZgdN6nd.5XyATNkg--~A Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:34 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
328	192.168.2.16	50236	35.236.220.17	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	656	OUT	GET /rb_match?gdpr=0&us_privacy=1--- HTTP/1.1 Host: um.simpli.fi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: suid=230C3A6911DC4BB0ABF9299139F39B54
2023-12-19 09:22:34 UTC	658	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: text/html Content-Length: 142 Connection: close Location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=230C3A6911DC4BB0ABF9299139F39B54&expires=365 Expires: Mon, 18 Dec 2023 09:22:34 GMT Cache-Control: no-cache Strict-Transport-Security: max-age=63072000; includeSubdomains; preload X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
2023-12-19 09:22:34 UTC	142	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
329	192.168.2.16	50260	34.200.65.202	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	985	OUT	GET /ups/58350/sync?redir=true HTTP/1.1 Host: ups.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDSYNC=18z8~2fox; A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE
2023-12-19 09:22:34 UTC	736	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Length: 0 Strict-Transport-Security: max-age=31536000 Set-Cookie: IDSYNC="18z8~2fox:190u~2fox";Version=1;Domain=.analytics.yahoo.com;Path=/;Max-Age=31536000;Expires=Wed, 18-Dec-2024 09:22:34 GMT;Secure;SameSite=None P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Location: https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-U79fYvJE2uFwP3YGnrrUbmjtr2kCJLYH~A Age: 0 Connection: close Server: ATS/9.1.10.94 Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:34 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
330	192.168.2.16	50255	38.68.201.140	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	611	OUT	GET /sn.ashx?gdpr=0&us_privacy=1--- HTTP/1.1 Host: rbp.mxptint.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	711	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R35CAB_10DEE0DDE_1DCF549&expires=60 P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE" P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE" Set-Cookie: mxpim=R35CAB_10DEE0DDE_1DCF549.1.0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000658160DA; domain=mxptint.net; expires=Fri, 19-Dec-2025 09:22:34 GMT; path=/; secure; SameSite=None Date: Tue, 19 Dec 2023 09:22:33 GMT Connection: close Content-Length: 226 Strict-Transport-Security: max-age=-385982554; includeSubDomains
2023-12-19 09:22:34 UTC	226	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 72 75 62 69 63 6f 6e 70 72 6f 6a 65 63 74 2e 63 6f 6d 2f 74 61 70 2e 70 68 70 3f 76 3d 31 34 33 32 31 26 61 6d 70 3b 6e 69 64 3d 32 33 31 33 26 61 6d 70 3b 70 75 74 3d 52 33 35 43 41 42 5f 31 30 44 45 45 30 44 44 45 5f 31 44 43 46 35 34 39 26 61 6d 70 3b 65 78 70 69 72 65 73 3d 36 30 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R35CAB_10DEE0DDE_1DCF549&expires=60">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
331	192.168.2.16	50239	8.28.7.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	1616	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHTMDn43-HvwMcUnSsAAAAAAA&expiration=1703064151&nuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&is_secure=true&gdpr_consent=&gdpr=0 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; chkChromeAb67Sec=2; pi=156011:4; DPSync3=1704153600%3A260_259_201_263_262_261%7C1703030400%3A248%7C1703548800%3A265; SyncRTB3=1704153600%3A178_21_166_13_231_48_22_54_104_220_3_250_71%7C1703548800%3A15_223%7C1703808000%3A63; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; PugT=1702977750
2023-12-19 09:22:35 UTC	708	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:34 GMT; path=/ Set-Cookie: PugT=1702977754; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:34 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:35 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
332	192.168.2.16	50259	35.211.178.172	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	831	OUT	GET /sync?dsp_id=119&user_id=968907273661960568&expires=30&ssp=pubmatic HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:34 UTC	614	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy= Set-Cookie: custom_data=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: bsw_origin_init=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
333	192.168.2.16	50245	172.67.38.106	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	610	OUT	GET /api/1.0/esp.js HTTP/1.1 Host: cdn.id5-sync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 3pi=; id5=007d896a-8f1e-732b-999f-36c629c57f99#1702977742775#1
2023-12-19 09:22:34 UTC	623	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: text/javascript;charset=utf-8 Content-Length: 155646 Connection: close x-amz-id-2: kuVlbwnRthrnddMWS6PZcf1fu3INw7gtakR1bq+7tMTpgng/RrFpn2QjUWZL7mLtr2lZt0SA5hHSdn2trRWjVA== x-amz-request-id: HRXQAW6KCFC28286 Last-Modified: Thu, 07 Dec 2023 12:57:20 GMT ETag: "5fcefeebf5ddc7b2ddf2435967e63de9" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=3600 CF-Cache-Status: HIT Age: 3113 Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains; preload Server: cloudflare CF-RAY: 837e94f49839747f-MIA
2023-12-19 09:22:34 UTC	746	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 40 69 64 35 69 6f 2f 69 64 35 2d 61 70 69 2e 6a 73 0a 20 2a 20 40 76 65 72 73 69 6f 6e 20 76 31 2e 30 2e 35 35 0a 20 2a 20 40 6c 69 6e 6b 20 68 74 74 70 73 3a 2f 2f 69 64 35 2e 69 6f 2f 0a 20 2a 20 40 6c 69 63 65 6e 73 65 20 41 70 61 63 68 65 2d 32 2e 30 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 72 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 69 66 28 72 5b 65 5d 29 72 65 74 75 72 6e 20 72 5b 65 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 72 5b 65 5d 3d 7b 69 3a 65 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 6e 5b 65 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 74 2e 6c 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 6f 2e Data Ascii: /** * @id5io/id5-api.js * @version v1.0.55 * @link https://id5.io/ * @license Apache-2.0 */!function(n){var r={};function o(e){if(r[e])return r[e].exports;var t=r[e]={i:e,l:!1,exports:{}};return n[e].call(t.exports,t,t.exports,o),t.l=!0,t.exports}o.
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 72 79 70 74 6f 2e 72 61 6e 64 6f 6d 55 55 49 44 28 29 3b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 31 65 36 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 7d 2c 67 2e 73 65 6d 61 6e 74 69 63 56 65 72 73 69 6f 6e 43 6f 6d 70 61 72 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 5e 5c 5c 64 2b 28 5c 5c 2e 5c 5c 64 2b 28 5c 5c 2e 5c 5c 64 2b 29 7b 30 2c 31 7d 29 7b 30 2c 31 7d 24 22 3b 69 66 28 21 65 2e 6d 61 74 63 68 28 6e 29 7c 7c 21 74 2e 6d 61 74 63 68 28 6e 29 29 72 65 74 75 72 6e 3b 76 61 72 20 72 3d 65 2e 73 70 6c 69 74 28 22 2e 22 29 2c 6f 3d 74 2e 73 70 6c 69 74 28 22 2e 22 29 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 70 61 72 73 65 49 6e 74 28 65 29 7c 7c 30 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e Data Ascii: rypto.randomUUID();return"".concat(1e6*Math.random()\|0)},g.semanticVersionCompare=function(e,t){var n="^\\d+(\\.\\d+(\\.\\d+){0,1}){0,1}$";if(!e.match(n)\|\|!t.match(n))return;var r=e.split("."),o=t.split("."),n=function(e){return parseInt(e)\|\|0},e=function
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 6e 2e 68 72 65 66 3d 65 3a 6e 2e 68 72 65 66 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 3b 74 3d 74 26 26 22 64 65 63 6f 64 65 53 65 61 72 63 68 41 73 53 74 72 69 6e 67 22 69 6e 20 74 26 26 74 2e 64 65 63 6f 64 65 53 65 61 72 63 68 41 73 53 74 72 69 6e 67 3b 72 65 74 75 72 6e 7b 68 72 65 66 3a 6e 2e 68 72 65 66 2c 70 72 6f 74 6f 63 6f 6c 3a 28 6e 2e 70 72 6f 74 6f 63 6f 6c 7c 7c 22 22 29 2e 72 65 70 6c 61 63 65 28 2f 3a 24 2f 2c 22 22 29 2c 68 6f 73 74 6e 61 6d 65 3a 6e 2e 68 6f 73 74 6e 61 6d 65 2c 70 6f 72 74 3a 2b 6e 2e 70 6f 72 74 2c 70 61 74 68 6e 61 6d 65 3a 6e 2e 70 61 74 68 6e 61 6d 65 2e 72 65 70 6c 61 63 65 28 2f 5e 28 3f 21 5c 2f 29 2f 2c 22 2f 22 29 2c 73 65 61 72 63 68 3a 74 3f 6e 2e 73 65 61 72 63 68 3a 66 75 6e 63 74 Data Ascii: n.href=e:n.href=decodeURIComponent(e);t=t&&"decodeSearchAsString"in t&&t.decodeSearchAsString;return{href:n.href,protocol:(n.protocol\|\|"").replace(/:$/,""),hostname:n.hostname,port:+n.port,pathname:n.pathname.replace(/^(?!\/)/,"/"),search:t?n.search:funct
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 28 6e 2e 73 65 61 72 63 68 7c 7c 22 22 29 2c 68 61 73 68 3a 28 6e 2e 68 61 73 68 7c 7c 22 22 29 2e 72 65 70 6c 61 63 65 28 2f 5e 23 2f 2c 22 22 29 2c 68 6f 73 74 3a 6e 2e 68 6f 73 74 7c 7c 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 7d 7d 28 65 2c 6f 29 2c 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 73 2e 73 65 61 72 63 68 2c 6e 29 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 28 65 2e 70 72 6f 74 6f 63 6f 6c 7c 7c 22 68 74 74 70 22 29 2b 22 3a 2f 2f 22 2b 28 65 2e 68 6f 73 74 7c 7c 65 2e 68 6f 73 74 6e 61 6d 65 2b 28 65 2e 70 6f 72 74 3f 22 3a 22 2e 63 6f 6e 63 61 74 28 65 2e 70 6f 72 74 29 3a 22 22 29 29 2b 28 65 2e 70 61 74 68 6e 61 6d 65 7c 7c 22 22 29 2b 28 65 2e 73 65 61 72 63 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 66 Data Ascii: (n.search\|\|""),hash:(n.hash\|\|"").replace(/^#/,""),host:n.host\|\|window.location.host}}(e,o),Object.assign(s.search,n),e=function(e){return(e.protocol\|\|"http")+"://"+(e.host\|\|e.hostname+(e.port?":".concat(e.port):""))+(e.pathname\|\|"")+(e.search?"?".concat(f
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 41 72 72 61 79 28 6e 29 3b 66 6f 72 28 3b 6e 2d 2d 3b 29 72 5b 6e 5d 3d 5b 74 5b 6e 5d 2c 65 5b 74 5b 6e 5d 5d 5d 3b 72 65 74 75 72 6e 20 72 7d 3b 76 61 72 20 75 3d 6d 28 31 29 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 72 65 74 75 72 6e 28 6c 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c Data Ascii: Array(n);for(;n--;)r[n]=[t[n],e[t[n]]];return r};var u=m(1);function l(e){return(l="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 52 65 66 6c 65 63 74 7c 7c 21 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 29 72 65 74 75 72 6e 21 31 3b 69 66 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 2e 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 50 72 6f 78 79 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 Data Ascii: efined"==typeof Reflect\|\|!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}();return function(){v
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 74 26 26 72 28 65 2e 70 72 6f 74 6f 74 79 70 65 2c 74 29 2c 6e 26 26 72 28 65 2c 6e 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 22 70 72 6f 74 6f 74 79 70 65 22 2c 7b 77 72 69 74 61 62 6c 65 3a 21 31 7d 29 2c 65 7d 6e 2e 64 28 74 2c 22 61 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 29 2c 6e 2e 64 28 74 2c 22 63 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 29 2c 6e 2e 64 28 74 2c 22 62 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 29 3b 76 61 72 20 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 63 28 74 68 69 73 2c 65 29 7d 72 65 74 75 72 6e 20 Data Ascii: r)}}function u(e,t,n){return t&&r(e.prototype,t),n&&r(e,n),Object.defineProperty(e,"prototype",{writable:!1}),e}n.d(t,"a",function(){return l}),n.d(t,"c",function(){return f}),n.d(t,"b",function(){return d});var l=function(){function e(){c(this,e)}return
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 74 29 2c 72 3d 30 3b 72 3c 74 3b 72 2b 2b 29 6e 5b 72 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 3b 28 65 3d 74 68 69 73 2e 5f 64 65 6c 65 67 61 74 65 29 2e 65 72 72 6f 72 2e 61 70 70 6c 79 28 65 2c 5b 74 68 69 73 2e 5f 70 72 65 66 69 78 5d 2e 63 6f 6e 63 61 74 28 6e 29 29 7d 7d 5d 29 2c 6f 7d 28 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 63 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 21 30 3b 72 65 74 75 72 6e 20 69 2e 6d 2e 5f 65 61 63 68 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 3d 6e 26 26 74 28 65 29 7d 29 2c 6e 7d 2c 74 2e 71 3d 67 2c 74 2e 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 79 3d 21 21 65 7d 2c 74 2e 6c 3d 62 2c 74 2e 6d 3d 66 75 6e 63 74 Data Ascii: t),r=0;r<t;r++)n[r]=arguments[r];(e=this._delegate).error.apply(e,[this._prefix].concat(n))}}]),o}()},function(e,t,n){"use strict";t.c=function(e,t){var n=!0;return i.m._each(e,function(e){return n=n&&t(e)}),n},t.q=g,t.r=function(e){y=!!e},t.l=b,t.m=funct
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c 2e 70 72 6f 74 6f 74 79 70 65 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 29 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 72 3d 74 5b 6e 5d 3b 72 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 72 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 72 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 72 26 26 28 72 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 Data Ascii: ion(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function a(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defi
2023-12-19 09:22:34 UTC	1369	IN	Data Raw: 69 6f 6e 20 68 28 65 29 7b 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 3d 6f 28 65 29 7c 7c 6e 75 6c 6c 3d 3d 3d 65 29 72 65 74 75 72 6e 20 65 3b 76 61 72 20 6e 3d 65 5b 53 79 6d 62 6f 6c 2e 74 6f 50 72 69 6d 69 74 69 76 65 5d 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 6e 29 72 65 74 75 72 6e 28 22 73 74 72 69 6e 67 22 3d 3d 3d 74 3f 53 74 72 69 6e 67 3a 4e 75 6d 62 65 72 29 28 65 29 3b 74 3d 6e 2e 63 61 6c 6c 28 65 2c 74 7c 7c 22 64 65 66 61 75 6c 74 22 29 3b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 3d 6f 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 40 40 74 6f 50 72 69 6d 69 74 69 76 65 20 6d 75 73 74 20 72 65 74 75 72 6e 20 61 20 70 72 69 6d 69 74 69 76 65 20 Data Ascii: ion h(e){e=function(e,t){if("object"!==o(e)\|\|null===e)return e;var n=e[Symbol.toPrimitive];if(void 0===n)return("string"===t?String:Number)(e);t=n.call(e,t\|\|"default");if("object"!==o(t))return t;throw new TypeError("@@toPrimitive must return a primitive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
334	192.168.2.16	50215	3.84.70.71	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	811	OUT	GET /sync-iframe?redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DRISE_CODES%26ttl%3D720%26uid%3D48b439bcf2930e6408d6e795f7f1cdd2%26visitor%3D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: cs-server-s2s.yellowblue.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	645	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close access-control-allow-credentials: true access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE access-control-allow-origin: https://visitor.omnitagjs.com/ set-cookie: wrvUserID=u-mxFjSzkp_s; Path=/; Domain=.yellowblue.io; Expires=Thu, 18 Jan 2024 09:22:34 UTC; Max-Age=2592000; HttpOnly; SameSite=None; Secure x-envoy-upstream-service-time: 2 server: istio-envoy
2023-12-19 09:22:34 UTC	3027	IN	Data Raw: 62 63 63 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6f 6e 65 74 61 67 2d 73 79 73 2e 63 6f 6d 2f 75 73 79 6e 63 2f 3f 70 75 62 49 64 3d 36 39 66 34 38 63 32 31 36 30 63 38 31 31 33 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 3c 2f 69 66 72 61 6d 65 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 2e 79 69 65 6c 64 6d 6f 2e 63 6f 6d 2f 70 62 73 79 6e 63 3f 69 73 3d 72 69 73 65 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 75 73 5f 70 72 69 76 61 63 79 3d 26 72 65 64 69 72 65 63 74 55 72 Data Ascii: bcc<html><head><title></title></head><body><iframe src="https://onetag-sys.com/usync/?pubId=69f48c2160c8113&gdpr=0&gdpr_consent=" style="display:none;"></iframe><img src="https://ads.yieldmo.com/pbsync?is=rise&gdpr=0&gdpr_consent=&us_privacy=&redirectUr
2023-12-19 09:22:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
335	192.168.2.16	50266	51.222.239.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	672	OUT	GET /match/?int_id=2&uid=LQC4ZCY6-1I-JWAU&gdpr=0 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:34 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:52; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
336	192.168.2.16	50222	54.239.38.253	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	718	OUT	GET /s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr=0&us_privacy=1--- HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:34 UTC	898	IN	HTTP/1.1 302 Found Server: Server Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Length: 0 Connection: close x-amz-rid: DCAMYNW6B7NKJYWQ669J Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:34 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:34 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Location: https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=WUd4fstsQC6nKZ8ZipRYBg&rk=usync-other&gdpr=0 Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
337	192.168.2.16	50194	162.248.18.32	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	1465	OUT	GET /AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID HTTP/1.1 Host: image8.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; PugT=1702977749; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; chkChromeAb67Sec=2; pi=156011:4; DPSync3=1704153600%3A260_259_201_263_262_261%7C1703030400%3A248%7C1703548800%3A265; SyncRTB3=1704153600%3A178_21_166_13_231_48_22_54_104_220_3_250_71%7C1703548800%3A15_223%7C1703808000%3A63
2023-12-19 09:22:34 UTC	1096	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Location: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: SyncRTB3=1703808000%3A63%7C1704153600%3A13_54_3_231_220_250_21_48_22_104_71_178_166_55%7C1703548800%3A15_223; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; domain=pubmatic.com; path=/; max-age=3; SameSite=None; secure; Set-Cookie: pi=159706:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=3; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:33 GMT Content-Length: 104 Connection: close
2023-12-19 09:22:34 UTC	104	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2d 73 79 6e 63 2e 73 69 74 65 73 63 6f 75 74 2e 63 6f 6d 2f 64 6d 70 2f 70 69 78 65 6c 53 79 6e 63 3f 6e 69 64 3d 33 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
338	192.168.2.16	50240	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	688	OUT	GET /ecm3?ex=gg.com&id=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:35 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: 463Q1W25BQQSTPRRFJPD Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
339	192.168.2.16	50201	45.137.176.88	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	813	OUT	GET /cookie/adyoulike?r=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DADOTMOB%26ttl%3D720%26uid%3Db989ee06df7dfc250798f7f0dfc4ddee%26visitor%3D%7Bamob_user_id%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.adotmob.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:35 UTC	793	IN	HTTP/1.1 302 Found x-powered-by: Express vary: Origin access-control-allow-credentials: true set-cookie: uid=09ef2204008941e33a02d6b0; Domain=.adotmob.com; Path=/; Expires=Fri, 17 Jan 2025 09:22:34 GMT; Secure; SameSite=None set-cookie: uuid=09ef2204008941e33a02d6b0; Domain=.adotmob.com; Path=/; Expires=Fri, 17 Jan 2025 09:22:34 GMT; Secure; SameSite=None set-cookie: partners=AYL%3A1702977754441; Domain=.adotmob.com; Path=/; Expires=Fri, 17 Jan 2025 09:22:34 GMT; Secure; SameSite=None location: https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ADOTMOB&ttl=720&uid=b989ee06df7dfc250798f7f0dfc4ddee&visitor=09ef2204008941e33a02d6b0&gdpr=0&gdpr_consent=&gdpr=0&gdprConsent= date: Tue, 19 Dec 2023 09:22:34 GMT keep-alive: timeout=5 content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
340	192.168.2.16	50254	69.90.254.78	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	621	OUT	GET /tum?umid=2&gdpr=0&us_privacy=1--- HTTP/1.1 Host: ums.acuityplatform.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	657	IN	HTTP/1.1 302 Found Content-Length: 0 Access-Control-Allow-Origin: * Set-Cookie: auid=866838000893; Domain=.acuityplatform.com; Expires=Wed, 18-Dec-2024 09:22:34 GMT; Path=/; SameSite=None; Secure Set-Cookie: aum="OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfv7hnZlcnNpb27C+w=="; Version=1; Domain=.acuityplatform.com; Max-Age=31536000; Expires=Wed, 18-Dec-2024 09:22:34 GMT; Path=/; SameSite=None; Secure Location: https://pixel.rubiconproject.com/tap.php?v=5672&nid=2082&put=866838000893&expires=30&us_privacy=1---
2023-12-19 09:22:36 UTC	926	OUT	GET /tum?umid=6 HTTP/1.1 Host: ums.acuityplatform.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: auid=866838000893; aum="OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfv7hnZlcnNpb27C+w=="
2023-12-19 09:22:36 UTC	675	IN	HTTP/1.1 302 Found Content-Length: 0 Access-Control-Allow-Origin: * Set-Cookie: auid=866838000893; Domain=.acuityplatform.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Path=/; SameSite=None; Secure Set-Cookie: aum=OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfuANvpCzEMlAUYgLCViqkQlAUYgLCViqkUh+/uGdmVyc2lvbsL7; Domain=.acuityplatform.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Path=/; SameSite=None; Secure Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=866838000893
2023-12-19 09:22:37 UTC	956	OUT	GET /tum?umid=6 HTTP/1.1 Host: ums.acuityplatform.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: auid=866838000893; aum=OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfuANvpCzEMlAUYgLCViqkQlAUYgLCViqkUh+/uGdmVyc2lvbsL7
2023-12-19 09:22:37 UTC	675	IN	HTTP/1.1 302 Found Content-Length: 0 Access-Control-Allow-Origin: * Set-Cookie: auid=866838000893; Domain=.acuityplatform.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Path=/; SameSite=None; Secure Set-Cookie: aum=OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfuANvpCzEMlAUYgLCYGjkQlAUYgLCYGjkUh+/uGdmVyc2lvbsL7; Domain=.acuityplatform.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Path=/; SameSite=None; Secure Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=866838000893
2023-12-19 09:22:38 UTC	956	OUT	GET /tum?umid=6 HTTP/1.1 Host: ums.acuityplatform.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: auid=866838000893; aum=OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfuANvpCzEMlAUYgLCYGjkQlAUYgLCYGjkUh+/uGdmVyc2lvbsL7
2023-12-19 09:22:38 UTC	675	IN	HTTP/1.1 302 Found Content-Length: 0 Access-Control-Allow-Origin: * Set-Cookie: auid=866838000893; Domain=.acuityplatform.com; Expires=Wed, 18-Dec-2024 09:22:38 GMT; Path=/; SameSite=None; Secure Set-Cookie: aum=OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfuANvpCzEMlAUYgLCYelEQlAUYgLCYelEUh+/uGdmVyc2lvbsL7; Domain=.acuityplatform.com; Expires=Wed, 18-Dec-2024 09:22:38 GMT; Path=/; SameSite=None; Secure Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=866838000893
2023-12-19 09:22:39 UTC	956	OUT	GET /tum?umid=6 HTTP/1.1 Host: ums.acuityplatform.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: auid=866838000893; aum=OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfuANvpCzEMlAUYgLCYelEQlAUYgLCYelEUh+/uGdmVyc2lvbsL7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
341	192.168.2.16	50298	104.18.36.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	777	OUT	GET /crum?cm_dsp_id=18&expiration=1718788950&external_user_id=ae8c4288-8303-465e-8690-01650b07f760 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:34 UTC	986	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e94f56ad94c26-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:34 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:34 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EF%2BTypqzRlmoUUWmk4yytuRo6yNcc4fOTa5PR09yMsZ2VON2zh3%2B5s8mJNZI3Kfy3CrhkGtCpBHuUYZHMlmoxGCr0TGrOThtCrGM%2BcmU1WDJ1LUHWJI6rtR%2BNkKbpdUI7tK7aA422QS3Sw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:34 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
342	192.168.2.16	50271	51.222.239.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	728	OUT	GET /match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=72801ad7-cfff-40c4-85ce-2c79e9709f58 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:34 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:52; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
343	192.168.2.16	50281	23.227.146.18	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	787	OUT	GET /csync?t=a&ep=482928&extuid=72d68e79-f2f1-0102-0119-397345919658&traffic_source=snippet&session=14A0FC939D6A6483&sp=750078&pb=612004&c=656033&a=482928&domain=visitor.omnitagjs.com HTTP/1.1 Host: sync.spotim.market Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://s.spotim.market/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vmuid=36de1d8845678e06
2023-12-19 09:22:34 UTC	440	IN	HTTP/1.1 200 OK Server: Spotim Date: Tue, 19 Dec 2023 09:22:33 GMT Content-Type: image/gif Content-Length: 43 Etag: 36de1d8845678e06 Set-Cookie: vmuid=36de1d8845678e06; expires=Mon, 19 Feb 2024 09:22:34 GMT; domain=.spotim.market; path=/; secure; SameSite=None Set-Cookie: a482928=72d68e79-f2f1-0102-0119-397345919658; expires=Mon, 19 Feb 2024 09:22:34 GMT; domain=.spotim.market; path=/; secure; SameSite=None Connection: close
2023-12-19 09:22:34 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
344	192.168.2.16	50252	35.163.115.57	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	751	OUT	GET /visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LQC4ZCY6-1I-JWAU&name=RUBICON&gdpr=0&us_privacy=1--- HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:35 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 3 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:35 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
345	192.168.2.16	50210	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	932	OUT	GET /cookie-sync?gdpr=0&bee_sync_partners=sas%2Csyn%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AACk507LAsIAABM7-sg6gA&pid=558502&do=add&gdpr=0 HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: bitoIsSecure=ok; checkForPermission=ok; bito=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:35 UTC	641	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:34 GMT location: https://rtb-csync.smartadserver.com/redir?partneruserid=AACk507LAsIAABM7-sg6gA&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsyn%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID&gdpr=0 Server: gunicorn set-cookie: bito=AACk507LAsIAABM7-sg6gA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:34 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
346	192.168.2.16	50180	50.31.142.95	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	855	OUT	GET /usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_NATIVE_1_2%26ttl%3D720%26uid%3Df2d9136cf53dede7f83ba16171a37fdd%26visitor%3D__ZUID__%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: b1sync.zemanta.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: zuid=aXQaOqrGBGrZCZrdEc4x
2023-12-19 09:22:34 UTC	627	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 225 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Thu, 01 Dec 1994 16:00:00 GMT Location: https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=aXQaOqrGBGrZCZrdEc4x&gdpr=0&gdpr_consent=&gdpr=0 P3p: CP="We do not support P3P header." Pragma: no-cache Set-Cookie: zuid=aXQaOqrGBGrZCZrdEc4x; Path=/; Domain=zemanta.com; Expires=Wed, 18 Dec 2024 09:22:34 GMT; Max-Age=31536000; Secure; SameSite=None Date: Tue, 19 Dec 2023 09:22:34 GMT
2023-12-19 09:22:34 UTC	225	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 76 69 73 69 74 6f 72 2d 75 73 2d 77 65 73 74 2d 32 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 2f 76 69 73 69 74 6f 72 2f 73 79 6e 63 3f 6e 61 6d 65 3d 5a 45 4d 41 4e 54 41 5f 4e 41 54 49 56 45 5f 31 5f 32 26 61 6d 70 3b 74 74 6c 3d 37 32 30 26 61 6d 70 3b 75 69 64 3d 66 32 64 39 31 33 36 63 66 35 33 64 65 64 65 37 66 38 33 62 61 31 36 31 37 31 61 33 37 66 64 64 26 61 6d 70 3b 76 69 73 69 74 6f 72 3d 61 58 51 61 4f 71 72 47 42 47 72 5a 43 5a 72 64 45 63 34 78 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 61 6d 70 3b 67 64 70 72 3d 30 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=aXQaOqrGBGrZCZrdEc4x&gdpr=0&gdpr_consent=&gdpr=0">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
347	192.168.2.16	50213	192.184.68.215	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	737	OUT	GET /pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: cms.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	828	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Length: 0 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Pragma: no-cache Set-Cookie: d=ELMBCwHZKvijAA; expires=Mon, 18-Mar-2024 09:22:34 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Set-Cookie: mc=658160da-98e44-ad098-ad945; expires=Sat, 18-Jan-2025 09:22:34 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Strict-Transport-Security: max-age=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
348	192.168.2.16	50284	5.161.124.197	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	718	OUT	GET /match/bidswitch?id=%24%7Buser_id%7D&gdpr=0&consent=&usp=&ssp=adyoulike&bsw=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&chk=1 HTTP/1.1 Host: sync-dmp.mobtrakk.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: chk=1
2023-12-19 09:22:34 UTC	467	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Length: 0 Connection: close Location: https://x.bidswitch.net/sync?dsp_id=457&user_id=NGY5YWY0NmMyMDgxN2Jm&gdpr=0&gdpr_consent=&us_privacy=&ssp=adyoulike&bsw_param=132eab48-61bf-4eaf-9a69-4fb4f080c8bc Set-Cookie: pid=NGY5YWY0NmMyMDgxN2Jm; expires=Thu, 19 Jun 2025 09:22:34 GMT; path=/; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
349	192.168.2.16	50320	8.28.7.81	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	1775	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=40423046&p=156212&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; PugT=1702977750; chkChromeAb67Sec=3; DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; SyncRTB3=1704153600%3A250_178_13_231_22_54_21_166_220_3_71_55_48_104%7C1703808000%3A63%7C1703548800%3A15_223; ipc=159706^https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D^2^0; SPugT=1702942220
2023-12-19 09:22:34 UTC	1135	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=4; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=156212:4; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1704153600%3A259_201_263_262_260_261_245%7C1703894400%3A257%7C1703548800%3A252_265_253%7C1703030400%3A248_255%7C1704067200%3A258_256; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: SyncRTB3=1703808000%3A63%7C1705536000%3A224%7C1704240000%3A35%7C1708128000%3A69%7C1704153600%3A178_220_3_176_240_99_71_233_46_56_214_48_5_264_243_81_96_54_21_8_165_166_55_7_238_249_13_22_104_234_250_231%7C1703548800%3A223_15_38_2; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:33 GMT Transfer-Encoding: chunked Connection: close
2023-12-19 09:22:34 UTC	2980	IN	Data Raw: 31 31 30 65 0d 0a 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 74 61 70 61 64 2e 63 6f 6d 2f 69 64 73 79 6e 63 2f 65 78 2f 72 65 63 65 69 76 65 3f 70 61 72 74 6e 65 72 5f 69 64 3d 33 32 30 33 26 70 61 72 74 6e 65 72 5f 64 65 76 69 63 65 5f 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 62 70 69 2e 72 74 61 63 74 69 76 61 74 65 2e 63 6f 6d 2f 74 61 67 2f 3f 69 64 3d 32 30 39 30 39 26 75 73 65 72 5f 69 64 3d 35 44 43 33 Data Ascii: 110ePubMatic.loadAsyncImagePixel('https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://bpi.rtactivate.com/tag/?id=20909&user_id=5DC3
2023-12-19 09:22:34 UTC	1399	IN	Data Raw: 53 65 72 76 65 72 25 32 46 50 75 67 25 33 46 76 63 6f 64 65 25 33 44 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 32 4d 69 5a 30 62 44 30 78 4d 6a 6b 32 4d 44 41 25 33 44 25 33 44 25 32 36 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 25 33 44 75 69 64 25 33 41 25 35 42 4d 4d 5f 55 55 49 44 25 35 44 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 66 72 61 6d 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 67 6f 63 6d 2e 63 2e 61 70 70 69 65 72 2e 6e 65 74 2f 70 75 62 6d 61 74 69 63 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 66 72 61 6d 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 32 2f 70 75 62 6d 61 74 69 63 26 67 64 70 72 3d 30 Data Ascii: Server%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D');PubMatic.loadAsyncIframePixel('https://gocm.c.appier.net/pubmatic');PubMatic.loadAsyncIframePixel('https://sync.1rx.io/usersync2/pubmatic&gdpr=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
350	192.168.2.16	50289	35.172.99.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	773	OUT	GET /usersync?b=sus&i=ZYFg2cCo5ssAAIowlkUAAAAA HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:34 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:34 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
351	192.168.2.16	50299	104.18.36.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	751	OUT	GET /crum?cm_dsp_id=90&external_user_id=230C3A6911DC4BB0ABF9299139F39B54 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:35 UTC	990	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e94f73de821df-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:34 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:34 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mCimODx6ATuoMwFmEpoQRRTDbJztIMInGjTk4r3lQ3kTCeXOirXwxUdsYU3L%2B9wxu3KcCzclBEaLx3P656Y44Lhc%2BkOEVdxpiSnZlX%2BA7HQ%2BemMJ5kfXle7VKfN%2Bfa%2B8AFz9K0gnwfiRpQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
352	192.168.2.16	50212	216.219.92.22	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	863	OUT	GET /adxcm.aspx?ssp=5E789729-1E92-41CA-8B4F-987C6EDAE9FE&rurl=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DADMIXER%26ttl%3D720%26uid%3D0f4b0fcde45fe67019618f4c5f35f52e%26visitor%3D%24%24visitor_cookie%24%24%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: inv-nets.admixer.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	576	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Xss-Protection: 0 P3p: CP="NID DSP ALL COR" Location: https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ADMIXER&ttl=720&uid=0f4b0fcde45fe67019618f4c5f35f52e&visitor=f34834d64b984ac2ad5e1a43f09751fe&gdpr=0&gdpr_consent= Set-Cookie: am-uid=f34834d64b984ac2ad5e1a43f09751fe; expires=Mon, 18 Mar 2024 09:22:34 GMT; domain=.admixer.net; secure; SameSite=None Keep-Alive: timeout=25

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
353	192.168.2.16	50292	52.20.73.112	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	800	OUT	GET /pixel.gif?ch=185&cm=H2KyTBZHDmz9_ZgQSoi2z_V6&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent= HTTP/1.1 Host: aorta.clickagy.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cb=ZYFg1ybZKqdSngqUsIytTAGV; chs=[{"ch":"185","t":"2023-12-19 09:22:31"}]
2023-12-19 09:22:34 UTC	792	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: text/plain Content-Length: 0 Connection: close server: Aorta/20231215.627d1920a X-Aorta-Host: 1cd6e3771c52 X-Aorta-Region: us-east-1 access-control-allow-credentials: true access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction access-control-expose-headers: Set-Cookie access-control-allow-methods: POST, GET, OPTIONS access-control-allow-origin: * access-control-max-age: 31536000 cache-control: no-cache, no-store, must-revalidate expect: 0 Location: https://ce.lijit.com/merge?pid=84&3pid=ZYFg1ybZKqdSngqUsIytTAGV set-cookie: cb=ZYFg1ybZKqdSngqUsIytTAGV; Max-Age=63027504; Expires=Wed, 17 Dec 2025 21:00:58 GMT; Path=/; Domain=.clickagy.com; SameSite=None; Secure

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
354	192.168.2.16	50322	35.211.233.246	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	618	OUT	GET /sync?ssp=bidswitch&bidswitch_ssp_id=fmx HTTP/1.1 Host: a.sportradarserving.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:34 UTC	739	IN	HTTP/1.1 302 Moved Temporarily Cache-Control: no-cache, no-store, must-revalidate Content-Length: 0 Date: Tue, 19 Dec 2023 09:22:34 GMT Location: https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=fmx Set-Cookie: zuuid=717f049b-6e7a-4ed4-8020-58a3b807e659; path=/; expires=Wed, 18-Dec-2024 09:22:34 GMT; domain=sportradarserving.com; samesite=none; secure Set-Cookie: c=1702977754; path=/; expires=Wed, 18-Dec-2024 09:22:34 GMT; domain=sportradarserving.com; samesite=none; secure Set-Cookie: zuuid_lu=1702977754; path=/; expires=Wed, 18-Dec-2024 09:22:34 GMT; domain=sportradarserving.com; samesite=none; secure Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
355	192.168.2.16	50246	50.31.142.95	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	659	OUT	GET /usersync/rubicon/?gdpr=0&us_privacy=1--- HTTP/1.1 Host: b1sync.zemanta.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: zuid=aXQaOqrGBGrZCZrdEc4x
2023-12-19 09:22:34 UTC	566	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 160 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Thu, 01 Dec 1994 16:00:00 GMT Location: https://pixel.rubiconproject.com/tap.php?v=144598&nid=3992&expires=30&put=aXQaOqrGBGrZCZrdEc4x&gdpr=0&us_privacy=1--- P3p: CP="We do not support P3P header." Pragma: no-cache Set-Cookie: zuid=aXQaOqrGBGrZCZrdEc4x; Path=/; Domain=zemanta.com; Expires=Wed, 18 Dec 2024 09:22:34 GMT; Max-Age=31536000; Secure; SameSite=None Date: Tue, 19 Dec 2023 09:22:34 GMT
2023-12-19 09:22:34 UTC	160	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 72 75 62 69 63 6f 6e 70 72 6f 6a 65 63 74 2e 63 6f 6d 2f 74 61 70 2e 70 68 70 3f 76 3d 31 34 34 35 39 38 26 61 6d 70 3b 6e 69 64 3d 33 39 39 32 26 61 6d 70 3b 65 78 70 69 72 65 73 3d 33 30 26 61 6d 70 3b 70 75 74 3d 61 58 51 61 4f 71 72 47 42 47 72 5a 43 5a 72 64 45 63 34 78 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 75 73 5f 70 72 69 76 61 63 79 3d 31 2d 2d 2d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://pixel.rubiconproject.com/tap.php?v=144598&nid=3992&expires=30&put=aXQaOqrGBGrZCZrdEc4x&gdpr=0&us_privacy=1---">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
356	192.168.2.16	50294	44.207.23.148	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	788	OUT	GET /sync/casale/ZYFg02kDskXAcMABkyNPagAACu4AAAIB?gdpr_consent=&us_privacy=1---&gdpr=&gpp=&gpp_sid= HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE
2023-12-19 09:22:35 UTC	778	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:34 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
357	192.168.2.16	50288	35.172.99.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	682	OUT	GET /usersync?b=opx&i=bc35a5c6-637b-0abd-0dee-e98b0c9a5593 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:35 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:34 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:35 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
358	192.168.2.16	50305	104.18.36.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	764	OUT	GET /crum?cm_dsp_id=130&external_user_id=AACk507LAsIAABM7-sg6gA&expiration=1704187350 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:35 UTC	990	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e94f88c457421-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:34 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:34 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DHmQMexegHGPD33u%2F9YgojGKkcKj4RqIZXNnS%2B1BOUzcbTNe5H5Ii4JgMajEd1%2BJkPmBnvnFI518xe6UovVNYKLTPuzDypvCihsPPo14VbEGFmLEelx6%2Bhxi8K7gGe%2FDgBZ%2FzmvCTgZ6LQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
359	192.168.2.16	50300	104.18.36.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	740	OUT	GET /crum?cm_dsp_id=131&external_user_id=18072662089849815167 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:35 UTC	982	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e94f8b929225d-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:35 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:35 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MjElqic6qG9JwqX5XWL1FG0isbemSlJmRkrzo4tgGmYXWWSwCRfqQjCq4GCYs4wmv%2Fu2AUApJp0UHHep5Md4ykWlIKg7%2F8wuw2UU86ovb7GKT13FeSdx6CVwzMUkvenqLx3THDWsa6XGyw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
360	192.168.2.16	50297	54.82.32.1	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	827	OUT	GET /s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZYFg02kDskXAcMABkyNPagAA%262798&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=862509da372042b1b2d97a918fb6e1dd HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=CggKBgjSARDiFg; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:35 UTC	628	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Length: 0 Connection: close Location: https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=a0aee609-2968-45de-a5d3-b77df9a421f0 Set-Cookie: _li_ss=ChAKBgjSARDiFgoGCKIBEOIW; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:35 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:35 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 2 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
361	192.168.2.16	50330	8.28.7.81	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	1780	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=65345964&p=137711&s=137812&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; PugT=1702977750; chkChromeAb67Sec=3; DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; SyncRTB3=1704153600%3A250_178_13_231_22_54_21_166_220_3_71_55_48_104%7C1703808000%3A63%7C1703548800%3A15_223; ipc=159706^https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D^2^0; SPugT=1702942220
2023-12-19 09:22:35 UTC	1135	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=4; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=137711:4; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1703894400%3A257%7C1703548800%3A253_252_265%7C1704067200%3A256_258%7C1704153600%3A263_260_201_259_245_261_262%7C1703030400%3A248_255; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: SyncRTB3=1704240000%3A35%7C1705536000%3A224%7C1704153600%3A48_165_233_240_250_231_21_71_176_96_214_243_13_264_56_3_104_8_5_7_22_166_55_46_238_54_220_234_99_81_178_249%7C1703808000%3A63%7C1703548800%3A223_38_15_2%7C1708128000%3A69; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:34 GMT Transfer-Encoding: chunked Connection: close
2023-12-19 09:22:35 UTC	2980	IN	Data Raw: 31 31 30 64 0d 0a 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 74 61 70 61 64 2e 63 6f 6d 2f 69 64 73 79 6e 63 2f 65 78 2f 72 65 63 65 69 76 65 3f 70 61 72 74 6e 65 72 5f 69 64 3d 33 32 30 33 26 70 61 72 74 6e 65 72 5f 64 65 76 69 63 65 5f 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 62 70 69 2e 72 74 61 63 74 69 76 61 74 65 2e 63 6f 6d 2f 74 61 67 2f 3f 69 64 3d 32 30 39 30 39 26 75 73 65 72 5f 69 64 3d 35 44 43 33 Data Ascii: 110dPubMatic.loadAsyncImagePixel('https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://bpi.rtactivate.com/tag/?id=20909&user_id=5DC3
2023-12-19 09:22:35 UTC	1398	IN	Data Raw: 53 65 72 76 65 72 25 32 46 50 75 67 25 33 46 76 63 6f 64 65 25 33 44 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 32 4d 69 5a 30 62 44 30 78 4d 6a 6b 32 4d 44 41 25 33 44 25 33 44 25 32 36 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 25 33 44 75 69 64 25 33 41 25 35 42 4d 4d 5f 55 55 49 44 25 35 44 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 66 72 61 6d 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 67 6f 63 6d 2e 63 2e 61 70 70 69 65 72 2e 6e 65 74 2f 70 75 62 6d 61 74 69 63 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 66 72 61 6d 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 32 2f 70 75 62 6d 61 74 69 63 26 67 64 70 72 3d 30 Data Ascii: Server%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D');PubMatic.loadAsyncIframePixel('https://gocm.c.appier.net/pubmatic');PubMatic.loadAsyncIframePixel('https://sync.1rx.io/usersync2/pubmatic&gdpr=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
362	192.168.2.16	50287	69.194.240.13	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	752	OUT	GET /usersync/turn/7402232151745586090?dspret=1&gdpr=&gdpr_consent=&us_privacy= HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22zdxidn%22%3A%222069.80%22%2C%22nxtrdr%22%3Afalse%7D
2023-12-19 09:22:35 UTC	714	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:35 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%7D; path=/; expires=Wed, 18 Dec 2024 09:22:35 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://sync.targeting.unrulymedia.com/csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D97%263pid%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 connection: close
2023-12-19 09:22:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
363	192.168.2.16	50325	162.248.18.34	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:34 UTC	1772	OUT	GET /AdServer/SPug?partnerID=156078&xid=y-O5tWUOxE2uVdZ2jpuKv8kVzN9wV5VWw-~A&gdpr=0 HTTP/1.1 Host: image4.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; PugT=1702977750; chkChromeAb67Sec=3; DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; SyncRTB3=1704153600%3A250_178_13_231_22_54_21_166_220_3_71_55_48_104%7C1703808000%3A63%7C1703548800%3A15_223; ipc=159706^https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D^2^0; pi=159706:3; SPugT=1702942220
2023-12-19 09:22:35 UTC	408	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:35 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: SPugT=1702977755; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:35 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
364	192.168.2.16	50304	104.18.36.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	797	OUT	GET /rum?cm_dsp_id=39&external_user_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&expiration=1705569752&gdpr=0&gdpr_consent= HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:35 UTC	986	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e94f969e7d9f1-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:35 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:35 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WajI2K58xYrsCfTvFV2%2BTdnYBsDAM5QlGaxl3TCI490WiJnlmLzi0UtEE5U1Rn32Al93n%2FnnOymdzdX4kwgsxOLNTLuwfPu8UrbbdS4lMEKb4NdI6Nvki75ZmVSa%2BWWQ45yOwz%2BlscZo8A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
365	192.168.2.16	50286	142.250.217.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	581	OUT	GET /dot.gif?gdpr=0 HTTP/1.1 Host: s0.2mdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:35 UTC	718	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-doubleclick-media" Report-To: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} Content-Length: 43 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 19 Dec 2023 00:41:56 GMT Expires: Wed, 20 Dec 2023 00:41:56 GMT Cache-Control: public, max-age=86400 Age: 31239 Last-Modified: Sun, 01 Feb 2009 08:00:00 GMT Content-Type: image/gif Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
366	192.168.2.16	50243	173.231.178.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	731	OUT	GET /bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP/1.1 Host: cm.adgrx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:35 UTC	620	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: image/gif Content-Length: 0 Connection: close server: Cowboy set-cookie: ADGRX_UID=251c4a36-9e50-11ee-a342-3aa302158eab; Version=1; Expires=Fri, 17-Jan-2025 09:22:35 GMT; Max-Age=34128000; Domain=.adgrx.com; Path=/; Secure; SameSite=None Location: https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent= X-RealServer-NX: lga-delivery-3 Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate Pragma: no-cache Expires: Thu, 23 Sep 2004 17:42:04 GMT P3P: CP="NOI OTC OTP OUR NOR" Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
367	192.168.2.16	50290	35.172.99.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	665	OUT	GET /usersync?b=apn&i=6663647625574893018 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:35 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:35 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
368	192.168.2.16	50276	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	1017	OUT	GET /merge?pid=2&3pid=93BC46BA1AC048E6B3FEE9603D02AEE4 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:35 UTC	2108	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:35 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:35 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:35 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:35 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:35 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
369	192.168.2.16	50310	35.244.159.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	802	OUT	GET /w/1.0/sd?id=537072991&val=CAESELPt7UfyJF1YSMpdjYoT4B8&google_cver=1 HTTP/1.1 Host: us-u.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://us-u.openx.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK; univ_id=537072971\|134495f3-7e94-4262-b6f5-d7524e6fbdd7\|1702977751750893
2023-12-19 09:22:35 UTC	366	IN	HTTP/1.1 200 OK Vary: Accept Server: OXGW/0.0.0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Expires: Mon, 26 Jul 1997 05:00:00 GMT Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: image/gif Content-Length: 43 Cache-Control: private, max-age=0, no-cache Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
370	192.168.2.16	50229	54.224.142.7	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	1410	OUT	GET /sync?nid=11&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk
2023-12-19 09:22:35 UTC	304	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:35 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= Content-Length: 188 Connection: Close
2023-12-19 09:22:35 UTC	188	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 30 4d 7a 45 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 47 48 5f 4a 76 44 6a 38 56 6a 64 76 72 42 6c 4f 61 76 48 6d 70 32 61 42 6d 4e 51 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent=">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
371	192.168.2.16	50261	52.223.22.214	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	985	OUT	GET /getuid?gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D33%26xu%3D%24UID HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tluid=2271281487850057919730
2023-12-19 09:22:35 UTC	514	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Length: 0 Connection: close Location: https://ssc-cms.33across.com/ps/?us_privacy=&xi=33&xu=2271281487850057919730 Cache-Control: no-cache, no-store, must-revalidate P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Set-Cookie: tluid=2271281487850057919730; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Mon, 18 Mar 2024 09:22:35 GMT; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
372	192.168.2.16	50285	207.198.113.203	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	778	OUT	GET /dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel-sync.sitescout.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; _ssuma=eyIyNCI6MTcwMjk3Nzc1MTM3MCwiMzkiOjE3MDI5Nzc3NTEzNzAsIjciOjE3MDI5Nzc3NTEzNzB9
2023-12-19 09:22:35 UTC	836	IN	HTTP/1.1 302 cache-control: max-age=0,no-cache,no-store pragma: no-cache expires: Tue, 11 Oct 1977 12:34:56 GMT p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml" set-cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; Domain=.sitescout.com; Expires=Wed, 18-Dec-2024 09:22:35 GMT; Path=/; Secure; SameSite=None set-cookie: _ssuma=eyI0NSI6MTcwMjk3Nzc1NTI5NiwiMjQiOjE3MDI5Nzc3NTEzNzAsIjM5IjoxNzAyOTc3NzUxMzcwLCI3IjoxNzAyOTc3NzUxMzcwfQ; Domain=.sitescout.com; Expires=Thu, 18-Jan-2024 09:22:35 GMT; Path=/; Secure; SameSite=None location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent= content-length: 0 date: Tue, 19 Dec 2023 09:22:34 GMT server: A connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
373	192.168.2.16	50237	8.2.110.134	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	718	OUT	GET /77781087eb9a0621642f9ebec6beb8d1.gif?puid=[UID]&redir=[RED]&gdpr=0&gdpr_consent= HTTP/1.1 Host: cs.krushmedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: krm_usr=ae67145e-4e6a-59f0-a89d-071ebeee2681; krm_r=572
2023-12-19 09:22:35 UTC	556	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Length: 0 Connection: close Set-Cookie: krm_usr=ae67145e-4e6a-59f0-a89d-071ebeee2681; path=/; domain=.krushmedia.com; expires=Tue, 02 Jan 2024 09:22:35 GMT;SameSite=None;Secure Set-Cookie: krm_r=572; path=/; domain=.krushmedia.com; expires=Tue, 02 Jan 2024 09:22:35 GMT;SameSite=None;Secure Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Location: https://sync-km.ads.yieldmo.com/sync?pn_id=km&id=ae67145e-4e6a-59f0-a89d-071ebeee2681

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
374	192.168.2.16	50308	63.251.86.49	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	1188	OUT	GET /pixel?redir=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DSOVRN%26ttl%3D720%26uid%3D4b30a0b1f289a261ab592e1e53c126eb%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: ap.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:35 UTC	296	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 19 Dec 2023 09:22:35 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, DELETE, PUT Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Requested-With, Content-Type X-Sovrn-Pod: ad_ap1dca1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
375	192.168.2.16	50291	35.172.99.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	703	OUT	GET /usersync?b=sta&i=0-187fc9bc-38fc-5637-6fac-194e6af1e6a7$ip$102.129.152.212 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:35 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:35 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
376	192.168.2.16	50293	68.67.181.211	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	714	OUT	GET /getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&us_privacy=1--- HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018
2023-12-19 09:22:35 UTC	1048	IN	HTTP/1.1 302 Found Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6663647625574893018&us_privacy=1--- AN-X-Request-Uuid: 2faa76bc-b4d2-45aa-88ec-68afcab641ba Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:35 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
377	192.168.2.16	50301	104.18.36.155	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	760	OUT	GET /crum?cm_dsp_id=45&external_user_id=CAESEHn_Pd_rrAcqXrT5_bqGfnQ&google_cver=1 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:35 UTC	980	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e94fada4225b9-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:35 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:35 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FghJgh8kun7A3rP2uwpMb3X0j1VdlUeAcCXaslK8youlm5IAYv2LMl41HlNOtf1NPU0higAQjyD7O1KaidfMwJuSASDDQ7pLV9mp5%2BbjCHeiXhcGNWHOkluQ9aSnU5mcedL8kjJWyScmbg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
378	192.168.2.16	50295	172.64.151.101	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	794	OUT	GET /usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEB4TS_wvGArfeqKKzVxPONU&google_cver=1 HTTP/1.1 Host: ssum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:35 UTC	998	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e94fae9669ad2-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:35 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:35 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1P7oawqnIsyNoU7GCwhm%2BOpSri4mVt8A3q6KBeiL333%2BoDY%2B08U%2F2OBKS%2FhaBdFonR%2F6Lft5bYMraSdGf%2B5lVOJSXpHtFvjo70J5rItGAdH1GzPUkaH%2B9N48qdh27TZBZKg%2BEEyqIt7%2FhQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
379	192.168.2.16	50344	67.202.105.21	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	715	OUT	GET /ps/?xi=1&xu=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: ssc-cms.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:35 UTC	676	IN	HTTP/1.1 302 p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" set-cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632; Domain=.33across.com; Expires=Wed, 18-Dec-2024 09:22:35 GMT; Path=/; Secure; SameSite=None referrer-policy: unsafe-url pragma: no-cache cache-control: no-store, no-cache, must-revalidate expires: Thu, 01-Jan-70 00:00:01 GMT x-33x-status: 8000000008200000A server: 33XP002 location: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LQC4ZCY6-1I-JWAU&ts=1702977755&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1--- content-length: 0 date: Tue, 19 Dec 2023 09:22:35 GMT connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
380	192.168.2.16	50328	8.28.7.84	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	1688	OUT	GET /AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage4.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; PugT=1702977750; chkChromeAb67Sec=3; DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; SyncRTB3=1704153600%3A250_178_13_231_22_54_21_166_220_3_71_55_48_104%7C1703808000%3A63%7C1703548800%3A15_223; ipc=159706^https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D^2^0; SPugT=1702942220
2023-12-19 09:22:35 UTC	408	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:34 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: SPugT=1702977754; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:34 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
381	192.168.2.16	50317	172.64.149.180	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	648	OUT	GET /ht/htw-pixel.gif?ZYFg02kDskXAcMABkyNPagAA%262798=&us_privacy=1--- HTTP/1.1 Host: cdn.indexww.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:35 UTC	484	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: image/gif Content-Length: 43 Connection: close Last-Modified: Tue, 24 Jan 2017 19:36:04 GMT ETag: "902a3d-2b-546dc3a097100" Cache-Control: public, max-age=86400 Expires: Wed, 20 Dec 2023 09:22:35 GMT Edge-Control: cache-maxage=1h P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" CF-Cache-Status: HIT Age: 2547 Accept-Ranges: bytes Server: cloudflare CF-RAY: 837e94fbcdba7486-MIA
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
382	192.168.2.16	50350	130.211.23.194	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	569	OUT	GET /country HTTP/1.1 Host: api.btloader.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:35 UTC	332	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Cache-Control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600 Content-Type: application/json Vary: Origin Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Length: 16 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:35 UTC	16	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"country":"US"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
383	192.168.2.16	50274	142.250.189.132	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	1008	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-20035800-1&cid=430166992.1702977739&jid=183335909&_u=YCDAgEABAAQCAGAAI~&z=189824434 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:35 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:35 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:35 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
384	192.168.2.16	50324	8.28.7.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	2018	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; chkChromeAb67Sec=3; DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; SyncRTB3=1704153600%3A250_178_13_231_22_54_21_166_220_3_71_55_48_104%7C1703808000%3A63%7C1703548800%3A15_223; ipc=159706^https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D^2^0; SPugT=1702942220; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; PugT=1702977752
2023-12-19 09:22:35 UTC	686	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:35 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:35 GMT; path=/ Set-Cookie: PugT=1702977755; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:35 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
385	192.168.2.16	50278	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	1043	OUT	GET /merge?pid=27&3pid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:35 UTC	2113	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:35 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:35 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:35 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:35 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:35 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
386	192.168.2.16	50363	34.230.139.192	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	696	OUT	GET /api/v1/dsync/Rubicon?exid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: crb.kargo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ktcid=655d224e-6e9b-0d65-583b-6a0c46f32bd0
2023-12-19 09:22:35 UTC	456	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0 Expires: Thu, 01 Jan 1970 00:00:00 UTC Pragma: no-cache Set-Cookie: ktcid=655d224e-6e9b-0d65-583b-6a0c46f32bd0; Path=/; Domain=kargo.com; Expires=Wed, 18 Dec 2024 09:22:35 GMT; Max-Age=31536000; HttpOnly; Secure; SameSite=None Vary: Origin X-Accel-Expires: 0
2023-12-19 09:22:35 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
387	192.168.2.16	50296	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	688	OUT	GET /cookie-sync/ie?_bee_ppp=1 HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: bitoIsSecure=ok; checkForPermission=ok; bito=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:35 UTC	434	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:35 GMT location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AACk507LAsIAABM7-sg6gA&expiration=1704187355 Server: gunicorn set-cookie: bito=AACk507LAsIAABM7-sg6gA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:35 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
388	192.168.2.16	50327	34.111.113.62	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	814	OUT	GET /idsync/ex/receive?partner_id=1830&partner_device_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=2fbacb1a-cf7e-4185-bc55-8155b145136e%2C%2C HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:36 UTC	1101	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:36 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:36 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:36 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=1!8481;Expires=Sat, 17 Feb 2024 09:22:36 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:36 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
389	192.168.2.16	50234	169.197.150.7	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:35 UTC	707	OUT	GET /usersync/143?gdpr=0&us_privacy=1--- HTTP/1.1 Host: match.deepintent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CDIUSER=di_979c85533fdc4607be2b6; CDIPARTNERS=%7B%221%22%3A%2220231219%22%7D
2023-12-19 09:22:36 UTC	664	IN	HTTP/1.1 303 See Other p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI' location: https://pixel.rubiconproject.com/tap.php?v=1011864&nid=5528&put=di_979c85533fdc4607be2b6 set-cookie: CDIUSER=di_979c85533fdc4607be2b6; Max-Age=47260800; SameSite=None; Expires=Wed, 18 Jun 2025 09:22:36 GMT; Domain=deepintent.com; Secure; Path=/ set-cookie: CDIPARTNERS=%7B%221%22%3A%2220231219%22%2C%22143%22%3A%2220231219%22%7D; Max-Age=47260800; SameSite=None; Expires=Wed, 18 Jun 2025 09:22:36 GMT; Domain=deepintent.com; Secure; Path=/ content-type: image/gif content-length: 0 date: Tue, 19 Dec 2023 09:22:35 GMT server: a connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
390	192.168.2.16	50335	173.231.178.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	778	OUT	GET /bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent= HTTP/1.1 Host: cm.adgrx.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ADGRX_UID=251c4a36-9e50-11ee-a342-3aa302158eab
2023-12-19 09:22:36 UTC	849	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 0 Connection: close server: Cowboy set-cookie: ADGRX_UID=251c4a36-9e50-11ee-a342-3aa302158eab; Version=1; Expires=Fri, 17-Jan-2025 09:22:36 GMT; Max-Age=34128000; Domain=.adgrx.com; Path=/; Secure; SameSite=None set-cookie: ADGRX_CM_PUBMATIC_BRIDGED=1; Version=1; Expires=Wed, 20-Dec-2023 09:22:36 GMT; Max-Age=86400; Domain=.adgrx.com; Path=/; Secure; SameSite=None Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=251c4a36-9e50-11ee-a342-3aa302158eab X-RealServer-NX: lga-delivery-3 Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate Pragma: no-cache Expires: Thu, 23 Sep 2004 17:42:04 GMT P3P: CP="NOI OTC OTP OUR NOR" Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
391	192.168.2.16	50323	142.250.217.164	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	2367	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=normal&s=Y5pDg2JnqBHv5hm8ocrLBcGihlxa84Gvmbnw2NCDxhvj7nwAkjTgEp8nImgXSh2unZ-Pn5ovzrhVs24egQXvk69pRWRr0W1dpCJ0jxlefq3Lg8j7mAmnD1o-a2ch4TJcsVGyvXVcGP2b-WcGQ4WLOqqNbHRrq16CiIiNreJwMSm61HzNbYB5xfRw840wumuXWDCXD59Wvp2aR04Zot5D8zw5xq3Evcl_MMaUj5we0WFyWXndmchJd3LY8j_xA1geo5Hxo4I_U9rfG3qmt7XJWgTYglKno0s&cb=b81swjp7dfou HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fpsid%3D3261714721%26iab_gdprApplies%3Dfalse%26client%3Dsoftonic%26r%3Dm%26hl%3Dpt%26cpp%3D5%26rpbu%3Dhttps%253A%252F%252Fwww.softonic.com.br%252Fs%252F%253Frscp%253Ddsk_rscp_pt_pp%2526platformId%253Dwindows%26rpqp%3Dq%26type%3D3%26rs_tt%3Dc%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301383%26format%3Dr4%26nocache%3D9311702977738466%26num%3D0%26output%3Dafd_ads%26domain_name%3Dcaffeine.softonic.com.br%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D60%26dt%3D1702977738467%26u_w%3D1280%26u_h%3D1024%26biw%3D1263%26bih%3D907%26psw%3D1263%26psh%3D6480%26frm%3D0%26cl%3D588056317%26uio%3Dwi290-%26cont%3Drscontainer%26drt%3D0%26jsid%3Dcsa%26nfp%3D1%26jsv%3D588056317%26rurl%3Dhttps%253A%252F%252Fcaffeine.softonic.com.br%252F&hl=pt&q=EgRmgZjUGMzBhawGIjDYmH_Xf2aM1xdZKz8ZZRlQk2kz51DAs7QUplT8tENUOdH_uo1e7PI4UepJ3ir3LS4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:36 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-PgI9i3Pr014E1Opc1b6C9Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:36 UTC	361	IN	Data Raw: 32 61 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2a2d<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2023-12-19 09:22:36 UTC	1252	IN	Data Raw: 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 Data Ascii: o/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//f
2023-12-19 09:22:36 UTC	1252	IN	Data Raw: 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 2d 31 45 39 46 2c 20 55 2b 31 45 46 32 2d 31 45 46 46 2c 20 55 2b 32 30 32 30 2c 20 55 2b 32 30 41 30 2d 32 30 41 42 2c 20 55 2b 32 30 41 44 2d 32 30 43 46 2c 20 Data Ascii: boto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF,
2023-12-19 09:22:36 UTC	1252	IN	Data Raw: 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 Data Ascii: font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Roboto'; font-sty
2023-12-19 09:22:36 UTC	1252	IN	Data Raw: 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 37 34 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a Data Ascii: to/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}
2023-12-19 09:22:36 UTC	1252	IN	Data Raw: 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 39 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d Data Ascii: * vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 900; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-
2023-12-19 09:22:36 UTC	1252	IN	Data Raw: 33 50 72 30 31 34 45 31 4f 70 63 31 62 36 43 39 51 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 32 2f 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 75 2d 78 63 71 33 50 4f 43 57 46 6c 43 72 33 78 38 5f 49 50 78 67 50 75 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d 22 50 67 49 39 69 Data Ascii: 3Pr014E1Opc1b6C9Q" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com/recaptcha/api2/';</script><script type="text/javascript" src="https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js" nonce="PgI9i
2023-12-19 09:22:36 UTC	1252	IN	Data Raw: 43 61 72 55 76 56 65 54 4d 74 53 4a 38 57 67 32 6b 35 70 75 42 57 42 6e 65 71 4e 2d 4d 77 50 4a 6e 77 67 4b 67 38 66 62 4e 32 44 37 6e 52 31 54 6d 4e 74 55 44 69 6d 58 4a 4a 76 70 38 43 6c 38 6b 4a 79 43 6f 44 33 71 73 6a 59 38 4e 44 77 79 43 66 63 39 79 67 34 68 43 71 73 6f 54 54 35 34 5f 50 76 38 31 4b 6d 76 6c 34 4c 4c 2d 78 6c 7a 73 44 77 63 62 77 66 72 6b 39 72 68 63 45 76 4c 4d 77 66 77 57 6f 78 33 6c 71 35 51 75 38 31 32 62 43 73 56 76 7a 69 41 41 6e 56 59 65 36 57 73 76 74 2d 76 57 77 30 51 49 72 67 72 6e 4c 42 67 36 71 62 6f 76 49 7a 4e 71 53 70 30 34 42 69 77 45 45 6b 71 52 5f 4c 42 5a 78 63 59 77 43 6c 39 65 6c 49 71 47 6b 4d 33 58 6f 4e 70 31 68 56 63 53 48 6a 54 46 67 44 54 47 61 6f 44 69 4f 66 63 59 44 68 77 6e 61 4d 4b 75 4a 49 66 47 6c 78 Data Ascii: CarUvVeTMtSJ8Wg2k5puBWBneqN-MwPJnwgKg8fbN2D7nR1TmNtUDimXJJvp8Cl8kJyCoD3qsjY8NDwyCfc9yg4hCqsoTT54_Pv81Kmvl4LL-xlzsDwcbwfrk9rhcEvLMwfwWox3lq5Qu812bCsVvziAAnVYe6Wsvt-vWw0QIrgrnLBg6qbovIzNqSp04BiwEEkqR_LBZxcYwCl9elIqGkM3XoNp1hVcSHjTFgDTGaoDiOfcYDhwnaMKuJIfGlx
2023-12-19 09:22:36 UTC	1252	IN	Data Raw: 65 52 6d 4d 73 4f 33 6d 6d 5a 38 4e 4a 63 75 6b 2d 70 31 4f 67 47 4d 75 45 6d 77 31 54 2d 6a 36 55 46 66 36 58 72 70 52 31 48 67 70 43 51 5a 6d 35 49 36 56 39 6f 62 5a 35 74 41 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 50 67 49 39 69 33 50 72 30 31 34 45 31 4f 70 63 31 62 36 43 39 51 22 3e 0a 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 2e 61 6e 63 68 6f 72 2e 4d 61 69 6e 2e 69 6e 69 74 28 22 5b 5c 78 32 32 61 69 6e 70 75 74 5c 78 32 32 2c 5b 5c 78 32 32 62 67 64 61 74 61 5c 78 32 32 2c 5c 78 32 32 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 74 54 44 4a 5a 4d 6d 52 6d 4f 55 31 51 4e 7a 4a 6f 53 6e 4e 77 53 55 74 72 59 56 4e 66 Data Ascii: eRmMsO3mmZ8NJcuk-p1OgGMuEmw1T-j6UFf6XrpR1HgpCQZm5I6V9obZ5tA"><script type="text/javascript" nonce="PgI9i3Pr014E1Opc1b6C9Q"> recaptcha.anchor.Main.init("[\x22ainput\x22,[\x22bgdata\x22,\x22Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9tTDJZMmRmOU1QNzJoSnNwSUtrYVNf
2023-12-19 09:22:36 UTC	428	IN	Data Raw: 6b 57 6e 5a 49 4e 33 49 77 62 57 70 4a 4d 48 5a 78 64 55 56 32 65 58 4a 51 56 6e 56 73 52 6e 5a 32 4e 30 74 57 57 6a 4a 58 52 44 56 4f 62 32 31 31 55 55 77 34 64 7a 64 57 54 7a 6b 72 53 6e 4a 47 61 7a 46 4e 51 57 39 6c 57 45 78 43 4d 6a 46 42 4c 32 64 34 53 6e 70 36 61 32 5a 53 61 6e 52 71 4c 30 70 70 55 55 49 79 52 33 4a 6c 55 6e 6c 4d 57 46 5a 47 55 55 4a 53 53 57 4e 51 62 6d 5a 45 59 31 46 79 63 48 42 74 64 54 56 50 53 45 78 42 61 57 4a 70 5a 46 4e 6b 54 6d 56 6b 65 6b 70 6f 54 47 39 57 64 47 39 50 64 31 6c 44 64 46 68 7a 4d 30 39 34 51 55 59 33 62 69 39 7a 59 57 74 77 63 31 67 79 51 56 46 42 51 33 68 35 64 44 59 78 4e 6b 78 6e 54 30 39 4c 56 56 64 51 55 33 5a 79 65 56 59 78 61 48 68 5a 52 32 78 47 4d 55 56 4d 52 6e 46 35 65 47 56 47 51 58 64 6f 4c 30 Data Ascii: kWnZIN3IwbWpJMHZxdUV2eXJQVnVsRnZ2N0tWWjJXRDVOb211UUw4dzdWTzkrSnJGazFNQW9lWExCMjFBL2d4Snp6a2ZSanRqL0ppUUIyR3JlUnlMWFZGUUJSSWNQbmZEY1FycHBtdTVPSExBaWJpZFNkTmVkekpoTG9WdG9Pd1lDdFhzM094QUY3bi9zYWtwc1gyQVFBQ3h5dDYxNkxnT09LVVdQU3ZyeVYxaHhZR2xGMUVMRnF5eGVGQXdoL0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
392	192.168.2.16	50270	51.222.239.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	702	OUT	GET /match/?int_id=3&uid=9db4533c9ac65d1375943e865ca2281c&gdpr_consent=&gdpr=0 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:36 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:54; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
393	192.168.2.16	50275	35.211.178.172	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	805	OUT	GET /sync?dsp_id=457&user_id=NGY5YWY0NmMyMDgxN2Jm&gdpr=0&gdpr_consent=&us_privacy=&ssp=adyoulike&bsw_param=132eab48-61bf-4eaf-9a69-4fb4f080c8bc HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:36 UTC	584	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //visitor.omnitagjs.com/visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&name=BIDSWITCH&gdpr=0&gdpr_consent= Set-Cookie: custom_data=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: bsw_origin_init=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
394	192.168.2.16	50267	51.222.239.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	706	OUT	GET /match/?int_id=1&uid=7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:36 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:54; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
395	192.168.2.16	50318	34.111.113.62	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	771	OUT	GET /idsync/ex/receive?partner_id=3355&partner_device_id=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:36 UTC	1095	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:36 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:36 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:36 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:36 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:36 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
396	192.168.2.16	50269	51.222.239.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	726	OUT	GET /match/?gdpr=&gdpr_consent=%24%7BGDPR_STRING%7D&int_id=168&uid=OPUfcf5109a1a63427ca17f2e650a5ade17 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:36 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:54; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
397	192.168.2.16	50303	34.200.65.202	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	839	OUT	GET /ups/55940/sync?_origin=1&redir2=true&uid=ZYFg02kDskXAcMABkyNPagAACu4AAAIB&gdpr_consent=&us_privacy=1---&gdpr=&gpp=&gpp_sid= HTTP/1.1 Host: ups.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDSYNC=18z8~2fox; A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE
2023-12-19 09:22:36 UTC	718	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Length: 0 Strict-Transport-Security: max-age=31536000 Set-Cookie: IDSYNC="18z8~2fox:175w~2fox";Version=1;Domain=.analytics.yahoo.com;Path=/;Max-Age=31536000;Expires=Wed, 18-Dec-2024 09:22:36 GMT;Secure;SameSite=None P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Location: https://pr-bh.ybp.yahoo.com/sync/casale/ZYFg02kDskXAcMABkyNPagAACu4AAAIB Age: 0 Connection: close Server: ATS/9.1.10.94 Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:36 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
398	192.168.2.16	50365	8.28.7.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	2227	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; PugT=1702977754; pi=137711:4; DPSync3=1703894400%3A257%7C1703548800%3A253_252_265%7C1704067200%3A256_258%7C1704153600%3A263_260_201_259_245_261_262%7C1703030400%3A248_255; SyncRTB3=1704240000%3A35%7C1705536000%3A224%7C1704153600%3A48_165_233_240_250_231_21_71_176_96_214_243_13_264_56_3_104_8_5_7_22_166_55_46_238_54_220_234_99_81_178_249%7C1703808000%3A63%7C1703548800%3A223_38_15_2%7C1708128000%3A69; SPugT=1702977755
2023-12-19 09:22:36 UTC	794	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:35 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:35 GMT; path=/ Set-Cookie: PugT=1702977755; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:35 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
399	192.168.2.16	50372	68.67.181.211	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	749	OUT	GET /getuidnb?https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4894%26nid%3D1986%26put%3D$UID%26expires%3D30&gdpr=0&us_privacy=1--- HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018
2023-12-19 09:22:36 UTC	1059	IN	HTTP/1.1 302 Found Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://pixel.rubiconproject.com/tap.php?v=4894&nid=1986&put=6663647625574893018&expires=30&gdpr=0&us_privacy=1--- AN-X-Request-Uuid: 44e5d3b5-0f33-4c6b-ab7f-ca2461c86d56 Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:36 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
400	192.168.2.16	50341	35.172.99.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	673	OUT	GET /usersync?b=zem&i=aXQaOqrGBGrZCZrdEc4x&gdpr=0 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:37 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:37 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
401	192.168.2.16	50384	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	697	OUT	GET /ecm3?ex=onetag.com&id=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:36 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: E93D24B18YRHKFXS3CS7 Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:36 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
402	192.168.2.16	50332	192.184.68.215	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	794	OUT	GET /pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: cms.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: d=ELMBCwHZKvijAA; mc=658160da-98e44-ad098-ad945
2023-12-19 09:22:36 UTC	494	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Length: 0 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE Pragma: no-cache Strict-Transport-Security: max-age=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
403	192.168.2.16	50392	3.94.183.232	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	784	OUT	GET /usersync?b=adf&i=6074270596568283332&gdpr=0&gdpr_consent= HTTP/1.1 Host: rtb.gumgum.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:36 UTC	263	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif;charset=UTF-8 Content-Length: 35 Connection: close Server: nginx Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache Timing-Allow-Origin: *
2023-12-19 09:22:36 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
404	192.168.2.16	50338	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	698	OUT	GET /ecm3?ex=rubiconprojectHMT&id=Tw4728KPQIaXIzG5auIVXg&gdpr=0 HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:36 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: 63Q9KD83H7BNF0K6H31X Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:36 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
405	192.168.2.16	50313	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	1035	OUT	GET /merge?pid=49&3pid=UJ0Gt3SdkRY8&ev=1&pid=558511&gdpr_consent=&gdpr=0 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:36 UTC	2089	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:36 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:36 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
406	192.168.2.16	50326	8.28.7.81	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	1770	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=20673352&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; PugT=1702977750; chkChromeAb67Sec=3; DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; SyncRTB3=1704153600%3A250_178_13_231_22_54_21_166_220_3_71_55_48_104%7C1703808000%3A63%7C1703548800%3A15_223; ipc=159706^https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D^2^0; SPugT=1702942220
2023-12-19 09:22:36 UTC	1056	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=4; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=0:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1703548800%3A253_265_252%7C1704153600%3A245_262_201_259_260_261_263%7C1703894400%3A257%7C1703030400%3A248_255%7C1704067200%3A258_256; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: SyncRTB3=1704153600%3A46_249_21_220_5_165_8_13_71_231_166_55_104_233_22_54_48_240_176_250_178_3%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:34 GMT Transfer-Encoding: chunked Connection: close
2023-12-19 09:22:36 UTC	2273	IN	Data Raw: 38 64 35 0d 0a 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 74 61 70 61 64 2e 63 6f 6d 2f 69 64 73 79 6e 63 2f 65 78 2f 72 65 63 65 69 76 65 3f 70 61 72 74 6e 65 72 5f 69 64 3d 33 32 30 33 26 70 61 72 74 6e 65 72 5f 64 65 76 69 63 65 5f 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 62 70 69 2e 72 74 61 63 74 69 76 61 74 65 2e 63 6f 6d 2f 74 61 67 2f 3f 69 64 3d 32 30 39 30 39 26 75 73 65 72 5f 69 64 3d 35 44 43 33 35 Data Ascii: 8d5PubMatic.loadAsyncImagePixel('https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://bpi.rtactivate.com/tag/?id=20909&user_id=5DC35

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
407	192.168.2.16	50347	54.224.142.7	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	1410	OUT	GET /sync?nid=11&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk
2023-12-19 09:22:36 UTC	304	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:36 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= Content-Length: 188 Connection: Close
2023-12-19 09:22:36 UTC	188	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 30 4d 7a 45 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 47 48 5f 4a 76 44 6a 38 56 6a 64 76 72 42 6c 4f 61 76 48 6d 70 32 61 42 6d 4e 51 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent=">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
408	192.168.2.16	50352	35.211.178.172	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	946	OUT	GET /sync?ssp=the33across&us_privacy= HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:36 UTC	335	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //rtb.mfadsrvr.com/sync?ssp=bidswitch&bidswitch_ssp_id=the33across&bsw_user_id=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&us_privacy=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
409	192.168.2.16	50340	104.18.25.173	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	960	OUT	GET /i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP/1.1 Host: a.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ANON_ID=alnsXDtZdPuem7SpBmPo7WiLw5VjMZbMU1mO0RZaP4nvdBsZaZaOVoVF01ql5S0HjhMClbMNqFswa24lfMTnj
2023-12-19 09:22:36 UTC	859	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 43 Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 302 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=aMnvBNR3YWj7UXuRu8rphZdE4WTZaZaEDQvYjPmERPNF0tHAA5CvWXsu4PFIemUJmP6K2wkAq9Nko0sDpOrByUTSAIfZc5Du5TdjNp4RipQtRIZba4xK4Spt8; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:36 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=aMnvBNR3YWj7UXuRu8rphZdE4WTZaZaEDQvYjPmERPNF0tHAA5CvWXsu4PFIemUJmP6K2wkAq9Nko0sDpOrByUTSAIfZc5Du5TdjNp4RipQtRIZba4xK4Spt8; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:36 GMT; CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 837e9500fb0267ce-MIA alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:36 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 40 02 02 44 01 00 3b Data Ascii: GIF89a!,@D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
410	192.168.2.16	50380	74.119.119.150	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	924	OUT	GET /dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP/1.1 Host: dis.criteo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uid=bcf55414-01bc-4254-873e-0589d6530dae
2023-12-19 09:22:36 UTC	532	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:35 GMT server: Kestrel cache-control: no-cache expires: Tue, 19 Dec 2023 00:00:00 GMT location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent= pragma: no-cache x-errorlevel: 0 p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" cross-origin-resource-policy: cross-origin server-processing-duration-in-ticks: 2646740 strict-transport-security: max-age=31536000; preload; connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.16	50425	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	2151	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent= HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; PugT=1702977754; pi=137711:4; DPSync3=1703894400%3A257%7C1703548800%3A253_252_265%7C1704067200%3A256_258%7C1704153600%3A263_260_201_259_245_261_262%7C1703030400%3A248_255; SyncRTB3=1704240000%3A35%7C1705536000%3A224%7C1704153600%3A48_165_233_240_250_231_21_71_176_96_214_243_13_264_56_3_104_8_5_7_22_166_55_46_238_54_220_234_99_81_178_249%7C1703808000%3A63%7C1703548800%3A223_38_15_2%7C1708128000%3A69; SPugT=1702977755
2023-12-19 09:22:36 UTC	761	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:35 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:35 GMT; path=/ Set-Cookie: PugT=1702977755; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:35 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.16	50400	35.211.178.172	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	722	OUT	GET /sync?ssp=krushmedia&user_id=ae67145e-4e6a-59f0-a89d-071ebeee2681 HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:36 UTC	269	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //sync.srv.stackadapt.com/sync?nid=50&gdpr=&gdpr_consent=&gdpr_pd=&ssp=krushmedia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
413	192.168.2.16	50360	3.233.88.120	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	637	OUT	GET /cs?aid=11590&id=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: cs.yellowblue.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: application/javascript Content-Length: 0 Connection: close access-control-allow-credentials: true access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE access-control-allow-origin: https://eus.rubiconproject.com/ x-envoy-upstream-service-time: 1 server: istio-envoy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
414	192.168.2.16	50356	35.244.193.51	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	761	OUT	GET /v1/envelope?pid=0013300001kQj1aAAC&src=aps&ver=1.2.0&us_privacy=1--- HTTP/1.1 Host: lexicon.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:36 UTC	374	IN	HTTP/1.1 200 OK vary: origin access-control-allow-credentials: true access-control-allow-origin: https://caffeine.softonic.com.br cache-control: private, must-revalidate, max-age=28800 content-type: application/json Content-Length: 42 via: 1.1 google date: Tue, 19 Dec 2023 09:22:35 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:36 UTC	42	IN	Data Raw: 7b 22 73 75 63 63 65 65 64 65 64 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 22 3a 22 43 6f 6f 6b 69 65 64 20 55 73 65 72 22 7d Data Ascii: {"succeeded":false,"error":"Cookied User"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
415	192.168.2.16	50351	130.211.23.194	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	750	OUT	GET /pv?tid=l9ItNXPhk&w=5299385968099328&o=5633429348548608&cv=2.1.26&widget=false&r=false&vr=1280x907&pageURL=https%3A%2F%2Fcaffeine.softonic.com.br%2F&sid=2Hh8ZkRI&c=false&pm=false&upapi=true HTTP/1.1 Host: api.btloader.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:36 UTC	255	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate Vary: Origin Date: Tue, 19 Dec 2023 09:22:36 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
416	192.168.2.16	50394	52.86.247.227	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	783	OUT	GET /d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&gdpr=0&us_privacy=1--- HTTP/1.1 Host: sync.ipredictive.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cu=92ceaf34-27c5-4c21-b9d3-66c038610988\|1702977752212
2023-12-19 09:22:36 UTC	511	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:36 GMT Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=92ceaf34-27c5-4c21-b9d3-66c038610988&expires=30&gdpr=0&us_privacy=1--- Set-Cookie: cu=92ceaf34-27c5-4c21-b9d3-66c038610988\|1702977752212; Path=/; Domain=ipredictive.com; Expires=Wed, 18 Dec 2024 09:22:36 GMT; Max-Age=31536000; SameSite=None; Secure X-CI-RTID: 89ffa870-f4f3-4c1d-987d-424a00f2253e Content-Length: 175 Connection: Close
2023-12-19 09:22:36 UTC	175	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 72 75 62 69 63 6f 6e 70 72 6f 6a 65 63 74 2e 63 6f 6d 2f 74 61 70 2e 70 68 70 3f 76 3d 31 37 31 34 39 26 61 6d 70 3b 6e 69 64 3d 32 38 36 31 26 61 6d 70 3b 70 75 74 3d 39 32 63 65 61 66 33 34 2d 32 37 63 35 2d 34 63 32 31 2d 62 39 64 33 2d 36 36 63 30 33 38 36 31 30 39 38 38 26 61 6d 70 3b 65 78 70 69 72 65 73 3d 33 30 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 75 73 5f 70 72 69 76 61 63 79 3d 31 2d 2d 2d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=92ceaf34-27c5-4c21-b9d3-66c038610988&expires=30&gdpr=0&us_privacy=1---">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
417	192.168.2.16	50348	54.157.11.141	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	848	OUT	GET /ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP/1.1 Host: pm.w55c.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:36 UTC	711	IN	HTTP/1.1 302 Cache-Control: no-cache, must-revalidate Date: Tue, 19 Dec 2023 09:22:35 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Location: https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= Pragma: no-cache Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-00176663060b90eb6@us-east-1d@dxedge-app-us-east-1-prod-asg Set-Cookie: wfivefivec=UzeiMh5u1Rfwja5; Domain=.w55c.net; Expires=Fri, 17-Jan-2025 19:22:36 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
418	192.168.2.16	50377	159.89.246.130	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	648	OUT	GET /usersync?cn=5529&ttt=1&dpui=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: e.serverbid.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:36 UTC	531	IN	HTTP/1.1 200 OK access-control-allow-origin: https://eus.rubiconproject.com access-control-allow-credentials: true access-control-allow-headers: origin, content-type, accept access-control-allow-methods: GET, POST, OPTIONS access-control-max-age: 10080 content-type: image/gif content-length: 35 set-cookie: CONSUMABLEID=5dbd0af681dc4dc3bd0af681dc8dc33a; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:36 GMT; Path=/; Domain=.serverbid.com; Secure; SameSite=None date: Tue, 19 Dec 2023 09:22:36 GMT connection: close
2023-12-19 09:22:36 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
419	192.168.2.16	50373	35.244.154.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	609	OUT	GET /711333.gif?&gdpr=0&gdpr_consent= HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:36 UTC	664	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://id.rlcdn.com/1000.gif?memo=CKW1KxoNCNzBhawGEgUI6AcQAEIASgA P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=iDTe1BCXSzCs8E/OKmA//IMCKlmjE6GaK7+b18+saXk=; Path=/; Domain=rlcdn.com; Expires=Wed, 18 Dec 2024 09:22:36 GMT; Secure; SameSite=None Set-Cookie: pxrc=CAA=; Path=/; Domain=rlcdn.com; Expires=Sat, 17 Feb 2024 09:22:36 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
420	192.168.2.16	50355	3.94.183.232	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	710	OUT	GET /usersync?b=pln&i=xHDGeFAGG4q9&ev=1&gpp_sid=$&gpp=$&us_privacy=${us_privacy}&pid=558355 HTTP/1.1 Host: rtb.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:36 UTC	263	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif;charset=UTF-8 Content-Length: 35 Connection: close Server: nginx Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache Timing-Allow-Origin: *
2023-12-19 09:22:36 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.16	50396	34.96.105.8	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	664	OUT	GET /v1/api/sync/rubicon?gdpr=0&us_privacy=1--- HTTP/1.1 Host: tr.blismedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b=658160D81C50604C154D07C7BLIS
2023-12-19 09:22:37 UTC	417	IN	HTTP/1.1 307 Temporary Redirect Location: https://pixel.rubiconproject.com/tap.php?v=12406&nid=2540&put=658160D81C50604C154D07C7BLIS&expires=30 Set-Cookie: b=658160D81C50604C154D07C7BLIS;Version=1;Domain=blismedia.com;Path=/;Max-Age=31540000;SameSite=None;Secure Content-Length: 0 Date: Tue, 19 Dec 2023 09:22:36 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.16	50418	68.67.161.208	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	685	OUT	GET /prebid/setuid?bidder=rubicon&uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018
2023-12-19 09:22:36 UTC	1368	IN	HTTP/1.1 200 OK Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: b0bb9c98-2948-49ed-81ac-8b169d5277a5 Set-Cookie: anj=dTM7k!M4/YCxrEQF']wIg2GU`aghWq!1yIE'Yg-$<@[#3*V!gos0S4uQ2sZ8iq%iMtf8rS)yEAmJYfkG9T5_m!x(#2(:BN@; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:36 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: uids=eyJ0ZW1wVUlEcyI6eyJydWJpY29uIjp7InVpZCI6IkxRQzRaQ1k2LTFJLUpXQVUiLCJleHBpcmVzIjoiMjAyNC0wMy0xOFQwOToyMjozNloifX0sImJpcnRoZGF5IjoiMjAyMy0xMi0xOVQwOToyMjozNloifQ==; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:36 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:36 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2023-12-19 09:22:36 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a!,@L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
423	192.168.2.16	50345	35.163.115.57	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	792	OUT	GET /visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-187fc9bc-38fc-5637-6fac-194e6af1e6a7$ip$102.129.152.212&name=STACKADAPT&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:37 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 5 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:37 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.16	50413	192.184.68.215	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	630	OUT	GET /pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: cms.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:36 UTC	718	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Length: 0 Connection: close Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Location: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Pragma: no-cache Set-Cookie: d=EFgBDQHZKt-owQA; expires=Mon, 18-Mar-2024 09:22:36 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Set-Cookie: mc=658160dc-8eeb9-895f2-d0e4b; expires=Sat, 18-Jan-2025 09:22:36 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Strict-Transport-Security: max-age=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.16	50414	159.127.43.82	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	697	OUT	GET /w/user.sync?ptrid=14&userid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: match.sync.ad.cpe.dotomi.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: DotomiTest=736715c3f541548
2023-12-19 09:22:37 UTC	581	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-cache Pragma: no-cache Expires: 0 Accept-CH: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Set-Cookie: DotomiUser=718507358754739980$3$501652885$$1; Expires=Wed, 15 Jan 2025 09:22:36 GMT; Path=/; Domain=.dotomi.com; SameSite=None; Secure Set-Cookie: receive-cookie-deprecation=1; Expires=Wed, 18 Dec 2024 09:22:36 GMT; Path=/; Domain=.dotomi.com; Secure; HTTPOnly; SameSite=None; Partitioned
2023-12-19 09:22:37 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
426	192.168.2.16	50378	52.46.128.147	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	721	OUT	GET /ecm3?id=LQC4ZCY6-1I-JWAU&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1--- HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:36 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: 23QZ5873ARYRRW89H3PP Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:36 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
427	192.168.2.16	50337	51.222.239.230	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	670	OUT	GET /match/?int_id=107&uid=5184721251378344538 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:36 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:54; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
428	192.168.2.16	50393	35.172.99.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	665	OUT	GET /usersync?b=sad&i=5184721251378344538 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:36 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:36 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
429	192.168.2.16	50367	34.149.50.64	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	651	OUT	GET /cs/cookiesync/Rubicon?channeluid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: s.seedtag.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:36 UTC	419	IN	HTTP/1.1 204 No Content Server: openresty Date: Tue, 19 Dec 2023 09:22:36 GMT Access-Control-Allow-Methods: GET, POST, OPTIONS, DELETE, PUT, HEAD Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.16	50403	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	1057	OUT	GET /merge?pid=16&3pid=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:36 UTC	2127	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:36 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:36 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.16	50408	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	699	OUT	GET /match/?int_id=106&google_gid=CAESEBV6UFJEVZiVnNP6YpSJcqk&google_cver=1 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:36 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:54; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
432	192.168.2.16	50374	34.111.113.62	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	783	OUT	GET /idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:36 UTC	1095	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:36 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:36 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:36 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:36 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:36 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.16	50412	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	825	OUT	GET /usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%7D
2023-12-19 09:22:37 UTC	683	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:36 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:36 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5966854299 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.16	50401	52.89.73.205	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	788	OUT	GET /visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=aXQaOqrGBGrZCZrdEc4x&gdpr=0&gdpr_consent=&gdpr=0 HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:36 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 5 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:36 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
435	192.168.2.16	50359	162.55.236.225	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	886	OUT	GET /697a8452aebbe5875da0878cfaf3d0d0/?uid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&us_ps= HTTP/1.1 Host: sync.richaudience.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sync.richaudience.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pdid=64f4bbfb-8ac7-4d56-b41c-1zz1702977725; raibs=1; avcid-imd-uid=9f860467-d79c-45d4-bcf9-51ad3d856e68; avcid-inx-uid=ZYFg02kDskXAcMABkyNPagAACu4AAAIB; avcid-bsx-uid=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:37 UTC	438	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Tue, 19 Dec 2023 09:22:16 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.2.4 P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: avcid-bsw-uid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; expires=Mon, 18 Mar 2024 09:22:16 GMT; Max-Age=7776000; path=/; domain=.richaudience.com; secure; HttpOnly; SameSite=None
2023-12-19 09:22:37 UTC	106	IN	Data Raw: 35 66 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 5fPNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
436	192.168.2.16	50277	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	1010	OUT	GET /merge?pid=84&3pid=ZYFg1ybZKqdSngqUsIytTAGV HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:37 UTC	2101	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:36 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:37 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
437	192.168.2.16	50311	69.175.41.15	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	1412	OUT	GET /merge?pid=71&3pid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4
2023-12-19 09:22:36 UTC	2097	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:36 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9jbFuAjEQBf%2FFdVay1%2BtdO92eMdKhiwRSogg6jM8UKSkj%2Fh1fQztvRu%2FfoPk0yU%2BZeFKn2VIsPPl9KYmt31nUUsh8GJThOU%2BUQvcgayIgZITKPUCTgLRyr63JcKMd7nLKdMnHGdwByvKNg6fti5k9kzCGIBSTty5uiX8nZwY3w%2BFXfzYeBlfNf8HKoo9ZdfoSeNz5rmMVHivKyq0Lw9W1K9i4MmDDBNRvtt6kco1ini9gATcg; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:36 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.16	50406	52.89.73.205	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	782	OUT	GET /visitor/sync?name=ADMIXER&ttl=720&uid=0f4b0fcde45fe67019618f4c5f35f52e&visitor=f34834d64b984ac2ad5e1a43f09751fe&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:37 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:37 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
439	192.168.2.16	50339	34.227.128.134	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	743	OUT	GET /sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: match.sharethrough.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: stx_user_id=8e71ecfd-8285-4086-9d46-6047ffd70504
2023-12-19 09:22:36 UTC	320	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/png Content-Length: 68 Connection: close Set-Cookie: stx_user_id=8e71ecfd-8285-4086-9d46-6047ffd70504; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:36 GMT; Path=/; Domain=.sharethrough.com; Secure; SameSite=None Cache-Control: no-cache
2023-12-19 09:22:36 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0b 49 44 41 54 78 da 63 f8 ff 1f 00 03 00 01 ff 6f 81 ab b6 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxcoIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
440	192.168.2.16	50364	23.105.14.106	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	730	OUT	GET /redir/?partnerid=104&partneruserid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: rtb-csync.smartadserver.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pid=5184721251378344538; csync=86:6663647625574893018
2023-12-19 09:22:36 UTC	394	IN	HTTP/1.1 200 OK content-type: image/gif date: Tue, 19 Dec 2023 09:22:36 GMT cache-control: no-cache,no-store pragma: no-cache set-cookie: csync=86:6663647625574893018\|104:LQC4ZCY6-1I-JWAU; expires=Thu, 19 Dec 2024 09:22:36 GMT; domain=smartadserver.com; path=/; SameSite=None; secure transfer-encoding: chunked p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" connection: close
2023-12-19 09:22:36 UTC	54	IN	Data Raw: 32 42 0d 0a 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2BGIF89a!,D;0

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.16	50402	35.207.24.140	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	700	OUT	GET /ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP/1.1 Host: rtb.mfadsrvr.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=5aea8bca-e090-4802-94d3-585fd3816e26; c=1702977754; tuuid_lu=1702977754
2023-12-19 09:22:37 UTC	716	IN	HTTP/1.1 302 Moved Temporarily Cache-Control: no-cache, no-store, must-revalidate Content-Length: 0 Date: Tue, 19 Dec 2023 09:22:36 GMT Location: //ce.lijit.com/merge?pid=87&3pid=5aea8bca-e090-4802-94d3-585fd3816e26 Set-Cookie: tuuid=5aea8bca-e090-4802-94d3-585fd3816e26; path=/; expires=Thu, 18-Dec-2025 09:22:36 GMT; domain=.mfadsrvr.com; samesite=none; secure Set-Cookie: tuuid_lu=1702977756; path=/; expires=Thu, 18-Dec-2025 09:22:36 GMT; domain=.mfadsrvr.com; samesite=none; secure Set-Cookie: ssh=!sovrn,1702977756; path=/; expires=Thu, 18-Dec-2025 09:22:36 GMT; domain=.mfadsrvr.com; samesite=none; secure Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
442	192.168.2.16	50316	8.28.7.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	2274	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=251c4a36-9e50-11ee-a342-3aa302158eab HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; pi=137711:4; DPSync3=1703894400%3A257%7C1703548800%3A253_252_265%7C1704067200%3A256_258%7C1704153600%3A263_260_201_259_245_261_262%7C1703030400%3A248_255; SyncRTB3=1704240000%3A35%7C1705536000%3A224%7C1704153600%3A48_165_233_240_250_231_21_71_176_96_214_243_13_264_56_3_104_8_5_7_22_166_55_46_238_54_220_234_99_81_178_249%7C1703808000%3A63%7C1703548800%3A223_38_15_2%7C1708128000%3A69; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755
2023-12-19 09:22:36 UTC	735	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:35 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:35 GMT; path=/ Set-Cookie: PugT=1702977755; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:35 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
443	192.168.2.16	50375	207.198.113.203	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	799	OUT	GET /dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel-sync.sitescout.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; _ssuma=eyIyNCI6MTcwMjk3Nzc1MTM3MCwiMTUiOjE3MDI5Nzc3NTM5MTMsIjM5IjoxNzAyOTc3NzUxMzcwLCI3IjoxNzAyOTc3NzUxMzcwfQ
2023-12-19 09:22:36 UTC	861	IN	HTTP/1.1 302 cache-control: max-age=0,no-cache,no-store pragma: no-cache expires: Tue, 11 Oct 1977 12:34:56 GMT p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml" set-cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; Domain=.sitescout.com; Expires=Wed, 18-Dec-2024 09:22:36 GMT; Path=/; Secure; SameSite=None set-cookie: _ssuma=eyI0NSI6MTcwMjk3Nzc1Njg2NSwiMjQiOjE3MDI5Nzc3NTEzNzAsIjE1IjoxNzAyOTc3NzUzOTEzLCIzOSI6MTcwMjk3Nzc1MTM3MCwiNyI6MTcwMjk3Nzc1MTM3MH0; Domain=.sitescout.com; Expires=Thu, 18-Jan-2024 09:22:36 GMT; Path=/; Secure; SameSite=None location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent= content-length: 0 date: Tue, 19 Dec 2023 09:22:36 GMT server: A connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
444	192.168.2.16	50354	52.0.247.215	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	646	OUT	GET /cs?aid=21479&id=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: cs.minutemedia-prebid.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: application/javascript Content-Length: 0 Connection: close access-control-allow-credentials: true access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE access-control-allow-origin: https://eus.rubiconproject.com/ x-envoy-upstream-service-time: 0 server: istio-envoy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
445	192.168.2.16	50383	174.129.88.64	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	659	OUT	GET /map/c=14701/tp=MTAI/tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F/gdpr=0/gdpr_consent= HTTP/1.1 Host: bcp.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:36 UTC	459	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Length: 0 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.10.116 Set-Cookie: _cc_cc=ctst;Path=/;Domain=crwdcntrl.net;SameSite=None;Secure Location: https://bcp.crwdcntrl.net/map/ct=y/c=14701/tp=MTAI/tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F/gdpr=0/gdpr_consent= Server: Jetty(9.4.38.v20210224)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
446	192.168.2.16	50312	34.225.234.246	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	1024	OUT	GET /qmap?c=1389&tp=STSC&tpid=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553%26partner_url%3Dhttps%253A%252F%252Fr.casalemedia.com%252Frum%253Fcm_dsp_id%253D64%2526external_user_id%253D6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	815	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Length: 0 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.58.76 Set-Cookie: _cc_cc=ctst;Path=/;Domain=crwdcntrl.net;SameSite=None;Secure Location: https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553%26partner_url%3Dhttps%253A%252F%252Fr.casalemedia.com%252Frum%253Fcm_dsp_id%253D64%2526external_user_id%253D6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553%2526gdpr%253D0%2526gdpr_consent%253D&ct=y Server: Jetty(9.4.38.v20210224)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
447	192.168.2.16	50391	162.19.138.116	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	619	OUT	GET /api/esp/increment?counter=no-config HTTP/1.1 Host: id5-sync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	352	IN	HTTP/1.1 204 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers access-control-allow-origin: https://caffeine.softonic.com.br vary: Origin access-control-allow-credentials: true date: Tue, 19 Dec 2023 09:22:36 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.16	50430	35.71.139.29	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	463	OUT	GET /xuid?mid=7976&xuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&dongle=u6nf&gdpr=0&gdpr_consent= HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tluid=2271281487850057919730
2023-12-19 09:22:37 UTC	449	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:36 GMT Content-Type: image/gif Content-Length: 37 Connection: close Cache-Control: no-cache, no-store, must-revalidate P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Set-Cookie: tluid=2271281487850057919730; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Mon, 18 Mar 2024 09:22:36 GMT; Secure; SameSite=None
2023-12-19 09:22:37 UTC	37	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
449	192.168.2.16	50385	52.7.115.91	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	719	OUT	GET /cookie-sync/rp?bee_sync_partners=rp&gdpr=0&us_privacy=1--- HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: bitoIsSecure=ok; checkForPermission=ok; bito=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:37 UTC	424	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:37 GMT location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AACk507LAsIAABM7-sg6gA&expires=30&gdpr=0 Server: gunicorn set-cookie: bito=AACk507LAsIAABM7-sg6gA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:37 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
450	192.168.2.16	50315	35.186.193.173	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	611	OUT	GET /int/cm?exc=19&us_privacy=1--- HTTP/1.1 Host: cm.ctnsnet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	701	IN	HTTP/1.1 302 Found Server: Apache-Coyote/1.1 P3P: CP="NOI DSP COR NID CUR OUR NOR" Set-Cookie: cid_75ae24856eb84dc58191e0600d738e77=1; path=/; domain=.ctnsnet.com; expires=Wed, 18 Dec 2024 09:22:37 GMT; Secure; SameSite=None; Pragma: no-cache Cache-Control: no-cache, must-revalidate Expires: Fri, 01 Jan 1990 00:00:00 GMT x-xss-protection: 1; mode=block Status: 302 Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=109&external_user_id=75ae24856eb84dc58191e0600d738e77&expiration=1705569757 Content-Type: text/html;charset=UTF-8 Content-Length: 0 Date: Tue, 19 Dec 2023 09:22:36 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.16	50411	44.197.22.251	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	824	OUT	GET /insync?gdpr=0&gdpr_consent=&vxii_pdid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&vxii_pid=12&vxii_pid1=10067&vxii_rcid=18084528-0860-4dcc-9aff-4aa340ba369a HTTP/1.1 Host: thrtle.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=eyJpZCI6IjE4MDg0NTI4LTA4NjAtNGRjYy05YWZmLTRhYTM0MGJhMzY5YSIsImwiOjE3MDI5Nzc3NTQxMzksInQiOjF9
2023-12-19 09:22:37 UTC	353	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif Content-Length: 43 Connection: close P3p: CP="NOI OUR BUS UNI COM NAV" Set-Cookie: mc=eyJpZCI6IjE4MDg0NTI4LTA4NjAtNGRjYy05YWZmLTRhYTM0MGJhMzY5YSIsImwiOjE3MDI5Nzc3NTcwMDQsInQiOjF9; Path=/; Domain=thrtle.com; Expires=Sat, 06 Jul 2024 09:22:37 GMT; Secure; SameSite=None
2023-12-19 09:22:37 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.16	50441	34.225.234.246	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	659	OUT	GET /qmap?c=240&tp=PUBM&tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	458	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Length: 0 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.57.98 Set-Cookie: _cc_cc=ctst;Path=/;Domain=crwdcntrl.net;SameSite=None;Secure Location: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=&ct=y Server: Jetty(9.4.38.v20210224)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
453	192.168.2.16	50361	107.20.203.46	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	637	OUT	GET /sync?pn_id=rc&id=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: ads.yieldmo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	771	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif;charset=utf-8 Content-Length: 43 Connection: close Set-Cookie: yieldmo_id=3zYO8rrWWOrSrPQ49uAk%7C1702944000000%7C0; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:37 GMT; Domain=yieldmo.com; Path=/; Secure; SameSite=None Set-Cookie: ptrrc=LQC4ZCY6-1I-JWAU; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:37 GMT; Domain=ads.yieldmo.com; Path=/; Secure; SameSite=None Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Cache-Control, Pragma, * Access-Control-Allow-Methods: POST, GET, OPTIONS Pragma: no-cache Accept-CH: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
2023-12-19 09:22:37 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
454	192.168.2.16	50368	34.107.140.113	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	641	OUT	GET /setuid?bidder=rubicon&uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: s2s.t13.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	522	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Set-Cookie: uids=eyJ1aWRzIjp7fSwidGVtcFVJRHMiOnsicnViaWNvbiI6eyJ1aWQiOiJMUUM0WkNZNi0xSS1KV0FVIiwiZXhwaXJlcyI6IjIwMjQtMDEtMDJUMDk6MjI6MzcuMDcxMzQ4NTYzWiJ9fX0=; Max-Age=7776000; Expires=Mon, 18 Mar 2024 09:22:37 GMT; Path=/; Secure; SameSite=None content-type: image/png Content-Length: 86 Date: Tue, 19 Dec 2023 09:22:37 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:37 UTC	86	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 0d 49 44 41 54 08 99 63 60 60 60 60 00 00 00 05 00 01 87 a1 4e d4 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsBIT\|dIDATc````NIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
455	192.168.2.16	50370	142.250.189.132	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	986	OUT	GET /ads/measurement/l?ebcid=ALh7CaS6r-_5lf_6tH-ZDD1jbPWVE1BFmaV0xo-oXt9QGfdNTDarW4kJ-7x3SXPrkG8pqGnTU6gl9s5FcNMZxtiEZ-c-uz4KjA HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:37 UTC	314	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:37 GMT Server: jumble_frontend_server Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
456	192.168.2.16	50343	35.172.99.217	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:36 UTC	682	OUT	GET /usersync?b=vnt&i=92ceaf34-27c5-4c21-b9d3-66c038610988 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rtb.gumgum.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:37 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:37 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.16	50416	54.239.38.253	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	705	OUT	GET /s/ecm3?ex=rubiconprojectHMT&id=WUd4fstsQC6nKZ8ZipRYBg&gdpr=0 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:37 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: 7AAXGAFZ2Y40RMKDAHKJ Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:37 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
458	192.168.2.16	50386	8.28.7.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	1928	OUT	GET /AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; chkChromeAb67Sec=3; DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; SPugT=1702942220; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; PugT=1702977752; SyncRTB3=1703808000%3A63%7C1704153600%3A13_54_3_231_220_250_21_48_22_104_71_178_166_55%7C1703548800%3A15_223; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0
2023-12-19 09:22:37 UTC	851	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:37 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:37 GMT; path=/ Set-Cookie: PugT=1702977757; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:37 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
459	192.168.2.16	50389	8.28.7.81	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	1801	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=59007874&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; chkChromeAb67Sec=3; DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; SPugT=1702942220; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; PugT=1702977752; SyncRTB3=1703808000%3A63%7C1704153600%3A13_54_3_231_220_250_21_48_22_104_71_178_166_55%7C1703548800%3A15_223; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0
2023-12-19 09:22:37 UTC	1026	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=4; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=156011:4; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1704153600%3A259_260_201_263_261_262_245%7C1704067200%3A256_258%7C1703548800%3A252_265_253%7C1703030400%3A248_255%7C1703894400%3A257; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: SyncRTB3=1704153600%3A13_54_231_104_55_176_22_178_166_8_165_5_233_220_48_3_250_21_71%7C1703548800%3A223_2_15%7C1703808000%3A63; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:35 GMT Content-Length: 1493 Connection: close
2023-12-19 09:22:37 UTC	1493	IN	Data Raw: 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 74 61 70 61 64 2e 63 6f 6d 2f 69 64 73 79 6e 63 2f 65 78 2f 72 65 63 65 69 76 65 3f 70 61 72 74 6e 65 72 5f 69 64 3d 33 32 30 33 26 70 61 72 74 6e 65 72 5f 64 65 76 69 63 65 5f 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 62 70 69 2e 72 74 61 63 74 69 76 61 74 65 2e 63 6f 6d 2f 74 61 67 2f 3f 69 64 3d 32 30 39 30 39 26 75 73 65 72 5f 69 64 3d 35 44 43 33 35 38 33 39 2d 46 Data Ascii: PubMatic.loadAsyncImagePixel('https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://bpi.rtactivate.com/tag/?id=20909&user_id=5DC35839-F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
460	192.168.2.16	50369	198.148.27.131	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	840	OUT	GET /bh/rtset?pid=562985&ev=1&us_privacy=&rurl=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D149%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%25%25VGUID%25%25 HTTP/1.1 Host: bh.contextweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: V=xHDGeFAGG4q9; pb_rtb_ev=3-1oms\|7bq.0.1; INGRESSCOOKIE=363b52ae67c8a57f
2023-12-19 09:22:37 UTC	780	IN	HTTP/1.1 302 Found Connection: close P3P: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT" Accept-CH: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version CW-Server: bh-deployment-db744d8c7-d4chf Cache-Control: private, max-age=0, no-cache, no-store Expires: -1 Content-Language: en-US Set-Cookie: V=xHDGeFAGG4q9;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Fri, 13-Dec-2024 09:22:37 GMT;Max-Age=31104000;SameSite=None Location: https://onetag-sys.com/match/?int_id=149&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=xHDGeFAGG4q9&ev=1&us_privacy=&pid=562985 Server: Jetty(10.0.14) Strict-Transport-Security: max-age=15768000

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.16	50429	147.28.129.140	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	639	OUT	GET /setuid/magnite?uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: prebid.a-mo.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	702	IN	HTTP/1.1 204 No Content cache-control: max-age=0, private, must-revalidate date: Tue, 19 Dec 2023 09:22:36 GMT server: envoy set-cookie: _sv3_7=1; path=/; domain=prebid.a-mo.net; expires=Wed, 20 Dec 2023 09:22:37 GMT; max-age=86400; secure; HttpOnly; SameSite=None set-cookie: amuid2=cacbc31b-1fde-48cb-b82e-b07cfd357513; path=/; domain=a-mo.net; expires=Wed, 18 Dec 2024 09:22:37 GMT; max-age=31536000; secure; HttpOnly; SameSite=None set-cookie: sd_amuid2=cacbc31b-1fde-48cb-b82e-b07cfd357513; path=/; domain=prebid.a-mo.net; expires=Wed, 18 Dec 2024 09:22:37 GMT; max-age=31536000; secure; HttpOnly; SameSite=None x-envoy-upstream-service-time: 1 vary: Accept-Encoding connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.16	50405	35.211.233.246	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	711	OUT	GET /ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=fmx HTTP/1.1 Host: a.sportradarserving.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: zuuid=717f049b-6e7a-4ed4-8020-58a3b807e659; c=1702977754; zuuid_lu=1702977754
2023-12-19 09:22:37 UTC	910	IN	HTTP/1.1 302 Moved Temporarily Cache-Control: no-cache, no-store, must-revalidate Content-Length: 0 Date: Tue, 19 Dec 2023 09:22:37 GMT Location: https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=717f049b-6e7a-4ed4-8020-58a3b807e659&ssp=fmx Set-Cookie: zuuid=717f049b-6e7a-4ed4-8020-58a3b807e659; path=/; expires=Wed, 18-Dec-2024 09:22:37 GMT; domain=sportradarserving.com; samesite=none; secure Set-Cookie: zuuid_lu=1702977757; path=/; expires=Wed, 18-Dec-2024 09:22:37 GMT; domain=sportradarserving.com; samesite=none; secure Set-Cookie: zuuid_k=1; path=/; expires=Wed, 18-Dec-2024 09:22:37 GMT; domain=sportradarserving.com; samesite=none; secure Set-Cookie: zuuid_k_lu=1702977757; path=/; expires=Wed, 18-Dec-2024 09:22:37 GMT; domain=sportradarserving.com; samesite=none; secure Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
463	192.168.2.16	50358	18.209.128.131	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	816	OUT	GET /pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:38 UTC	337	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Length: 0 Connection: close Server: Kestrel Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID}

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.16	50419	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	708	OUT	GET /csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D97%263pid%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: sync.targeting.unrulymedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	562	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:37 GMT content-type: text/html transfer-encoding: chunked set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:37 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://ce.lijit.com/merge?pid=97&3pid=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.16	50470	34.96.71.22	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	691	OUT	GET /s/rp?gdpr=0&us_privacy=1--- HTTP/1.1 Host: s.company-target.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=ae8c4288-8303-465e-8690-01650b07f760; tuuid_lu=1702977750\|ix:0
2023-12-19 09:22:37 UTC	670	IN	HTTP/1.1 302 Found Access-Control-Allow-Methods: GET,OPTIONS Access-Control-Allow-Origin: *.rubiconproject.com Content-Type: text/html; charset=utf-8 Location: https://pixel.rubiconproject.com/tap.php?v=1181926&nid=5578&put=ae8c4288-8303-465e-8690-01650b07f760 Set-Cookie: tuuid=ae8c4288-8303-465e-8690-01650b07f760; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Set-Cookie: tuuid_lu=1702977757\|ix:0\|rp:0; Path=/; Domain=company-target.com; Max-Age=63072000; Secure; SameSite=None Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Length: 131 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:37 UTC	131	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 72 75 62 69 63 6f 6e 70 72 6f 6a 65 63 74 2e 63 6f 6d 2f 74 61 70 2e 70 68 70 3f 76 3d 31 31 38 31 39 32 36 26 61 6d 70 3b 6e 69 64 3d 35 35 37 38 26 61 6d 70 3b 70 75 74 3d 61 65 38 63 34 32 38 38 2d 38 33 30 33 2d 34 36 35 65 2d 38 36 39 30 2d 30 31 36 35 30 62 30 37 66 37 36 30 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://pixel.rubiconproject.com/tap.php?v=1181926&nid=5578&put=ae8c4288-8303-465e-8690-01650b07f760">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.16	50399	52.89.73.205	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	1013	OUT	GET /visitor/sync?name=33ACROSS&ttl=720&uid=2f9442d7df2189f76c8b593d5f54ce95&visitor=212294706585447&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:37 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 6 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:37 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
467	192.168.2.16	50381	13.32.87.73	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	718	OUT	GET /syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: synchroscript.deliveryengine.adswizz.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	311	IN	HTTP/1.1 200 OK Server: CloudFront Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Length: 0 Connection: close X-Cache: Error from cloudfront Via: 1.1 80677c288b4024a45c671874b4fa625a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: hdGVI5lwVnPGArILImMuc1JEvKDSFG2ZY6ZYn3XGIVJsulZ07faQDg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
468	192.168.2.16	50382	35.244.154.8	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	656	OUT	GET /712188.gif?partner_uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: idsync.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:38 UTC	735	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://idsync.rlcdn.com/1000.gif?memo=CPy7KxIwCiwIARCFpQoaJDVEQzM1ODM5LUZERjgtNENFOC1BNzVDLTA1QzA0RUVBQUI3RhAAGg0I3cGFrAYSBQjoBxAAQgBKAA P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=6LzdEGUkCuawsId1Fg21eZ28T3wf8tQnMIZvDxAxAZU=; Path=/; Domain=rlcdn.com; Expires=Wed, 18 Dec 2024 09:22:37 GMT; Secure; SameSite=None Set-Cookie: pxrc=CAA=; Path=/; Domain=rlcdn.com; Expires=Sat, 17 Feb 2024 09:22:37 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
469	192.168.2.16	50395	69.194.240.13	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	853	OUT	GET /usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D
2023-12-19 09:22:37 UTC	683	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:37 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:37 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4475564770 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.16	50427	18.239.225.91	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	698	OUT	GET /sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=a0aee609-2968-45de-a5d3-b77df9a421f0 HTTP/1.1 Host: live.rezync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	1193	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 971 Connection: close Date: Tue, 19 Dec 2023 09:22:37 GMT Location: https://p.rfihub.com/cm?pub=39342&in=1&userid=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977757.5650773&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3Da4612a01-e9ec-45c4-bd44-397ee7f54411%253A1702977757.5650773%26pid%3D500040%26it%3D1%26iv%3Da4612a01-e9ec-45c4-bd44-397ee7f54411%253A1702977757.5650773%26_%3D1702977757.5676894&cb=1702977757.5677361 Set-Cookie: zync-uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411:1702977757.5650773; Domain=rezync.com; Expires=Sun, 12 Jan 2025 09:22:37 GMT; Path=/; SameSite=None; Secure Set-Cookie: sd-session-id=eyJfcGVybWFuZW50Ijp0cnVlLCJzZXNzaW9uX2lkIjoiYTQ2MTJhMDEtZTllYy00NWM0LWJkNDQtMzk3ZWU3ZjU0NDExOjE3MDI5Nzc3NTcuNTY1MDc3MyJ9.ZYFg3Q.tuCU6ZN6du2nJlWUbZwo1ZuBKwQ; Expires=Sun, 12 Jan 2025 09:22:37 GMT; HttpOnly; Path=/; SameSite=None; Secure Vary: Cookie Server: lighttpd/1.4.69 X-Cache: Miss from cloudfront Via: 1.1 96ef33fafb355df015bb2b6c144dad20.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P8 X-Amz-Cf-Id: wRnkyiaSvFZN2gojg4ZWY6kfW3NWLTNDhgmpDULO8OGP4aiDzYy0EQ==
2023-12-19 09:22:37 UTC	971	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 73 68 6f 75 6c 64 20 62 65 20 72 65 64 69 72 65 63 74 65 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 74 6f 20 74 68 65 20 74 61 72 67 65 74 20 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 2e 72 66 69 68 75 62 2e 63 6f 6d 2f 63 6d 3f 70 75 62 3d 33 39 33 34 32 26 61 6d 70 3b 69 6e 3d 31 26 61 6d 70 3b 75 73 65 72 69 64 3d 61 34 36 31 32 61 30 31 2d 65 39 65 63 2d 34 35 63 34 2d 62 64 34 34 2d 33 39 37 65 65 37 66 35 34 34 31 31 25 33 41 31 37 30 32 39 37 37 Data Ascii: <!doctype html><html lang=en><title>Redirecting...</title><h1>Redirecting...</h1><p>You should be redirected automatically to the target URL: <a href="https://p.rfihub.com/cm?pub=39342&in=1&userid=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.16	50420	173.231.178.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	787	OUT	GET /bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP/1.1 Host: cm.adgrx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ADGRX_UID=251c4a36-9e50-11ee-a342-3aa302158eab
2023-12-19 09:22:38 UTC	849	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif Content-Length: 0 Connection: close server: Cowboy set-cookie: ADGRX_UID=251c4a36-9e50-11ee-a342-3aa302158eab; Version=1; Expires=Fri, 17-Jan-2025 09:22:37 GMT; Max-Age=34128000; Domain=.adgrx.com; Path=/; Secure; SameSite=None set-cookie: ADGRX_CM_PUBMATIC_BRIDGED=1; Version=1; Expires=Wed, 20-Dec-2023 09:22:37 GMT; Max-Age=86400; Domain=.adgrx.com; Path=/; Secure; SameSite=None Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=251c4a36-9e50-11ee-a342-3aa302158eab X-RealServer-NX: lga-delivery-3 Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate Pragma: no-cache Expires: Thu, 23 Sep 2004 17:42:04 GMT P3P: CP="NOI OTC OTP OUR NOR" Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.16	50409	52.89.73.205	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	794	OUT	GET /visitor/sync?name=ADOTMOB&ttl=720&uid=b989ee06df7dfc250798f7f0dfc4ddee&visitor=09ef2204008941e33a02d6b0&gdpr=0&gdpr_consent=&gdpr=0&gdprConsent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:38 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 3 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:38 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
473	192.168.2.16	50388	8.28.7.81	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	1796	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=30216410&p=156813&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; chkChromeAb67Sec=3; DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; SPugT=1702942220; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; PugT=1702977752; SyncRTB3=1703808000%3A63%7C1704153600%3A13_54_3_231_220_250_21_48_22_104_71_178_166_55%7C1703548800%3A15_223; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0
2023-12-19 09:22:37 UTC	1135	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=4; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=156813:4; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1703030400%3A248_255%7C1703894400%3A257%7C1704153600%3A261_201_245_263_259_262_260%7C1704067200%3A256_258%7C1703548800%3A253_252_265; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:37 GMT Transfer-Encoding: chunked Connection: close
2023-12-19 09:22:37 UTC	4378	IN	Data Raw: 31 31 30 64 0d 0a 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 74 61 70 61 64 2e 63 6f 6d 2f 69 64 73 79 6e 63 2f 65 78 2f 72 65 63 65 69 76 65 3f 70 61 72 74 6e 65 72 5f 69 64 3d 33 32 30 33 26 70 61 72 74 6e 65 72 5f 64 65 76 69 63 65 5f 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 62 70 69 2e 72 74 61 63 74 69 76 61 74 65 2e 63 6f 6d 2f 74 61 67 2f 3f 69 64 3d 32 30 39 30 39 26 75 73 65 72 5f 69 64 3d 35 44 43 33 Data Ascii: 110dPubMatic.loadAsyncImagePixel('https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=');PubMatic.loadAsyncImagePixel('https://bpi.rtactivate.com/tag/?id=20909&user_id=5DC3

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.16	50407	67.202.105.21	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	971	OUT	GET /ps/?xi=99&us_privacy=&xu=y-U79fYvJE2uFwP3YGnrrUbmjtr2kCJLYH~A HTTP/1.1 Host: ssc-cms.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:38 UTC	694	IN	HTTP/1.1 302 p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" set-cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632; Domain=.33across.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Path=/; Secure; SameSite=None referrer-policy: unsafe-url pragma: no-cache cache-control: no-store, no-cache, must-revalidate expires: Thu, 01-Jan-70 00:00:01 GMT x-33x-status: 8000000008200000A server: 33XP005 location: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-U79fYvJE2uFwP3YGnrrUbmjtr2kCJLYH%7EA&ts=1702977757&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy= content-length: 0 date: Tue, 19 Dec 2023 09:22:37 GMT connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.16	50468	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	794	OUT	GET /usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEB4TS_wvGArfeqKKzVxPONU&google_cver=1 HTTP/1.1 Host: ssum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:38 UTC	992	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e9508d8885d0e-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:37 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:37 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sIUHbOOb6t0XefDFU6KHlAMX8z16W%2FfkoETu7d0m%2B%2BtaKC6j%2FG4ESFoJS%2FQkqIhu97cIXnZWafR3G5m1ontinkG2hCP03FRFhmk4%2F1hUnDVBPsLUmNMqSUXlYrN%2Fpdwh07piomwuD5DiZw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:38 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.16	50424	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	2453	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; pi=137711:4; DPSync3=1703894400%3A257%7C1703548800%3A253_252_265%7C1704067200%3A256_258%7C1704153600%3A263_260_201_259_245_261_262%7C1703030400%3A248_255; SyncRTB3=1704240000%3A35%7C1705536000%3A224%7C1704153600%3A48_165_233_240_250_231_21_71_176_96_214_243_13_264_56_3_104_8_5_7_22_166_55_46_238_54_220_234_99_81_178_249%7C1703808000%3A63%7C1703548800%3A223_38_15_2%7C1708128000%3A69; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ
2023-12-19 09:22:37 UTC	794	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:37 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:37 GMT; path=/ Set-Cookie: PugT=1702977757; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:37 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.16	50439	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	1586	OUT	GET /merge?pid=58&3pid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV
2023-12-19 09:22:37 UTC	2749	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:37 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9kEtrAjEQx7%2FLnjuQxzyS3rIxK1oLbdUWvRmz2YNQEL1I6Xdv9tLb8Ps%2FmJmfznTPnbd9RO6DDlGhS9zbISXPyi6UCSlh99Rpbj72XlVTC3itRsBzreBIdJvySSuveKwZmJxmVQiIyLYk%2Bpbcr9Xybrfl8nFwjRlpTFtET9WCjB4BDRvIXAmKkMGRay5Fmtep5t28RzzGtxXoNaTNzjTu582Z2TIKGyJB563Sc73oJtEiWnLWw7AYHGBMDoJQBEXtyJRC6GWY6%2B1%2F%2FYFBr2D9FfYzx8aPh2HSj3x8uZbt93Td31aP%2By4sP2edmh5CvJCSTbitWt%2BrwG3iKcwbzO8yMnKpwnDS5QTKjQymGA9YzyqfJXN20v3%2BAQmMXds%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:37 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.16	50449	35.186.193.173	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	813	OUT	GET /int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id] HTTP/1.1 Host: ipac.ctnsnet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:38 UTC	504	IN	HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="NOI DSP COR NID CUR OUR NOR" Set-Cookie: cid_9e96bdcc99834ba48beda23b6dd70e67=1; path=/; domain=.ctnsnet.com; expires=Wed, 18 Dec 2024 09:22:37 GMT; Secure; SameSite=None; Pragma: no-cache Cache-Control: no-cache, must-revalidate Expires: Fri, 01 Jan 1990 00:00:00 GMT Content-Type: image/gif Content-Length: 43 Date: Tue, 19 Dec 2023 09:22:37 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:38 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.16	50440	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	729	OUT	GET /s/75145?bidder_id=195755&bidder_uuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=ChAKBgjSARDiFgoGCKIBEOIW; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:37 UTC	577	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Length: 0 Connection: close Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0 Set-Cookie: _li_ss=ChcKBgjSARDiFgoGCKIBEOIWCgUIChDiFg; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:37 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:37 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 2 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.16	50432	173.231.178.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	635	OUT	GET /bridge?AG_SETCOOKIE&AG_PID=rubicon&gdpr=0&us_privacy=1--- HTTP/1.1 Host: cm.adgrx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	621	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif Content-Length: 0 Connection: close server: Cowboy set-cookie: ADGRX_UID=269c0ff4-9e50-11ee-bb93-3aa3a7cfa5b7; Version=1; Expires=Fri, 17-Jan-2025 09:22:37 GMT; Max-Age=34128000; Domain=.adgrx.com; Path=/; Secure; SameSite=None Location: https://cm.adgrx.com/bridge.gif?AG_PID=rubicon&gdpr=0&us_privacy=1--- X-RealServer-NX: lga-delivery-3 Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate Pragma: no-cache Expires: Thu, 23 Sep 2004 17:42:04 GMT P3P: CP="NOI OTC OTP OUR NOR" Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.16	50471	35.211.178.172	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	703	OUT	GET /sync?ssp=fmx&us_privacy=&gdpr=0&gdpr_consent= HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:37 UTC	332	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //bttrack.com/pixel/cookiesyncredir?rurl=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D151%26user_id%3D%7Bglobalid%7D%26expires%3D30%26ssp=fmx

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.16	50489	104.18.36.155	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	754	OUT	GET /crum?cm_dsp_id=46&external_user_id=6663647625574893018&us_privacy=1--- HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:37 UTC	996	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e950a3d9d31da-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:37 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:37 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8StXR6uL6wfkUxt%2ByZi0yRejsquGBLyWf%2FoDlfkwdXfW4uk1s%2FxfhNitvKc%2BhwrvOLXk54nL2n1TlH%2B2hzrJWPqdp%2FR0YV6%2FMb0jnb5wK%2FRE%2F522ewTGJSqYVkQBBARhZLA7gZnB5A3A6g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:37 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.16	50502	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	1059	OUT	GET /merge?pid=86&3pid=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s&pi=sovrn&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:37 UTC	2120	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:37 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:37 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.16	50398	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	710	OUT	GET /s/53233?bidder_id=183658&bidder_uuid=7402232151745586090 HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=CggKBgjSARDiFg; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:37 UTC	628	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Length: 0 Connection: close Location: https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=a0aee609-2968-45de-a5d3-b77df9a421f0 Set-Cookie: _li_ss=ChAKBgjSARDiFgoGCKIBEOIW; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:37 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:37 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 2 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.16	50397	172.240.127.128	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	975	OUT	GET /match?bidder_id=44774&callback_url=%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3Dbf39a6af2a15b80f82f7ff725f351919%26visitor%3D%24%7BUSER_ID%7D%26name%3DBETWEENX%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_CONSENT%7D&gdpr=0&consent=&crf=1&rts=-1984640480482933979 HTTP/1.1 Host: ads.betweendigital.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dc=was1; tuuid=a3da91b6-5988-5361-96e0-e2aef3618274; ut=ZYFg2gACJsh-9n31eSZJXTIvmopRDe1OWGS7LQ==; ss=1
2023-12-19 09:22:37 UTC	123	IN	HTTP/1.1 408 Request Time-out Content-length: 110 Cache-Control: no-cache Connection: close Content-Type: text/html
2023-12-19 09:22:37 UTC	110	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.16	50410	207.198.113.203	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	797	OUT	GET /dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel-sync.sitescout.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; _ssuma=eyIyNCI6MTcwMjk3Nzc1MTM3MCwiMTUiOjE3MDI5Nzc3NTM5MTMsIjM5IjoxNzAyOTc3NzUxMzcwLCI3IjoxNzAyOTc3NzUxMzcwfQ
2023-12-19 09:22:37 UTC	861	IN	HTTP/1.1 302 cache-control: max-age=0,no-cache,no-store pragma: no-cache expires: Tue, 11 Oct 1977 12:34:56 GMT p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml" set-cookie: ssi=6990f2fd-910e-4cff-8571-4cba10906efb#1702977749646; Domain=.sitescout.com; Expires=Wed, 18-Dec-2024 09:22:37 GMT; Path=/; Secure; SameSite=None set-cookie: _ssuma=eyI0NSI6MTcwMjk3Nzc1Nzg4MywiMjQiOjE3MDI5Nzc3NTEzNzAsIjE1IjoxNzAyOTc3NzUzOTEzLCIzOSI6MTcwMjk3Nzc1MTM3MCwiNyI6MTcwMjk3Nzc1MTM3MH0; Domain=.sitescout.com; Expires=Thu, 18-Jan-2024 09:22:37 GMT; Path=/; Secure; SameSite=None location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent= content-length: 0 date: Tue, 19 Dec 2023 09:22:37 GMT server: A connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
487	192.168.2.16	50426	64.227.64.62	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	627	OUT	GET /rubiconmatch?gdpr=0&us_privacy=1--- HTTP/1.1 Host: match.adsby.bidtheatre.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:38 UTC	478	IN	HTTP/1.1 302 302 Date: Tue, 19 Dec 2023 09:22:37 GMT Server: Apache P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT" Set-Cookie: __kuid=264187a7-eca5-4baa-b291-3de237129b1c.472191757; Max-Age=604800; Domain=.adsby.bidtheatre.com; SameSite=None; Secure Location: https://pixel.rubiconproject.com/tap.php?v=17039&nid=2650&days=30&gdpr=0&gdpr_consent=&put=264187a7-eca5-4baa-b291-3de237129b1c Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.16	50476	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	2543	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; pi=137711:4; DPSync3=1703894400%3A257%7C1703548800%3A253_252_265%7C1704067200%3A256_258%7C1704153600%3A263_260_201_259_245_261_262%7C1703030400%3A248_255; SyncRTB3=1704240000%3A35%7C1705536000%3A224%7C1704153600%3A48_165_233_240_250_231_21_71_176_96_214_243_13_264_56_3_104_8_5_7_22_166_55_46_238_54_220_234_99_81_178_249%7C1703808000%3A63%7C1703548800%3A223_38_15_2%7C1708128000%3A69; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553
2023-12-19 09:22:37 UTC	410	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:31:39 GMT Transfer-Encoding: chunked Connection: close Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.16	50485	54.157.11.141	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	848	OUT	GET /ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP/1.1 Host: pm.w55c.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:37 UTC	711	IN	HTTP/1.1 302 Cache-Control: no-cache, must-revalidate Date: Tue, 19 Dec 2023 09:22:37 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Location: https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= Pragma: no-cache Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-00176663060b90eb6@us-east-1d@dxedge-app-us-east-1-prod-asg Set-Cookie: wfivefivec=lif0y6A21Rfwjb5; Domain=.w55c.net; Expires=Fri, 17-Jan-2025 19:22:37 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.16	50456	34.224.234.201	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	632	OUT	GET /sync?pn_id=km&id=ae67145e-4e6a-59f0-a89d-071ebeee2681 HTTP/1.1 Host: sync-km.ads.yieldmo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:38 UTC	791	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif;charset=utf-8 Content-Length: 43 Connection: close Set-Cookie: yieldmo_id=3zYO8rrWWOrGlOM3v7w9%7C1702944000000%7C0; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:37 GMT; Domain=yieldmo.com; Path=/; Secure; SameSite=None Set-Cookie: ptrkm=ae67145e-4e6a-59f0-a89d-071ebeee2681; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:37 GMT; Domain=ads.yieldmo.com; Path=/; Secure; SameSite=None Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Cache-Control, Pragma, * Access-Control-Allow-Methods: POST, GET, OPTIONS Pragma: no-cache Accept-CH: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
2023-12-19 09:22:38 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
491	192.168.2.16	50428	195.244.31.10	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	516	OUT	GET /visitor/sync?uid=9276a8c8d010b77af50144c60047b781&visitor=5184721251378344538&name=SMARTADSERVER&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:38 UTC	465	IN	HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate content-type: image/gif expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff date: Tue, 19 Dec 2023 09:22:37 GMT content-length: 49 x-envoy-upstream-service-time: 7 server: ayl-lb-usa02 connection: close
2023-12-19 09:22:38 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.16	50498	104.18.25.173	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	960	OUT	GET /i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP/1.1 Host: a.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ANON_ID=alnsXDtZdPuem7SpBmPo7WiLw5VjMZbMU1mO0RZaP4nvdBsZaZaOVoVF01ql5S0HjhMClbMNqFswa24lfMTnj
2023-12-19 09:22:38 UTC	863	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 43 Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 302 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=a3nvJOM0ing9PBmSTApS97IN17hZaY8P1rVUmnE45nAxtMR2pn54rhYSWafOtrcWcumeQGgPe879bmdKEB64F7jK1N1B1snZdNWPeCmZdrGFXk6iKkGUsASfX97; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:38 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=a3nvJOM0ing9PBmSTApS97IN17hZaY8P1rVUmnE45nAxtMR2pn54rhYSWafOtrcWcumeQGgPe879bmdKEB64F7jK1N1B1snZdNWPeCmZdrGFXk6iKkGUsASfX97; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:38 GMT; CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 837e950b297b5730-MIA alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:38 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 40 02 02 44 01 00 3b Data Ascii: GIF89a!,@D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.16	50497	142.250.189.132	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	986	OUT	GET /ads/measurement/l?ebcid=ALh7CaScLXOX2jEWA16lue02FQF8Awz6TEot0kgi35hA-CWyXGZNM1xFZHpid8dnTfHJTeJzWV5bgYUX9Mbq0ZbSlKbKys-YGw HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:38 UTC	314	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:38 GMT Server: jumble_frontend_server Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.16	50446	13.32.87.66	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	657	OUT	GET /userPixel/sync?partner=rubicon&uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: usr.undertone.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:39 UTC	422	IN	HTTP/1.1 200 Content-Length: 0 Connection: close Date: Tue, 19 Dec 2023 09:22:38 GMT Set-Cookie: UID_EXT_47=LQC4ZCY6-1I-JWAU; Path=/; Domain=undertone.com; Expires=Wed, 18-Dec-2024 15:11:50 GMT; SameSite=None; Secure; X-Cache: Miss from cloudfront Via: 1.1 f0d2db130f25377126d8fc517e82fa4c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: slZgvQ0SFQWx49suu4gDZPi_8UNvkeub0kw9GrZfBwTpRmLBuaO00Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.16	50444	35.214.128.77	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:37 UTC	819	OUT	GET /?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token} HTTP/1.1 Host: csync.loopme.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.16	50437	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	760	OUT	GET /usersync2/rubicon?gdpr=0&us_privacy=1--- HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22zdxidn%22%3A%222069.80%22%2C%22nxtrdr%22%3Afalse%7D
2023-12-19 09:22:38 UTC	481	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:38 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache location: https://sync.targeting.unrulymedia.com/csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D186028%26nid%3D4112%26put%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%26expires%3D30%26us_privacy%3D1--- connection: close
2023-12-19 09:22:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.16	50438	35.236.220.17	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	873	OUT	GET /pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: um.simpli.fi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: suid=230C3A6911DC4BB0ABF9299139F39B54
2023-12-19 09:22:39 UTC	723	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Type: text/html Content-Length: 142 Connection: close Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:230C3A6911DC4BB0ABF9299139F39B54&gdpr=0&gdpr_consent= Expires: Mon, 18 Dec 2023 09:22:38 GMT Cache-Control: no-cache Strict-Transport-Security: max-age=63072000; includeSubdomains; preload X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
2023-12-19 09:22:39 UTC	142	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.16	50482	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	2551	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=866838000893 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; pi=137711:4; DPSync3=1703894400%3A257%7C1703548800%3A253_252_265%7C1704067200%3A256_258%7C1704153600%3A263_260_201_259_245_261_262%7C1703030400%3A248_255; SyncRTB3=1704240000%3A35%7C1705536000%3A224%7C1704153600%3A48_165_233_240_250_231_21_71_176_96_214_243_13_264_56_3_104_8_5_7_22_166_55_46_238_54_220_234_99_81_178_249%7C1703808000%3A63%7C1703548800%3A223_38_15_2%7C1708128000%3A69; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553
2023-12-19 09:22:38 UTC	691	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:19:21 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:19:21 GMT; path=/ Set-Cookie: PugT=1702941561; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:19:21 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.16	50443	64.227.64.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	740	OUT	GET /pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.adsby.bidtheatre.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:38 UTC	517	IN	HTTP/1.1 302 302 Date: Tue, 19 Dec 2023 09:22:38 GMT Server: Apache P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT" Set-Cookie: __kuid=1da3594a-a787-4bca-932d-676ba73d6ace.472191758; Max-Age=604800; Domain=.adsby.bidtheatre.com; SameSite=None; Secure Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:1da3594a-a787-4bca-932d-676ba73d6ace&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.16	50431	192.184.68.215	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	795	OUT	GET /pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: cms.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: d=EFgBDQHZKt-owQA; mc=658160dc-8eeb9-895f2-d0e4b
2023-12-19 09:22:39 UTC	695	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Length: 0 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7 P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Pragma: no-cache Set-Cookie: d=EIQBEgHZKvijDejbEA; expires=Mon, 18-Mar-2024 09:22:38 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Strict-Transport-Security: max-age=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.16	50488	104.18.36.155	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	764	OUT	GET /crum?cm_dsp_id=130&external_user_id=AACk507LAsIAABM7-sg6gA&expiration=1704187355 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:38 UTC	986	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e950d1bd674c6-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:38 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:38 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YiYROvsdFLj28DUC2c%2FYuuj0gaUBISgu12hRAviUYguFdmztXB0qD%2Bm%2F%2B1JWtVBoVXTHWTUY3GLSRuJnlzM07oIAQNXEGJf5DKNisghX2EzwkhDdSEtfyVzGBOUIj18a6ADldo5hNzFRog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:38 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.16	50490	44.207.23.148	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	738	OUT	GET /sync/casale/ZYFg02kDskXAcMABkyNPagAACu4AAAIB HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE
2023-12-19 09:22:38 UTC	778	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:38 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2023-12-19 09:22:38 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.16	50455	18.64.174.89	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	671	OUT	GET /live/liveCS.php?source=external&advId=100&advUuid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: live.primis.tech Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:38 UTC	812	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close server: nginx date: Tue, 19 Dec 2023 09:22:38 GMT p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control: no-store pragma: no-cache set-cookie: csuuid=658160de4aaac; expires=Sat, 13-Jan-2024 09:22:38 GMT; Max-Age=2160000; path=/; domain=.primis.tech; secure; SameSite=None location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQC4ZCY6-1I-JWAU X-Cache: Miss from cloudfront Via: 1.1 21b70c4727c36e560b23f2f5f3143daa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: ueFnHlR93zUo8YLHOcwGTjij6cCprHsBwFFMlrByg59C48vD14-pqw== Age: 0
2023-12-19 09:22:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.16	50448	172.105.220.23	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	688	OUT	GET /pubmatic HTTP/1.1 Host: gocm.c.appier.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:39 UTC	627	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 153 Connection: close Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version Cache-Control: no-store Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=kD5c8C9HCfKvLTiX3mCBZQ P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: _auid=kD5c8C9HCfKvLTiX3mCBZQ; Path=/; Domain=c.appier.net; Expires=Thu, 19 Dec 2024 09:22:38 GMT; Max-Age=31536000; HttpOnly; Secure; SameSite=None
2023-12-19 09:22:39 UTC	153	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 79 4d 44 49 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 6b 44 35 63 38 43 39 48 43 66 4b 76 4c 54 69 58 33 6d 43 42 5a 51 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=kD5c8C9HCfKvLTiX3mCBZQ">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.16	50496	8.28.7.81	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	2453	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=38146151&p=156212&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; pi=137711:4; DPSync3=1703894400%3A257%7C1703548800%3A253_252_265%7C1704067200%3A256_258%7C1704153600%3A263_260_201_259_245_261_262%7C1703030400%3A248_255; SyncRTB3=1704240000%3A35%7C1705536000%3A224%7C1704153600%3A48_165_233_240_250_231_21_71_176_96_214_243_13_264_56_3_104_8_5_7_22_166_55_46_238_54_220_234_99_81_178_249%7C1703808000%3A63%7C1703548800%3A223_38_15_2%7C1708128000%3A69; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553
2023-12-19 09:22:38 UTC	831	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=5; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=156212:4; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1703548800%3A252_265_253%7C1704153600%3A261_262_228_260_259_263_245_226_236_235_201%7C1703030400%3A255_248%7C1703894400%3A257%7C1704067200%3A258_256; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Length: 610 Connection: close
2023-12-19 09:22:38 UTC	610	IN	Data Raw: 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 69 6f 2e 6e 61 72 72 61 74 69 76 65 2e 69 6f 2f 3f 63 6f 6d 70 61 6e 79 49 64 3d 36 37 33 26 69 64 3d 70 75 62 6d 61 74 69 63 5f 69 64 3a 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 09 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 61 2e 61 75 64 72 74 65 2e 63 6f 6d 2f 6d 61 74 63 68 3f 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 70 3d 4d 31 37 31 37 30 35 34 39 30 31 26 75 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 Data Ascii: PubMatic.loadAsyncImagePixel('https://io.narrative.io/?companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F');PubMatic.loadAsyncImagePixel('https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.16	50454	34.117.239.71	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	779	OUT	GET /match?bidder_id=30&external_user_id=LQC4ZCY6-1I-JWAU&ts=1702977755&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: events-ssc.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:40 UTC	257	IN	HTTP/1.1 200 OK content-type: image/png cache-control: no-cache, no-store, max-age=0, must-revalidate Content-Length: 68 Date: Tue, 19 Dec 2023 09:22:38 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:40 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.16	50486	18.209.128.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	816	OUT	GET /pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:39 UTC	337	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Length: 0 Connection: close Server: Kestrel Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID}

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.16	50460	35.186.193.173	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	861	OUT	GET /int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id] HTTP/1.1 Host: ipac.ctnsnet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cid_75ae24856eb84dc58191e0600d738e77=1
2023-12-19 09:22:38 UTC	649	IN	HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="NOI DSP COR NID CUR OUR NOR" Set-Cookie: cid=75ae24856eb84dc58191e0600d738e77; path=/; domain=.ctnsnet.com; expires=Wed, 18 Dec 2024 09:22:38 GMT; Secure; SameSite=None; Set-Cookie: cid_75ae24856eb84dc58191e0600d738e77=null; path=/; domain=.ctnsnet.com; expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure; SameSite=None; Pragma: no-cache Cache-Control: no-cache, must-revalidate Expires: Fri, 01 Jan 1990 00:00:00 GMT Content-Type: image/gif Content-Length: 43 Date: Tue, 19 Dec 2023 09:22:37 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:38 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.16	50453	44.193.120.159	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	657	OUT	GET /tag/?id=20909&user_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: bpi.rtactivate.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:39 UTC	140	IN	HTTP/1.1 200 OK Server: awselb/2.0 Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Type: image/gif Content-Length: 43 Connection: close
2023-12-19 09:22:39 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.16	50479	35.163.115.57	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	770	OUT	GET /visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&name=BIDSWITCH&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:39 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 6 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:39 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.16	50516	34.111.113.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	783	OUT	GET /idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:38 UTC	1095	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:38 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:38 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:38 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:38 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:38 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.16	50466	54.224.142.7	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	1410	OUT	GET /sync?nid=11&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk
2023-12-19 09:22:39 UTC	304	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:38 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= Content-Length: 188 Connection: Close
2023-12-19 09:22:39 UTC	188	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 30 4d 7a 45 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 47 48 5f 4a 76 44 6a 38 56 6a 64 76 72 42 6c 4f 61 76 48 6d 70 32 61 42 6d 4e 51 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent=">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.16	50434	82.145.213.8	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	758	OUT	GET /pub/sync?pubid=pub8730968190912 HTTP/1.1 Host: t.adx.opera.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17
2023-12-19 09:22:40 UTC	809	IN	HTTP/1.1 302 Found Server: Tengine Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 166 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17 Pragma: no-cache Set-Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17; Path=/; Domain=adx.opera.com; Max-Age=31536000; Secure; SameSite=None
2023-12-19 09:22:40 UTC	166	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 30 4f 44 6b 6d 64 47 77 39 4e 44 4d 79 4d 44 41 3d 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 4f 50 55 66 63 66 35 31 30 39 61 31 61 36 33 34 32 37 63 61 31 37 66 32 65 36 35 30 61 35 61 64 65 31 37 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.16	50484	54.157.11.141	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	890	OUT	GET /ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP/1.1 Host: pm.w55c.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfivefivec=UzeiMh5u1Rfwja5
2023-12-19 09:22:39 UTC	773	IN	HTTP/1.1 302 Cache-Control: no-cache, must-revalidate Date: Tue, 19 Dec 2023 09:22:38 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:UzeiMh5u1Rfwja5&gdpr=0&gdpr_consent= Pragma: no-cache Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-001e04138de754858@us-east-1e@dxedge-app-us-east-1-prod-asg Set-Cookie: wfivefivec=UzeiMh5u1Rfwja5; Domain=.w55c.net; Expires=Sun, 19-Jan-2025 09:22:38 GMT; Path=/; SameSite=None; Secure Set-Cookie: matchpubmatic=5; Domain=.w55c.net; Expires=Thu, 18-Jan-2024 09:22:38 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.16	50481	74.119.119.150	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	924	OUT	GET /dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP/1.1 Host: dis.criteo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uid=bcf55414-01bc-4254-873e-0589d6530dae
2023-12-19 09:22:38 UTC	531	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:37 GMT server: Kestrel cache-control: no-cache expires: Tue, 19 Dec 2023 00:00:00 GMT location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent= pragma: no-cache x-errorlevel: 0 p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" cross-origin-resource-policy: cross-origin server-processing-duration-in-ticks: 654005 strict-transport-security: max-age=31536000; preload; connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.16	50501	8.28.7.81	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	2379	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=10772735&p=137711&s=137812&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; pi=0:3; DPSync3=1703548800%3A253_265_252%7C1704153600%3A245_262_201_259_260_261_263%7C1703894400%3A257%7C1703030400%3A248_255%7C1704067200%3A258_256; SyncRTB3=1704153600%3A46_249_21_220_5_165_8_13_71_231_166_55_104_233_22_54_48_240_176_250_178_3%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35
2023-12-19 09:22:38 UTC	1151	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=5; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=137711:4; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: SyncRTB3=1703808000%3A63%7C1705536000%3A224%7C1704153600%3A3_55_165_166_48_56_96_46_22_178_234_99_233_214_21_5_231_104_7_81_249_176_250_264_243_220_240_54_71_13_238_8%7C1703548800%3A223_15_2_38%7C1704240000%3A35%7C1708128000%3A69; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:38 GMT Transfer-Encoding: chunked Connection: close
2023-12-19 09:22:38 UTC	2725	IN	Data Raw: 61 39 39 0d 0a 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 69 6f 2e 6e 61 72 72 61 74 69 76 65 2e 69 6f 2f 3f 63 6f 6d 70 61 6e 79 49 64 3d 36 37 33 26 69 64 3d 70 75 62 6d 61 74 69 63 5f 69 64 3a 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 09 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 61 2e 61 75 64 72 74 65 2e 63 6f 6d 2f 6d 61 74 63 68 3f 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 70 3d 4d 31 37 31 37 30 35 34 39 30 31 26 75 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 Data Ascii: a99PubMatic.loadAsyncImagePixel('https://io.narrative.io/?companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F');PubMatic.loadAsyncImagePixel('https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=5DC35839-FDF8-4CE8-A75C-05C04E

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.16	50461	195.5.165.20	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	708	OUT	GET /cookiesync?gdpr=0&gdpr_consent= HTTP/1.1 Host: core.iprom.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:39 UTC	236	IN	HTTP/1.1 200 OK Vary: Accept-Encoding X-adserver-worker: ragnarok-6f9d40c4cb6f@version_1.579 Connection: close X-server-arch: v2 Content-Type: image/gif Content-Length: 43 X-core-time: 1ms Date: Tue, 19 Dec 2023 09:22:38 GMT
2023-12-19 09:22:39 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.16	50480	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	2822	OUT	GET /AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; PugT=1702977757; pi=156813:4; DPSync3=1703030400%3A248_255%7C1703894400%3A257%7C1704153600%3A261_201_245_263_259_262_260%7C1704067200%3A256_258%7C1703548800%3A253_252_265; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224
2023-12-19 09:22:38 UTC	781	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:38 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:38 GMT; path=/ Set-Cookie: PugT=1702977758; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:38 GMT; path=/ Location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.16	50465	192.132.33.69	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	764	OUT	GET /pixel/cookiesync?source=6b2595d5-cf4e-4298-a4ac-bcc34433eaad&secure=1&gdpr=0&gdpr_consent= HTTP/1.1 Host: bttrack.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: GLOBALID=2uKlc8-sIBd984cSkD72DtjK9bfIrLaH3EaccEUCHlhD8_uP_CjxhO295jvemgz1HpbM-824srMC4Q2
2023-12-19 09:22:39 UTC	664	IN	HTTP/1.1 302 Found Cache-Control: private,no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=595fce4a-490f-4f40-a00c-a7a6a90a5827&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT} Set-Cookie: GLOBALID=2uKlc8-sIBd984cSkD72DtjK9bfIrLaH3EaccEUCHlhD8_uP_CjxhO295jvemgz1HpbM-824srMC4Q2; domain=.bttrack.com; expires=Mon, 18-Mar-2024 09:21:55 GMT; path=/; secure; SameSite=None X-ServerName: Track004-iad Date: Tue, 19 Dec 2023 09:21:54 GMT Connection: close Content-Length: 315 Strict-Transport-Security: max-age=31536000;
2023-12-19 09:22:39 UTC	315	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 76 69 73 69 74 6f 72 2e 6f 6d 6e 69 74 61 67 6a 73 2e 63 6f 6d 2f 76 69 73 69 74 6f 72 2f 73 79 6e 63 3f 75 69 64 3d 36 63 61 39 34 39 33 66 64 39 35 61 66 38 33 39 35 31 61 38 64 30 62 32 31 33 61 37 37 65 38 64 26 61 6d 70 3b 76 69 73 69 74 6f 72 3d 35 39 35 66 63 65 34 61 2d 34 39 30 66 2d 34 66 34 30 2d 61 30 30 63 2d 61 37 61 36 61 39 30 61 35 38 32 37 26 61 6d 70 3b 6e 61 6d 65 3d 42 49 44 54 45 4c 4c 45 43 54 26 61 6d 70 3b 67 64 70 72 3d 24 7b 47 44 50 52 7d 26 61 6d 70 3b 67 64 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=595fce4a-490f-4f40-a00c-a7a6a90a5827&name=BIDTELLECT&gdpr=${GDPR}&gd

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.16	50433	35.244.154.8	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	611	OUT	GET /709414.gif?gdpr=0&us_privacy=1--- HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:39 UTC	673	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=SBa4E3v7q8AhIH8/GWsD1bC3dt0EMZwox4UxondWPLs=; Path=/; Domain=rlcdn.com; Expires=Wed, 18 Dec 2024 09:22:39 GMT; Secure; SameSite=None Set-Cookie: pxrc=CN/BhawGEgYIkLwrEAA=; Path=/; Domain=rlcdn.com; Expires=Sat, 17 Feb 2024 09:22:39 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.16	50475	23.105.14.106	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	1037	OUT	GET /redir?partneruserid=AACk507LAsIAABM7-sg6gA&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsyn%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID&gdpr=0 HTTP/1.1 Host: rtb-csync.smartadserver.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pid=5184721251378344538; csync=86:6663647625574893018
2023-12-19 09:22:39 UTC	581	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:38 GMT cache-control: no-cache,no-store location: https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=syn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=5184721251378344538&gdpr=0&gdpr_consent= pragma: no-cache set-cookie: csync=86:6663647625574893018\|127:AACk507LAsIAABM7-sg6gA; expires=Thu, 19 Dec 2024 09:22:39 GMT; domain=smartadserver.com; path=/; SameSite=None; secure p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.16	50518	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:38 UTC	2469	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968907273661960568 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; DPSync3=1703548800%3A253_265_252%7C1704153600%3A245_262_201_259_260_261_263%7C1703894400%3A257%7C1703030400%3A248_255%7C1704067200%3A258_256; SyncRTB3=1704153600%3A46_249_21_220_5_165_8_13_71_231_166_55_104_233_22_54_48_240_176_250_178_3%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35
2023-12-19 09:22:39 UTC	667	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:02:12 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_18=22947-968907273661960568; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:02:12 GMT; path=/ Set-Cookie: PugT=1702940532; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:02:12 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.16	50474	162.248.18.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	2223	OUT	GET /AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP/1.1 Host: image8.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; pi=137711:4; DPSync3=1703894400%3A257%7C1703548800%3A253_252_265%7C1704067200%3A256_258%7C1704153600%3A263_260_201_259_245_261_262%7C1703030400%3A248_255; SyncRTB3=1704240000%3A35%7C1705536000%3A224%7C1704153600%3A48_165_233_240_250_231_21_71_176_96_214_243_13_264_56_3_104_8_5_7_22_166_55_46_238_54_220_234_99_81_178_249%7C1703808000%3A63%7C1703548800%3A223_38_15_2%7C1708128000%3A69; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755
2023-12-19 09:22:39 UTC	848	IN	HTTP/1.1 302 Found Cache-Control: private,max-age=86400 Content-Type: text/html; charset=utf-8 Location: https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: ipc=; domain=pubmatic.com; path=/; max-age=0; SameSite=None; secure; Set-Cookie: pi=159706:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=5; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Length: 157 Connection: close
2023-12-19 09:22:39 UTC	157	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 6e 65 74 61 67 2d 73 79 73 2e 63 6f 6d 2f 6d 61 74 63 68 2f 3f 69 6e 74 5f 69 64 3d 31 31 34 26 61 6d 70 3b 67 64 70 72 3d 24 7b 47 44 50 52 7d 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 24 7b 47 44 50 52 5f 53 54 52 49 4e 47 7d 26 61 6d 70 3b 75 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.16	50495	35.244.154.8	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	693	OUT	GET /1000.gif?memo=CKW1KxoNCNzBhawGEgUI6AcQAEIASgA HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rlas3=iDTe1BCXSzCs8E/OKmA//IMCKlmjE6GaK7+b18+saXk=; pxrc=CAA=
2023-12-19 09:22:39 UTC	612	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=zcSEuIF0EqGs8E/OKmA//IMCKlmjE6GaK7+b18+saXk=; Path=/; Domain=rlcdn.com; Expires=Wed, 18 Dec 2024 09:22:39 GMT; Secure; SameSite=None Set-Cookie: pxrc=CN/BhawGEgUI6AcQAA==; Path=/; Domain=rlcdn.com; Expires=Sat, 17 Feb 2024 09:22:39 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.16	50552	35.172.99.217	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	787	OUT	GET /usersync?b=pbm&i=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:39 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:39 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.16	50530	34.225.234.246	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	685	OUT	GET /qmap?c=240&tp=PUBM&tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=&ct=y HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _cc_cc=ctst
2023-12-19 09:22:40 UTC	692	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Type: image/gif Content-Length: 49 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.9.99 Set-Cookie: _cc_dc=0;Path=/;Domain=crwdcntrl.net;Expires=Sat, 14-Sep-2024 09:09:00 GMT;SameSite=None;Secure Set-Cookie: _cc_id=99830540d7b420848ea61ac1fc0bd701;Path=/;Domain=crwdcntrl.net;Expires=Sat, 14-Sep-2024 09:09:00 GMT;SameSite=None;Secure Set-Cookie: _cc_cc="";Version=1;Path=/;Domain=crwdcntrl.net;Expires=Thu, 01-Jan-1970 02:01:00 GMT;Max-Age=0;SameSite=None;Secure Access-Control-Allow-Origin: * Server: Jetty(9.4.38.v20210224)
2023-12-19 09:22:40 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.16	50565	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	2331	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; PugT=1702977757; pi=156011:4; DPSync3=1704153600%3A259_260_201_263_261_262_245%7C1704067200%3A256_258%7C1703548800%3A252_265_253%7C1703030400%3A248_255%7C1703894400%3A257; SyncRTB3=1704153600%3A13_54_231_104_55_176_22_178_166_8_165_5_233_220_48_3_250_21_71%7C1703548800%3A223_2_15%7C1703808000%3A63
2023-12-19 09:22:39 UTC	744	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:37 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:37 GMT; path=/ Set-Cookie: PugT=1702977757; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:37 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.16	50556	34.200.65.202	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	753	OUT	GET /ups/58488/occ?&gdpr=0&gdpr_consent= HTTP/1.1 Host: ups.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; IDSYNC="18z8~2fox:190u~2fox"
2023-12-19 09:22:39 UTC	744	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Length: 0 Strict-Transport-Security: max-age=31536000 Set-Cookie: IDSYNC="18z8~2fox:190u~2fox:194o~2fox";Version=1;Domain=.analytics.yahoo.com;Path=/;Max-Age=31536000;Expires=Wed, 18-Dec-2024 09:22:39 GMT;Secure;SameSite=None P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Location: https://onetag-sys.com/match/?int_id=92&uid=y-HjSbKDBE2uGLVp3JXsBsqlttfjoBQA6yKJrnl2o-~A Age: 0 Connection: close Server: ATS/9.1.10.94 Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:39 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.16	50469	23.83.76.38	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	697	OUT	GET /api/sync?callerId=87&gdpr=0&us_privacy=1--- HTTP/1.1 Host: ssbsync.smartadserver.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pid=5184721251378344538; csync=86:6663647625574893018
2023-12-19 09:22:40 UTC	212	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:38 GMT location: https://pixel.rubiconproject.com/tap.php?v=333994&nid=4804&put=5184721251378344538&gdpr=0&gdpr_consent= connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.16	50493	162.248.18.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	2769	OUT	GET /AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP/1.1 Host: image8.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; DPSync3=1703548800%3A253_265_252%7C1704153600%3A245_262_201_259_260_261_263%7C1703894400%3A257%7C1703030400%3A248_255%7C1704067200%3A258_256; SyncRTB3=1704153600%3A46_249_21_220_5_165_8_13_71_231_166_55_104_233_22_54_48_240_176_250_178_3%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; PugT=1702977757
2023-12-19 09:22:39 UTC	1295	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Location: https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE YOUR PIGGYBACK COOKIES HERE]&gdpr=0&gdpr_consent= P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0; domain=pubmatic.com; path=/; max-age=3; SameSite=None; secure; Set-Cookie: pi=159706:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=5; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Length: 261 Connection: close
2023-12-19 09:22:39 UTC	261	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 31 2e 61 64 66 6f 72 6d 2e 6e 65 74 2f 73 65 72 76 69 6e 67 2f 63 6f 6f 6b 69 65 2f 6d 61 74 63 68 3f 70 61 72 74 79 3d 31 34 26 61 6d 70 3b 72 65 64 69 72 65 63 74 3d 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 49 34 4e 7a 55 6d 64 47 77 39 4e 44 4d 79 4d 44 41 3d 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 5b 50 4c 41 43 45 20 59 4f 55 52 20 50 49 47 47 59 42 41 43 4b 20 43 4f 4f 4b 49 45 53 20 48 45 52 45 5d 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c Data Ascii: <a href="https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE YOUR PIGGYBACK COOKIES HERE]&gdpr=0&gdpr_consent=">Found<

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.16	50494	34.194.40.200	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	664	OUT	GET /v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: sync.ex.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:39 UTC	454	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Type: image/png Content-Length: 86 Connection: close Vary: Origin Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Set-Cookie: exco-uids={"rubicon":{"UID":"LQC4ZCY6-1I-JWAU","Expire":"2023-12-26T09:22:39.528566084Z"}}; Expires=2024-03-18 09:22:39.528578306 +0000 UTC m=+8155289.816409066; Domain=.ex.co; Path=/; HTTPOnly; SameSite=None; Secure=true; Partitioned;
2023-12-19 09:22:39 UTC	86	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 0d 49 44 41 54 08 99 63 60 60 60 60 00 00 00 05 00 01 87 a1 4e d4 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsBIT\|dIDATc````NIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.16	50572	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	729	OUT	GET /s/75145?bidder_id=195755&bidder_uuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=ChAKBgjSARDiFgoGCKIBEOIW; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:39 UTC	577	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Length: 0 Connection: close Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0 Set-Cookie: _li_ss=ChcKBgjSARDiFgoGCKIBEOIWCgUIChDiFg; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:39 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:39 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 2 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.16	50436	74.121.140.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	923	OUT	GET /sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP/1.1 Host: sync.mathtag.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid=7a2e6581-60d7-4800-933d-354f6ed2801e
2023-12-19 09:22:39 UTC	563	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 19 Dec 2023 09:22:47 GMT Content-Type: image/gif Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Server: MT3 1237 600843f master iad iad-pixel-x15 config_version:"2575" Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= Expires: Tue, 19 Dec 2023 09:22:46 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.16	50558	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	462	OUT	GET /ecm3?ex=openx.com&id=13de7dcb-57c4-8911-aa9b-7bf1acf99f35&gdpr=0 HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:40 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: 4X7AFWBN8NYNGQ6T2ETV Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.16	50505	70.42.32.127	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	666	OUT	GET /cookie-sync?p=rubicon&uid=LQC4ZCY6-1I-JWAU&obUid=&initiator=&gdpr=0&us_privacy=1--- HTTP/1.1 Host: sync.outbrain.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:39 UTC	306	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Length: 0 Connection: close Cache-Control: no-cache X-TraceId: 40b5bfa9607071ce06222a26b327008f Set-Cookie: obuid=3a63fbe5-9b92-4970-b18c-2f99d5f00144; Path=/; Domain=.outbrain.com; Max-Age=7776000; Expires=Mon, 18 Mar 2024 09:22:39 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.16	50483	54.224.142.7	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	623	OUT	GET /sync?nid=14&gdpr=0&us_privacy=1--- HTTP/1.1 Host: sync.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:39 UTC	1316	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:39 GMT Location: https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=GH_JvDj8VjdvrBlOavHmp2aBmNQ Set-Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDfwYWsBjABOgT87-jmQgTWV5ru.JQAR7AgbvtEK8efXq8irp8HOJUIKN7KxeLPHNJFkjvM; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDfwYWsBjABOgT87-jmQgTWV5ru.JQAR7AgbvtEK8efXq8irp8HOJUIKN7KxeLPHNJFkjvM; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Content-Length: 121 Connection: Close
2023-12-19 09:22:39 UTC	121	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 72 75 62 69 63 6f 6e 70 72 6f 6a 65 63 74 2e 63 6f 6d 2f 74 61 70 2e 70 68 70 3f 76 3d 37 33 31 35 32 34 26 61 6d 70 3b 6e 69 64 3d 33 38 35 38 26 61 6d 70 3b 70 75 74 3d 47 48 5f 4a 76 44 6a 38 56 6a 64 76 72 42 6c 4f 61 76 48 6d 70 32 61 42 6d 4e 51 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=GH_JvDj8VjdvrBlOavHmp2aBmNQ">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.16	50543	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	482	OUT	GET /dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=13de7dcb-57c4-8911-aa9b-7bf1acf99f35 HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:39 UTC	807	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: 619Z9GBMEA3NZ06RWR5E Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:39 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:39 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:39 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.16	50524	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	2752	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=251c4a36-9e50-11ee-a342-3aa302158eab HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; PugT=1702977757; pi=156813:4; DPSync3=1703030400%3A248_255%7C1703894400%3A257%7C1704153600%3A261_201_245_263_259_262_260%7C1704067200%3A256_258%7C1703548800%3A253_252_265; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224
2023-12-19 09:22:40 UTC	650	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:39 GMT; path=/ Set-Cookie: PugT=1702977759; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:39 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.16	50487	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	2728	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=866838000893 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; PugT=1702977757; pi=156813:4; DPSync3=1703030400%3A248_255%7C1703894400%3A257%7C1704153600%3A261_201_245_263_259_262_260%7C1704067200%3A256_258%7C1703548800%3A253_252_265; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224
2023-12-19 09:22:39 UTC	600	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:38 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:38 GMT; path=/ Set-Cookie: PugT=1702977758; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:38 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.16	50562	15.197.193.217	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	946	OUT	GET /track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4475564770 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUYASAEKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.
2023-12-19 09:22:41 UTC	606	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Length: 181 Connection: close server: Kestrel location: https://sync.1rx.io/usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7 set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:39 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUYASABKAIyCwjAzLvy2J_APBAFOAFaC2FkY29uZHVjdG9yYAI.; expires=Thu, 19 Dec 2024 09:22:39 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:41 UTC	181	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 74 72 61 64 65 64 65 73 6b 2f 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 22 3e 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 74 72 61 64 65 64 65 73 6b 2f 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://sync.1rx.io/usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7">https://sync.1rx.io/usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.16	50477	15.197.193.217	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	946	OUT	GET /track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5966854299 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUYASAEKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.
2023-12-19 09:22:39 UTC	606	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Length: 181 Connection: close server: Kestrel location: https://sync.1rx.io/usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7 set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:39 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUYASABKAIyCwjKveDy2J_APBAFOAFaC2FkY29uZHVjdG9yYAI.; expires=Thu, 19 Dec 2024 09:22:39 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:39 UTC	181	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 74 72 61 64 65 64 65 73 6b 2f 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 22 3e 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 74 72 61 64 65 64 65 73 6b 2f 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://sync.1rx.io/usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7">https://sync.1rx.io/usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.16	50540	142.250.189.130	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	608	OUT	GET /pixel?google_nid=openx&google_hm=Njc2N2QyN2MtODIxOS02YzRmLTdmNzUtYTNkZjBlMjg5YWI1 HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:39 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/png Date: Tue, 19 Dec 2023 09:22:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Server: HTTP server (unknown) Content-Length: 170 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:39 UTC	170	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 d7 05 1d 0d 0d 2d 51 d5 37 6e 00 00 00 1d 74 45 58 74 43 6f 6d 6d 65 6e 74 00 43 72 65 61 74 65 64 20 77 69 74 68 20 54 68 65 20 47 49 4d 50 ef 64 25 6e 00 00 00 0d 49 44 41 54 08 d7 63 a8 69 79 e5 00 00 05 95 02 2b 03 a2 de f7 00 00 00 00 49 45 4e 44 ae 42 60 82 0a Data Ascii: PNGIHDRbKGDpHYstIME-Q7ntEXtCommentCreated with The GIMPd%nIDATciy+IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.16	50492	35.163.115.57	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	751	OUT	GET /visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LQC4ZCY6-1I-JWAU&name=RUBICON&gdpr=0&us_privacy=1--- HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:41 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 5 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:41 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.16	50525	34.225.234.246	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	680	OUT	GET /qmap?c=240&tp=PUBM&tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _cc_cc=ctst
2023-12-19 09:22:40 UTC	315	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Type: image/gif Content-Length: 49 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.10.116 Access-Control-Allow-Origin: * Server: Jetty(9.4.38.v20210224)
2023-12-19 09:22:40 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.16	50526	104.18.36.155	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	774	OUT	GET /crum?cm_dsp_id=109&external_user_id=75ae24856eb84dc58191e0600d738e77&expiration=1705569757 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:40 UTC	984	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e95178eb774ae-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:39 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:39 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZbjcMMQ337PN4tluB%2BmPuN36cZRW7LA72WMv%2B4MOi4dxttcew4Zr3Kpf5CWkSqMbvcdkDiFkaZXDkRxJDTq1FDD42d1ao6fcdejwma6doLwadqdzbRHqg%2FWn0lRBgqVA996nZokzJ8r6KA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.16	50473	34.200.65.202	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	805	OUT	GET /ups/58160/sync?_origin=1&uid=LQC4ZCY6-1I-JWAU&redir=true&gdpr=0&us_privacy=1--- HTTP/1.1 Host: ups.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; IDSYNC="18z8~2fox:175w~2fox"
2023-12-19 09:22:40 UTC	780	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Length: 0 Strict-Transport-Security: max-age=31536000 Set-Cookie: IDSYNC="18z8~2fox:175w~2fox:18vk~2fox";Version=1;Domain=.analytics.yahoo.com;Path=/;Max-Age=31536000;Expires=Wed, 18-Dec-2024 09:22:40 GMT;Secure;SameSite=None P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Location: https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=58160&ovsid=LQC4ZCY6-1I-JWAU&gdpr=0&redir=true&us_privacy=1--- Age: 0 Connection: close Server: ATS/9.1.10.94 Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:40 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.16	50608	34.233.75.175	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:39 UTC	504	OUT	GET /sync/openx/dfcf67f2-dbc2-a0a2-5b42-ef933b9d999c?gdpr=0 HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE
2023-12-19 09:22:40 UTC	778	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:40 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2023-12-19 09:22:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.16	50467	162.19.138.119	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	571	OUT	GET /lb/v1 HTTP/1.1 Host: lb.eu-1-id5-sync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:40 UTC	386	IN	HTTP/1.1 200 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers access-control-allow-origin: https://caffeine.softonic.com.br vary: Origin content-type: application/json;charset=UTF-8 transfer-encoding: chunked date: Tue, 19 Dec 2023 09:22:39 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2023-12-19 09:22:40 UTC	44	IN	Data Raw: 32 31 0d 0a 7b 22 6c 62 22 3a 22 2b 65 76 44 70 76 37 58 75 4e 54 64 69 41 4d 4e 4f 73 36 69 62 51 3d 3d 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 21{"lb":"+evDpv7XuNTdiAMNOs6ibQ=="}0

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.16	50464	44.193.120.159	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	657	OUT	GET /tag/?id=20909&user_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: bpi.rtactivate.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:41 UTC	140	IN	HTTP/1.1 200 OK Server: awselb/2.0 Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif Content-Length: 43 Connection: close
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.16	50542	54.224.142.7	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	1410	OUT	GET /sync?nid=11&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk
2023-12-19 09:22:40 UTC	304	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:40 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= Content-Length: 188 Connection: Close
2023-12-19 09:22:40 UTC	188	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 30 4d 7a 45 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 47 48 5f 4a 76 44 6a 38 56 6a 64 76 72 42 6c 4f 61 76 48 6d 70 32 61 42 6d 4e 51 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent=">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.16	50451	23.88.86.2	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	814	OUT	GET /sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID HTTP/1.1 Host: matching.truffle.bid Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:41 UTC	150	IN	HTTP/1.1 204 No Content Server: nginx/1.23.1 Date: Tue, 19 Dec 2023 09:22:40 GMT Connection: close Strict-Transport-Security: max-age=15768000

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.16	50551	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	1691	OUT	GET /merge?pid=71&3pid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:41 UTC	3084	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:40 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.16	50579	18.239.225.91	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	944	OUT	GET /sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=a0aee609-2968-45de-a5d3-b77df9a421f0 HTTP/1.1 Host: live.rezync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: zync-uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411:1702977757.5650773; sd-session-id=eyJfcGVybWFuZW50Ijp0cnVlLCJzZXNzaW9uX2lkIjoiYTQ2MTJhMDEtZTllYy00NWM0LWJkNDQtMzk3ZWU3ZjU0NDExOjE3MDI5Nzc3NTcuNTY1MDc3MyJ9.ZYFg3Q.tuCU6ZN6du2nJlWUbZwo1ZuBKwQ
2023-12-19 09:22:40 UTC	1193	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 971 Connection: close Date: Tue, 19 Dec 2023 09:22:40 GMT Location: https://p.rfihub.com/cm?pub=39342&in=1&userid=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977757.5650773&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3Da4612a01-e9ec-45c4-bd44-397ee7f54411%253A1702977757.5650773%26pid%3D500040%26it%3D1%26iv%3Da4612a01-e9ec-45c4-bd44-397ee7f54411%253A1702977757.5650773%26_%3D1702977760.1927698&cb=1702977760.1928182 Set-Cookie: zync-uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411:1702977757.5650773; Domain=rezync.com; Expires=Sun, 12 Jan 2025 09:22:40 GMT; Path=/; SameSite=None; Secure Set-Cookie: sd-session-id=eyJfcGVybWFuZW50Ijp0cnVlLCJzZXNzaW9uX2lkIjoiYTQ2MTJhMDEtZTllYy00NWM0LWJkNDQtMzk3ZWU3ZjU0NDExOjE3MDI5Nzc3NTcuNTY1MDc3MyJ9.ZYFg4A.HVP6tb5G70vDaIgR_XXCDC8gUKI; Expires=Sun, 12 Jan 2025 09:22:40 GMT; HttpOnly; Path=/; SameSite=None; Secure Vary: Cookie Server: lighttpd/1.4.69 X-Cache: Miss from cloudfront Via: 1.1 e8e86a0bfba495b0c160da8db57821d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P8 X-Amz-Cf-Id: 3EG-dloTRbYJYUixqe7o-5k9dkI8zqkAzyAq3LI84g8p87RsC3tsAg==
2023-12-19 09:22:40 UTC	971	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 73 68 6f 75 6c 64 20 62 65 20 72 65 64 69 72 65 63 74 65 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 74 6f 20 74 68 65 20 74 61 72 67 65 74 20 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 2e 72 66 69 68 75 62 2e 63 6f 6d 2f 63 6d 3f 70 75 62 3d 33 39 33 34 32 26 61 6d 70 3b 69 6e 3d 31 26 61 6d 70 3b 75 73 65 72 69 64 3d 61 34 36 31 32 61 30 31 2d 65 39 65 63 2d 34 35 63 34 2d 62 64 34 34 2d 33 39 37 65 65 37 66 35 34 34 31 31 25 33 41 31 37 30 32 39 37 37 Data Ascii: <!doctype html><html lang=en><title>Redirecting...</title><h1>Redirecting...</h1><p>You should be redirected automatically to the target URL: <a href="https://p.rfihub.com/cm?pub=39342&in=1&userid=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.16	50531	173.194.219.154	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	889	OUT	POST /g/collect?v=2&tid=G-R5K71YRXMV&cid=430166992.1702977739&gtm=45je3bt0v877889940z86335967&aip=1&dma=0&gcd=11l1l1l1l1 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:40 UTC	458	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://caffeine.softonic.com.br Date: Tue, 19 Dec 2023 09:22:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.16	50586	96.46.186.182	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	663	OUT	GET /cookiesyncendpoint?biddername=5&auid=&key=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: sync.aniview.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:40 UTC	326	IN	HTTP/1.1 200 OK set-cookie: 1_C_5=LQC4ZCY6-1I-JWAU; Path=/; Domain=aniview.com; Expires=Fri, 29 Dec 2023 09:22:40 GMT; Secure; SameSite=None set-cookie: 1_C_5=LQC4ZCY6-1I-JWAU; Path=/; Expires=Fri, 29 Dec 2023 09:22:40 GMT; Secure; SameSite=None date: Tue, 19 Dec 2023 09:22:40 GMT content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.16	50538	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	2451	OUT	GET /AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; pi=137711:4; DPSync3=1703894400%3A257%7C1703548800%3A253_252_265%7C1704067200%3A256_258%7C1704153600%3A263_260_201_259_245_261_262%7C1703030400%3A248_255; SyncRTB3=1704240000%3A35%7C1705536000%3A224%7C1704153600%3A48_165_233_240_250_231_21_71_176_96_214_243_13_264_56_3_104_8_5_7_22_166_55_46_238_54_220_234_99_81_178_249%7C1703808000%3A63%7C1703548800%3A223_38_15_2%7C1708128000%3A69; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ
2023-12-19 09:22:41 UTC	851	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:38 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:38 GMT; path=/ Set-Cookie: PugT=1702977758; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:38 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.16	50478	35.211.178.172	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	696	OUT	GET /sync?ssp=onetag&gdpr=0&gdpr_consent= HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:41 UTC	256	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=onetag

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.16	50519	174.129.88.64	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	685	OUT	GET /map/ct=y/c=14701/tp=MTAI/tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F/gdpr=0/gdpr_consent= HTTP/1.1 Host: bcp.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _cc_cc=ctst
2023-12-19 09:22:40 UTC	315	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif Content-Length: 49 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.57.123 Access-Control-Allow-Origin: * Server: Jetty(9.4.38.v20210224)
2023-12-19 09:22:40 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
559	192.168.2.16	50503	8.28.7.81	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	2361	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=83929620&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; DPSync3=1703548800%3A253_265_252%7C1704153600%3A245_262_201_259_260_261_263%7C1703894400%3A257%7C1703030400%3A248_255%7C1704067200%3A258_256; SyncRTB3=1704153600%3A46_249_21_220_5_165_8_13_71_231_166_55_104_233_22_54_48_240_176_250_178_3%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35
2023-12-19 09:22:40 UTC	1122	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=5; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=0:4; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1704067200%3A256_258%7C1703548800%3A265_253_252%7C1703894400%3A257%7C1704153600%3A262_263_236_235_228_201_260_226_245_259_261%7C1703030400%3A255_248; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:39 GMT Transfer-Encoding: chunked Connection: close
2023-12-19 09:22:40 UTC	2127	IN	Data Raw: 38 34 33 0d 0a 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 69 6f 2e 6e 61 72 72 61 74 69 76 65 2e 69 6f 2f 3f 63 6f 6d 70 61 6e 79 49 64 3d 36 37 33 26 69 64 3d 70 75 62 6d 61 74 69 63 5f 69 64 3a 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 09 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 61 2e 61 75 64 72 74 65 2e 63 6f 6d 2f 6d 61 74 63 68 3f 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 70 3d 4d 31 37 31 37 30 35 34 39 30 31 26 75 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 Data Ascii: 843PubMatic.loadAsyncImagePixel('https://io.narrative.io/?companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F');PubMatic.loadAsyncImagePixel('https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=5DC35839-FDF8-4CE8-A75C-05C04E

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.16	50550	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	1342	OUT	GET /merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4
2023-12-19 09:22:40 UTC	2101	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:40 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9jbFuAjEQBf%2FFdVay1%2BtdO92eMdKhiwRSogg6jM8UKSkj%2Fh1fQztvRu%2FfoPk0yU%2BZeFKn2VIsPPl9KYmt31nUUsh8GJThOU%2BUQvcgayIgZITKPUCTgLRyr63JcKMd7nLKdMnHGdwByvKNg6fti5k9kzCGIBSTty5uiX8nZwY3w%2BFXfzYeBlfNf8HKoo9ZdfoSeNz5rmMVHivKyq0Lw9W1K9i4MmDDBNRvtt6kco1ini9gATcg; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.16	50567	8.28.7.84	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	2440	OUT	GET /AdServer/SPug?partnerID=159047&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage4.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; PugT=1702977757; pi=156011:4; DPSync3=1704153600%3A259_260_201_263_261_262_245%7C1704067200%3A256_258%7C1703548800%3A252_265_253%7C1703030400%3A248_255%7C1703894400%3A257; SyncRTB3=1704153600%3A13_54_231_104_55_176_22_178_166_8_165_5_233_220_48_3_250_21_71%7C1703548800%3A223_2_15%7C1703808000%3A63
2023-12-19 09:22:40 UTC	408	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:27:40 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: SPugT=1702942060; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:27:40 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.16	50541	23.83.76.73	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	516	OUT	GET /redir/?issi=1&partnerid=86&partneruserid=6663647625574893018&gdpr=0&gdpr_consent= HTTP/1.1 Host: rtb-csync.smartadserver.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pid=5184721251378344538; csync=86:6663647625574893018\|104:LQC4ZCY6-1I-JWAU
2023-12-19 09:22:40 UTC	394	IN	HTTP/1.1 200 OK content-type: image/gif date: Tue, 19 Dec 2023 09:22:40 GMT cache-control: no-cache,no-store pragma: no-cache set-cookie: csync=86:6663647625574893018\|104:LQC4ZCY6-1I-JWAU; expires=Thu, 19 Dec 2024 09:22:40 GMT; domain=smartadserver.com; path=/; SameSite=None; secure transfer-encoding: chunked p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" connection: close
2023-12-19 09:22:40 UTC	54	IN	Data Raw: 32 42 0d 0a 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2BGIF89a!,D;0

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.16	50528	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	1454	OUT	GET /merge?pid=97&3pid=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV
2023-12-19 09:22:40 UTC	2756	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:40 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9kEtrAjEQx7%2FLnjuQxzyS3rIxK1oLbdUWvRmz2YNQEL1I6Xdv9tLb8Ps%2FmJmfznTPnbd9RO6DDlGhS9zbISXPyi6UCSlh99Rpbj72XlVTC3itRsBzreBIdJvySSuveKwZmJxmVQiIyLYk%2Bpbcr9Xybrfl8nFwjRlpTFtET9WCjB4BDRvIXAmKkMGRay5Fmtep5t28RzzGtxXoNaTNzjTu582Z2TIKGyJB563Sc73oJtEiWnLWw7AYHGBMDoJQBEXtyJRC6GWY6%2B1%2F%2FYFBr2D9FfYzx8aPh2HSj3x8uZbt93Td31aP%2By4sP2edmh5CvJCSTbitWt%2BrwG3iKcwbzO8yMnKpwnDS5QTKjQymGA9YzyqfJXN20v3%2BAQmMXds%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.16	50499	35.163.115.57	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	734	OUT	GET /visitor/sync?uid=f04f5c55f88ffea7a3ce5b2d908a6e71&visitor=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:40 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 3 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:40 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.16	50554	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:40 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:58; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.16	50651	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	2794	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; PugT=1702941561; chkChromeAb67Sec=5; pi=156212:4; DPSync3=1703548800%3A252_265_253%7C1704153600%3A261_262_228_260_259_263_245_226_236_235_201%7C1703030400%3A255_248%7C1703894400%3A257%7C1704067200%3A258_256
2023-12-19 09:22:41 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:39 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.16	50508	82.145.213.8	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	758	OUT	GET /pub/sync?pubid=pub8730968190912 HTTP/1.1 Host: t.adx.opera.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17
2023-12-19 09:22:41 UTC	807	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 166 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17 Pragma: no-cache Set-Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17; Path=/; Domain=adx.opera.com; Max-Age=31536000; Secure; SameSite=None
2023-12-19 09:22:41 UTC	166	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 30 4f 44 6b 6d 64 47 77 39 4e 44 4d 79 4d 44 41 3d 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 4f 50 55 66 63 66 35 31 30 39 61 31 61 36 33 34 32 37 63 61 31 37 66 32 65 36 35 30 61 35 61 64 65 31 37 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
568	192.168.2.16	50590	8.28.7.83	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	2966	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7562641581956847537 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; pi=137711:4; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; SyncRTB3=1703808000%3A63%7C1705536000%3A224%7C1704153600%3A3_55_165_166_48_56_96_46_22_178_234_99_233_214_21_5_231_104_7_81_249_176_250_264_243_220_240_54_71_13_238_8%7C1703548800%3A223_15_2_38%7C1704240000%3A35%7C1708128000%3A69; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; PugT=1702977758
2023-12-19 09:22:40 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.16	50512	67.202.105.21	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	957	OUT	GET /ps/?us_privacy=&xi=33&xu=2271281487850057919730 HTTP/1.1 Host: ssc-cms.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:41 UTC	678	IN	HTTP/1.1 302 p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" set-cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632; Domain=.33across.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Path=/; Secure; SameSite=None referrer-policy: unsafe-url pragma: no-cache cache-control: no-store, no-cache, must-revalidate expires: Thu, 01-Jan-70 00:00:01 GMT x-33x-status: 8000000008200000A server: 33XP018 location: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=2271281487850057919730&ts=1702977760&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy= content-length: 0 date: Tue, 19 Dec 2023 09:22:40 GMT connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.16	50598	34.117.223.223	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	139	OUT	POST /v4/receive/json/25 HTTP/1.1 Connection: Keep-Alive User-Agent: Icarus Http/1.0 Content-Length: 1236 Host: analytics.avcdn.net
2023-12-19 09:22:40 UTC	1236	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 32 35 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 38 61 38 61 61 66 30 33 2d 38 32 38 30 2d 34 38 34 62 2d 39 65 64 65 2d 63 37 33 38 31 36 32 63 33 66 66 61 22 2c 22 74 69 6d 65 22 3a 31 37 30 32 39 38 33 37 37 38 32 34 31 7d 2c 22 73 65 74 75 70 22 3a 7b 22 63 6f 6d 6d 6f 6e 22 3a 7b 22 6f 70 65 72 61 74 69 6f 6e 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 36 64 31 31 64 65 64 38 2d 38 34 33 32 2d 34 39 32 31 2d 62 66 61 33 2d 32 32 34 62 37 36 30 63 64 33 39 65 22 2c 22 73 74 61 67 65 22 3a 22 73 66 78 2d 72 75 6e 6e 69 6e 67 2d 69 63 61 72 75 73 22 2c 22 74 69 74 6c 65 22 3a 22 41 56 47 20 41 6e 74 Data Ascii: {"record":[{"event":{"type":25,"subtype":1,"request_id":"8a8aaf03-8280-484b-9ede-c738162c3ffa","time":1702983778241},"setup":{"common":{"operation":"install","session_id":"6d11ded8-8432-4921-bfa3-224b760cd39e","stage":"sfx-running-icarus","title":"AVG Ant
2023-12-19 09:22:40 UTC	216	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: application/json Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:40 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.16	50532	142.250.189.132	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	1215	OUT	GET /pagead/1p-user-list/631321069/?random=1702977738859&cv=11&fst=1702976400000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1280&u_h=1024&url=https%3A%2F%2Fcaffeine.softonic.com.br%2F&frm=0&tiba=Caffeine%20-%20Download&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Q98BsBw8NKot7PUJkSsguj26XYtXPdIHMJTPx35WoExwwoUA&random=134468308&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:41 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
572	192.168.2.16	50459	172.105.220.23	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	688	OUT	GET /pubmatic HTTP/1.1 Host: gocm.c.appier.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:40 UTC	627	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 153 Connection: close Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version Cache-Control: no-store Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=trdyDQMND--pvQOH4GCBZQ P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: _auid=trdyDQMND--pvQOH4GCBZQ; Path=/; Domain=c.appier.net; Expires=Thu, 19 Dec 2024 09:22:40 GMT; Max-Age=31536000; HttpOnly; Secure; SameSite=None
2023-12-19 09:22:40 UTC	153	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 79 4d 44 49 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 74 72 64 79 44 51 4d 4e 44 2d 2d 70 76 51 4f 48 34 47 43 42 5a 51 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=trdyDQMND--pvQOH4GCBZQ">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.16	50536	192.184.68.215	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	795	OUT	GET /pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: cms.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: d=EFgBDQHZKt-owQA; mc=658160dc-8eeb9-895f2-d0e4b
2023-12-19 09:22:40 UTC	695	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Length: 0 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7 P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Pragma: no-cache Set-Cookie: d=EIQBEgHZKvijDejbEA; expires=Mon, 18-Mar-2024 09:22:40 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Strict-Transport-Security: max-age=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.16	50549	8.28.7.84	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	2543	OUT	GET /AdServer/SPug?partnerID=156212&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage4.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; PugT=1702977757; pi=156813:4; DPSync3=1703030400%3A248_255%7C1703894400%3A257%7C1704153600%3A261_201_245_263_259_262_260%7C1704067200%3A256_258%7C1703548800%3A253_252_265; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224
2023-12-19 09:22:40 UTC	408	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:40 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: SPugT=1702977760; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:40 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.16	50584	18.209.128.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	742	OUT	GET /pbmtc.gif?puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:40 UTC	444	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif Content-Length: 42 Connection: close Server: Kestrel Set-Cookie: UID=ade99547-e71c-4503-9f72-c309ae5a0c29; expires=Thu, 19 Dec 2024 09:22:40 GMT; path=/; secure; samesite=none Set-Cookie: ss=Q5c%2By3QB7RuLCIcnuvkJXh2%2BVmmHH0BKTeDseY9vCvldIaoGPHgXs98TeAGrQ1P5656MMzqzU7HNmugPmqaZhQ%3D%3D; expires=Thu, 19 Dec 2024 09:22:40 GMT; path=/; secure; samesite=none
2023-12-19 09:22:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.16	50537	104.18.25.173	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	996	OUT	GET /i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP/1.1 Host: a.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ANON_ID=aMnvBNR3YWj7UXuRu8rphZdE4WTZaZaEDQvYjPmERPNF0tHAA5CvWXsu4PFIemUJmP6K2wkAq9Nko0sDpOrByUTSAIfZc5Du5TdjNp4RipQtRIZba4xK4Spt8
2023-12-19 09:22:42 UTC	859	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 43 Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 302 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=aNnvBNyg6AbrA7u8PUN85DhJC77L3c0Xbi2paQ4Zb71OpnZdXArHXVEr1W3HWTroV7sZboNEZblygTTd0X3c3X1t9sDhSyD5CgZc5twmo6r3rg9L9cxrCS3YV; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:40 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=aNnvBNyg6AbrA7u8PUN85DhJC77L3c0Xbi2paQ4Zb71OpnZdXArHXVEr1W3HWTroV7sZboNEZblygTTd0X3c3X1t9sDhSyD5CgZc5twmo6r3rg9L9cxrCS3YV; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:40 GMT; CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 837e951bead421f4-MIA alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 40 02 02 44 01 00 3b Data Ascii: GIF89a!,@D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.16	50570	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	1492	OUT	GET /merge?pid=80&3pid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV
2023-12-19 09:22:40 UTC	2729	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:40 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9kEtrAjEQx7%2FLnjuQxzyS3rIxK1oLbdUWvRmz2YNQEL1I6Xdv9tLb8Ps%2FmJmfznTPnbd9RO6DDlGhS9zbISXPyi6UCSlh99Rpbj72XlVTC3itRsBzreBIdJvySSuveKwZmJxmVQiIyLYk%2Bpbcr9Xybrfl8nFwjRlpTFtET9WCjB4BDRvIXAmKkMGRay5Fmtep5t28RzzGtxXoNaTNzjTu582Z2TIKGyJB563Sc73oJtEiWnLWw7AYHGBMDoJQBEXtyJRC6GWY6%2B1%2F%2FYFBr2D9FfYzx8aPh2HSj3x8uZbt93Td31aP%2By4sP2edmh5CvJCSTbitWt%2BrwG3iKcwbzO8yMnKpwnDS5QTKjQymGA9YzyqfJXN20v3%2BAQmMXds%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCY6-1I-JWAU; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.16	50539	162.248.18.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	2707	OUT	GET /AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP/1.1 Host: image8.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; PugT=1702977757; pi=156813:4; DPSync3=1703030400%3A248_255%7C1703894400%3A257%7C1704153600%3A261_201_245_263_259_262_260%7C1704067200%3A256_258%7C1703548800%3A253_252_265; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224
2023-12-19 09:22:41 UTC	659	IN	HTTP/1.1 204 No Content Cache-Control: private,max-age=86400 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: ipc=0^^0^0; domain=pubmatic.com; path=/; max-age=3; SameSite=None; secure; Set-Cookie: pi=0:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=5; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.16	50513	35.207.24.140	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	1043	OUT	GET /sync?ssp=bidswitch&bidswitch_ssp_id=the33across&bsw_user_id=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&us_privacy= HTTP/1.1 Host: rtb.mfadsrvr.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=5aea8bca-e090-4802-94d3-585fd3816e26; c=1702977754; tuuid_lu=1702977754
2023-12-19 09:22:41 UTC	483	IN	HTTP/1.1 302 Moved Temporarily Cache-Control: no-cache, no-store, must-revalidate Content-Length: 0 Date: Tue, 19 Dec 2023 09:22:40 GMT Location: //x.bidswitch.net/sync?dsp_id=250&expires=14&user_id=5aea8bca-e090-4802-94d3-585fd3816e26&ssp=the33across Set-Cookie: ssh=!bidswitch,1702977760; path=/; expires=Thu, 18-Dec-2025 09:22:40 GMT; domain=.mfadsrvr.com; samesite=none; secure Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.16	50515	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	3070	OUT	GET /AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; pi=159706:3; PugT=1702977757; SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0
2023-12-19 09:22:41 UTC	851	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:39 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:39 GMT; path=/ Set-Cookie: PugT=1702977759; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:39 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.16	50613	104.36.113.107	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	2486	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:93BC46BA1AC048E6B3FEE9603D02AEE4 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; PugT=1702941561; chkChromeAb67Sec=5; pi=156212:4; DPSync3=1703548800%3A252_265_253%7C1704153600%3A261_262_228_260_259_263_245_226_236_235_201%7C1703030400%3A255_248%7C1703894400%3A257%7C1704067200%3A258_256
2023-12-19 09:22:40 UTC	745	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 04:52:34 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 04:52:34 GMT; path=/ Set-Cookie: PugT=1702961554; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 04:52:34 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.16	50491	52.89.73.205	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	785	OUT	GET /visitor/sync?name=NATIVO&ttl=720&uid=0544850a0778385701c6899403bef718&visitor=ae22bf69-3570-4432-9201-d61950d25999&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:42 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 3 X-Kong-Proxy-Latency: 1 Via: kong/2.8.3
2023-12-19 09:22:42 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.16	50589	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	3052	OUT	GET /AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; pi=137711:4; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; SyncRTB3=1703808000%3A63%7C1705536000%3A224%7C1704153600%3A3_55_165_166_48_56_96_46_22_178_234_99_233_214_21_5_231_104_7_81_249_176_250_264_243_220_240_54_71_13_238_8%7C1703548800%3A223_15_2_38%7C1704240000%3A35%7C1708128000%3A69; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; PugT=1702977758
2023-12-19 09:22:40 UTC	781	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:19:24 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:19:24 GMT; path=/ Set-Cookie: PugT=1702941564; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:19:24 GMT; path=/ Location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.16	50544	216.239.38.181	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	2063	OUT	POST /g/collect?v=2&tid=G-R5K71YRXMV&gtm=45je3bt0v877889940z86335967&_p=1702977735272&_gaz=1&gcd=11l1l1l1l1&dma=0&tcfd=10000&cid=430166992.1702977739&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&_s=1&sid=1702977739&sct=1&seg=0&dl=https%3A%2F%2Fcaffeine.softonic.com.br%2F&dt=Caffeine%20-%20Download&en=page_view&_fv=1&_nsi=1&_ss=1&ep.page_type=program_page&ep.site_language=pt&ep.google_click_id=&ep.test_variant=&ep.pv=undefined&ep.source_details=test&ep.program_id=f46a4db4-96d4-11e6-b215-00163ec9f5fa&ep.program_platform=windows&ep.program_category=utilities-tools&ep.program_sources=&ep.program_review_source=legacy&ep.program_download_type=externalDownload&ep.program_review_modification_date=2014-08-01&ep.program_opinions=no&ep.program_review_publication_date=2010-07-29&ep.program_has_button_buy=no&ep.program_has_button_download=yes&ep.program_has_gallery=yes&ep.program_has_offer=no&epn.program_user_score=8.651515151515152&ep.google_compliant=yes&ep.program_name=Caffeine&ep.vertical_id=&ep.ecosystem_id=&ep.ad_session_id=undefined&tfd=6943 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:42 UTC	458	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://caffeine.softonic.com.br Date: Tue, 19 Dec 2023 09:22:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.16	50597	34.117.239.71	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	854	OUT	GET /match?liv=h&us_privacy=&bidder_id=25&external_user_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: events-ssc.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:41 UTC	257	IN	HTTP/1.1 200 OK content-type: image/png cache-control: no-cache, no-store, max-age=0, must-revalidate Content-Length: 68 Date: Tue, 19 Dec 2023 09:22:40 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:41 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
586	192.168.2.16	50633	63.251.86.49	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	1373	OUT	GET /merge?pid=76&3pid=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:41 UTC	3084	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:40 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:40 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.16	50547	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	1010	OUT	GET /merge?pid=84&3pid=ZYFg1ybZKqdSngqUsIytTAGV HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:41 UTC	2101	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:41 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.16	50559	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	441	OUT	GET /x/ae12848777b41970a5f2?gdpr=0&gdpr_consent= HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:41 UTC	826	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 64 Connection: close x-amz-rid: V1V3B47KXWRRW0HY38EX Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:40 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:40 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:41 UTC	64	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body style="background-color:transparent"></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.16	50573	34.225.234.246	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	1050	OUT	GET /qmap?c=1389&tp=STSC&tpid=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553%26partner_url%3Dhttps%253A%252F%252Fr.casalemedia.com%252Frum%253Fcm_dsp_id%253D64%2526external_user_id%253D6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553%2526gdpr%253D0%2526gdpr_consent%253D&ct=y HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _cc_cc=ctst
2023-12-19 09:22:42 UTC	563	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Length: 0 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.51.216 Location: https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&partner_url=https%3A%2F%2Fr.casalemedia.com%2Frum%3Fcm_dsp_id%3D64%26external_user_id%3D6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553%26gdpr%3D0%26gdpr_consent%3D Server: Jetty(9.4.38.v20210224)

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.16	50574	15.197.193.217	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	832	OUT	GET /track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUYASAEKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.
2023-12-19 09:22:42 UTC	659	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Length: 215 Connection: close server: Kestrel location: https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:41 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUSGQoKbGl2ZWludGVudBILCLTq9tDCn8A8EAUYASABKAIyCwiQ4fn92J_APBAFOAFaCmxpdmVpbnRlbnRgAg..; expires=Thu, 19 Dec 2024 09:22:41 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:42 UTC	215	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 2e 6c 69 61 64 6d 2e 63 6f 6d 2f 73 2f 33 35 37 35 39 3f 62 69 64 64 65 72 5f 69 64 3d 34 34 34 38 39 26 62 69 64 64 65 72 5f 75 75 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 22 3e 68 74 74 70 73 3a 2f 2f 69 2e 6c 69 61 64 6d 2e 63 6f 6d 2f 73 2f 33 35 37 35 39 3f 62 69 64 64 65 72 5f 69 64 3d 34 34 34 38 39 26 62 69 64 64 65 72 5f 75 75 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7">https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.16	50553	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	853	OUT	GET /usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D
2023-12-19 09:22:41 UTC	683	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:41 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:41 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5625528590 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.16	50521	198.148.27.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:40 UTC	818	OUT	GET /bh/rtset?pid=560687&ev=1&rurl=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D390200%26nid%3D5120%26put%3D%25%25VGUID%25%25&gdpr=0&us_privacy=1--- HTTP/1.1 Host: bh.contextweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: V=xHDGeFAGG4q9; pb_rtb_ev=3-1oms\|7bq.0.1; INGRESSCOOKIE=363b52ae67c8a57f
2023-12-19 09:22:41 UTC	906	IN	HTTP/1.1 302 Found Connection: close P3P: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT" Accept-CH: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version CW-Server: bh-deployment-db744d8c7-d4chf Cache-Control: private, max-age=0, no-cache, no-store Expires: -1 Content-Language: en-US Set-Cookie: ccpa=1---;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Thu, 18-Jan-2024 09:22:41 GMT;Max-Age=2592000;SameSite=None Set-Cookie: V=xHDGeFAGG4q9;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Fri, 13-Dec-2024 09:22:41 GMT;Max-Age=31104000;SameSite=None Location: https://pixel.rubiconproject.com/tap.php?v=390200&nid=5120&put=xHDGeFAGG4q9&ev=1&us_privacy=1---&pid=560687&gdpr=0 Server: Jetty(10.0.14) Strict-Transport-Security: max-age=15768000

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.16	50602	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	1691	OUT	GET /merge?pid=58&3pid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:41 UTC	3084	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:41 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.16	50450	195.5.165.20	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	708	OUT	GET /cookiesync?gdpr=0&gdpr_consent= HTTP/1.1 Host: core.iprom.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:42 UTC	234	IN	HTTP/1.1 200 OK Vary: Accept-Encoding X-adserver-worker: komodo-170ede39ffd7@version_1.579 Connection: close X-server-arch: v2 Content-Type: image/gif Content-Length: 43 X-core-time: 0ms Date: Tue, 19 Dec 2023 09:22:41 GMT
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.16	50686	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	523	OUT	GET /rum?cm_dsp_id=39&external_user_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&expiration=1705569749&gdpr=0&gdpr_consent= HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:41 UTC	988	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e951f2a615c69-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:41 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:41 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WONhoWNE8GaSR99Kefm4DnSLeaUJjwTWzsQpzc3%2B%2FRvdJzZjRHeNdbxANsZehO9nzjSnIA0RrW%2Fon87DvXo02wXHzOrtc1IP0uNoT7ahrk%2Bw5vjqSrEUiQVls%2FhnPcXvJYhbLahZmlvRWg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.16	50647	34.98.64.218	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	630	OUT	GET /w/1.0/sd?id=537072971&val=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0&gdpr_consent= HTTP/1.1 Host: us-u.openx.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK; univ_id=537072971\|134495f3-7e94-4262-b6f5-d7524e6fbdd7\|1702977751750893
2023-12-19 09:22:41 UTC	568	IN	HTTP/1.1 200 OK Vary: Accept Set-Cookie: univ_id=537072971\|134495f3-7e94-4262-b6f5-d7524e6fbdd7\|1702977761173237; Version=1; Expires=Wed, 03-Jan-2024 09:22:41 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None Server: OXGW/0.0.0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Expires: Mon, 26 Jul 1997 05:00:00 GMT Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Cache-Control: private, max-age=0, no-cache Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.16	50637	195.244.31.10	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	554	OUT	GET /visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1 HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:41 UTC	465	IN	HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate content-type: image/gif expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff date: Tue, 19 Dec 2023 09:22:40 GMT content-length: 49 x-envoy-upstream-service-time: 2 server: ayl-lb-usa02 connection: close
2023-12-19 09:22:41 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.16	50566	35.172.99.217	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	686	OUT	GET /usersync?b=mag&i=LQC4ZCY6-1I-JWAU&us_privacy=1--- HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:41 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:41 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.16	50618	195.244.31.10	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	492	OUT	GET /visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AABafU7LAsIAABNxgMUHeA&name=BEESWAX HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:41 UTC	465	IN	HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate content-type: image/gif expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff date: Tue, 19 Dec 2023 09:22:40 GMT content-length: 49 x-envoy-upstream-service-time: 1 server: ayl-lb-usa02 connection: close
2023-12-19 09:22:41 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.16	50684	23.227.146.18	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	598	OUT	GET /csync?t=a&ep=482928&extuid=72d68e79-f2f1-0102-0119-397345919658&traffic_source=snippet&session=14A0FC939D6A6483&sp=750078&pb=612004&c=656033&a=482928&domain=visitor.omnitagjs.com HTTP/1.1 Host: sync.spotim.market Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vmuid=36de1d8845678e06; a482928=72d68e79-f2f1-0102-0119-397345919658
2023-12-19 09:22:41 UTC	440	IN	HTTP/1.1 200 OK Server: Spotim Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif Content-Length: 43 Etag: 36de1d8845678e06 Set-Cookie: vmuid=36de1d8845678e06; expires=Mon, 19 Feb 2024 09:22:41 GMT; domain=.spotim.market; path=/; secure; SameSite=None Set-Cookie: a482928=72d68e79-f2f1-0102-0119-397345919658; expires=Mon, 19 Feb 2024 09:22:41 GMT; domain=.spotim.market; path=/; secure; SameSite=None Connection: close
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.16	50557	192.178.50.66	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	1418	OUT	GET /pcs/view?xai=AKAOjsuvvDURrCcXI7aV6goV8b-uA9eRZVCH44tm--EWzLxAeEx4KxRkaARYAcKm8H4h5x0Hnd42zl7nH0e0Q_Ky089jiNWn4M_9OwQF7jsJp__VRUpKmMMTxg7wtlBtzR1lnIPa0a2D4ESI0yQrPl9Wr6he6nA2FrL2OXedLiu-GNYlA7JldfuE3C9gmCpPJrfZqEez9mXInxhPZxOdCiGtil5n9lJ6rm_d7old3X_PPch5ON5qVbGKBNwJdPk-DrQsqTYBKyQzAiGQy1cn8DRaxhw92ObP6AhogaHDNDheadDPD-ASSJlw_F6xZyGhsk4X--5ncPsW5X_gZQcXvXALG9JTJgGpa1UzN8ODLJOm1tscrjqc7urPfVGISRwIY8uEa-66-l5LL7RCc3l_JcAtvajAVxVwhMQ0hYKIrw5Y7EuQKabuGpO5nXNOekYL_I0&sai=AMfl-YR-urUhOnXBd37m1V2gs903hnrryJ7vVqANCEilZp8B2CHRdv6kr2ZjL7_S2CVP9qHVXbr0fRw3nT0sYZbXZerNoxtrZWt6Cp3mVb_bG0dtOW19f_69MSfTjpoFmA&sig=Cg0ArKJSzMkZC0bWWBoAEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:42 UTC	792	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 09:22:41 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.16	50627	74.119.119.150	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	924	OUT	GET /dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP/1.1 Host: dis.criteo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uid=bcf55414-01bc-4254-873e-0589d6530dae
2023-12-19 09:22:42 UTC	531	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:40 GMT server: Kestrel cache-control: no-cache expires: Tue, 19 Dec 2023 00:00:00 GMT location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent= pragma: no-cache x-errorlevel: 0 p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" cross-origin-resource-policy: cross-origin server-processing-duration-in-ticks: 828694 strict-transport-security: max-age=31536000; preload; connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.16	50673	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	490	OUT	GET /crum?cm_dsp_id=130&external_user_id=AACk507LAsIAABM7-sg6gA&expiration=1704187350 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:42 UTC	986	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e9520ab5bda53-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:41 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:41 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WkEiBEduZFnp3PtlCpGsGJGF%2BwMFHKj0jnOnju0jq%2B5q31uRmbNCDkivDWvfrJVdSmOJDlgtBHsudDh9%2Fx8YsjJzzMbIwtyOQWTusDLpFqPLffvfHYaOEcEUbV%2B5bzKtvronk5HKRRmK9w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.16	50606	65.8.248.118	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	689	OUT	GET /profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQC4ZCY6-1I-JWAU HTTP/1.1 Host: sync.intentiq.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:41 UTC	1032	IN	HTTP/1.1 302 Content-Type: image/gif Content-Length: 43 Connection: close Date: Tue, 19 Dec 2023 09:22:41 GMT Set-Cookie: intentIQ=iE2ICWgiHo; Domain=.intentiq.com; Expires=Thu, 18 Dec 2025 09:22:41 GMT; Path=/; Secure; SameSite=None P3P: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC" Location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQC4ZCY6-1I-JWAU&ckls=true&ci=iE2ICWgiHo&nc=false&trid=-1077850458 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Patent: https://www.almondnet.com/ip Set-Cookie: IQver=1.9; Domain=.intentiq.com; Expires=Thu, 18 Dec 2025 09:22:41 GMT; Path=/; Secure; SameSite=None X-Cache: Miss from cloudfront Via: 1.1 d51c7bceca481ac0b07e2c48a718dfb6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C5 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: sVZkyiQ2HiWcdXMDDBwy6FHUuVvSEV_F6O589M6kecfgMWJL9rU2jw==
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.16	50563	34.200.69.89	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	671	OUT	GET /usersync/redirect?partner=rubicon&partnerId=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: exchange.mediavine.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:41 UTC	239	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Vary: Origin, Accept-Encoding Access-Control-Allow-Credentials: true Cache-Control: private, no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.16	50592	23.227.146.18	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	937	OUT	GET /csync?t=a&ep=281178&extuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&traffic_source=snippet&session=14A0FC939D6A6483&sp=750078&pb=612004&c=570607&a=281178&domain=visitor.omnitagjs.com HTTP/1.1 Host: sync.spotim.market Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vmuid=36de1d8845678e06; a482928=72d68e79-f2f1-0102-0119-397345919658
2023-12-19 09:22:41 UTC	440	IN	HTTP/1.1 200 OK Server: Spotim Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif Content-Length: 43 Etag: 36de1d8845678e06 Set-Cookie: vmuid=36de1d8845678e06; expires=Mon, 19 Feb 2024 09:22:41 GMT; domain=.spotim.market; path=/; secure; SameSite=None Set-Cookie: a281178=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; expires=Mon, 19 Feb 2024 09:22:41 GMT; domain=.spotim.market; path=/; secure; SameSite=None Connection: close
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.16	50664	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	466	OUT	GET /crum?cm_dsp_id=131&external_user_id=18072662089849815167 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:41 UTC	980	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e9520d8ebda8f-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:41 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:41 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aTVxJRe7KJH0ayz6PQnoyAW6Md56cMRgpiMC81J24zhHMQx8wvyFQ0nNZfEKtw9zI0oa6isZPgX3l5uge0ohZQuTESuADxWgGaiN%2Fni1wD52UindCiYvO5WPWhvNwg8KlxLAHggQNWa4Ww%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.16	50629	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	1356	OUT	GET /merge?pid=92&3pid=6663647625574893018&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:41 UTC	3067	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:41 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:41 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.16	50588	173.231.178.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	816	OUT	GET /bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP/1.1 Host: cm.adgrx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ADGRX_UID=251c4a36-9e50-11ee-a342-3aa302158eab; ADGRX_CM_PUBMATIC_BRIDGED=1
2023-12-19 09:22:41 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close server: Cowboy set-cookie: ADGRX_UID=251c4a36-9e50-11ee-a342-3aa302158eab; Version=1; Expires=Fri, 17-Jan-2025 09:22:41 GMT; Max-Age=34128000; Domain=.adgrx.com; Path=/; Secure; SameSite=None X-RealServer-NX: lga-delivery-3 Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate Pragma: no-cache Expires: Thu, 23 Sep 2004 17:42:04 GMT P3P: CP="NOI OTC OTP OUR NOR" Access-Control-Allow-Origin: *
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.16	50593	35.244.154.8	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	759	OUT	GET /1000.gif?memo=CPy7KxIwCiwIARCFpQoaJDVEQzM1ODM5LUZERjgtNENFOC1BNzVDLTA1QzA0RUVBQUI3RhAAGg0I3cGFrAYSBQjoBxAAQgBKAA HTTP/1.1 Host: idsync.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pxrc=CAA=; rlas3=6LzdEGUkCuawsId1Fg21eZ28T3wf8tQnMIZvDxAxAZU=
2023-12-19 09:22:42 UTC	751	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://pippio.com/api/sync?pid=5324&it=1&iv=e1e6e9ca5a3835d98a6158bd0159f65aaf47eec7d6aa31cf529966de7ef58217791426b5417dce21&_=2 P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=MHABhT+qp66wsId1Fg21eZ28T3wf8tQnMIZvDxAxAZU=; Path=/; Domain=rlcdn.com; Expires=Wed, 18 Dec 2024 09:22:41 GMT; Secure; SameSite=None Set-Cookie: pxrc=COHBhawGEgUI6AcQABIFCOhHEAA=; Path=/; Domain=rlcdn.com; Expires=Sat, 17 Feb 2024 09:22:41 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.16	50624	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	794	OUT	GET /rum?cm_dsp_id=65&external_user_id=AAAGUkmHgWjzvQM1zJFyAAAAAAA&expiration=1703064158&is_secure=true&us_privacy=1--- HTTP/1.1 Host: dsum.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:41 UTC	976	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e95217e9d8dfa-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:41 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:41 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0DXXtdguBd3QnnfAAWRRDR4CLE66RMCdHKfJ2bOjZJ%2BFF00lmEEM0eA4z4aHLv9ljSMwMzG8S1dj1u5i4NziDxe5qR3xfXEyxRIlPA4zBm%2BQc1EyCclYSB9%2B%2F9qhLwNlr2LfP%2Fd4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.16	50545	15.197.193.217	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	841	OUT	GET /track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=0&gdpr_consent= HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUYASAEKAIyCwjy-OmC2J_APBAFOAFaCHB1Ym1hdGljYAI.
2023-12-19 09:22:41 UTC	628	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Length: 233 Connection: close server: Kestrel location: https://onetag-sys.com/match/?int_id=29&uid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent= set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:41 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUYASABKAIyCwiu6eyC2Z_APBAFOAFaB3Z3Nml5cm5gAg..; expires=Thu, 19 Dec 2024 09:22:41 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:41 UTC	233	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 6e 65 74 61 67 2d 73 79 73 2e 63 6f 6d 2f 6d 61 74 63 68 2f 3f 69 6e 74 5f 69 64 3d 32 39 26 75 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 68 74 74 70 73 3a 2f 2f 6f 6e 65 74 61 67 2d 73 79 73 2e 63 6f 6d 2f 6d 61 74 63 68 2f 3f 69 6e 74 5f 69 64 3d 32 39 26 75 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://onetag-sys.com/match/?int_id=29&uid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent=">https://onetag-sys.com/match/?int_id=29&uid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent=</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.16	50680	3.213.224.199	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	452	OUT	GET /usersync?b=oth&i=y-SstFR3RE2pey1bTXUivUmXFmI8lWJgK8WXb.~A HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:41 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:41 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.16	50564	34.107.148.139	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	651	OUT	GET /setuid?bidder=rubicon&uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: prebid-s2s.media.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:42 UTC	673	IN	HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 set-cookie: uids=eyJ1aWRzIjp7fSwidGVtcFVJRHMiOnsicnViaWNvbiI6eyJ1aWQiOiJMUUM0WkNZNi0xSS1KV0FVIiwiZXhwaXJlcyI6IjIwMjQtMDEtMDJUMDk6MjI6NDEuNTU4MDUyNTgzWiJ9fSwiYmRheSI6IjIwMjMtMTItMTlUMDk6MjI6NDEuNTU3OTg0MTMzWiIsImhvc3RfdWlkcyI6e319; Max-Age=7776000; Expires=Mon, 18 Mar 2024 09:22:41 GMT; Path=/; Secure; SameSite=None content-type: image/png Content-Length: 86 x-envoy-upstream-service-time: 0 date: Tue, 19 Dec 2023 09:22:41 GMT server: envoy Via: 1.1 google Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Alt-Svc: clear Connection: close
2023-12-19 09:22:42 UTC	86	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 0d 49 44 41 54 08 99 63 60 60 60 60 00 00 00 05 00 01 87 a1 4e d4 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsBIT\|dIDATc````NIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.16	50578	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	3045	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=kD5c8C9HCfKvLTiX3mCBZQ HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; pi=159706:3; PugT=1702977757; SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0
2023-12-19 09:22:41 UTC	672	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:40 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:40 GMT; path=/ Set-Cookie: PugT=1702977760; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:40 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.16	50595	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	794	OUT	GET /usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEB4TS_wvGArfeqKKzVxPONU&google_cver=1 HTTP/1.1 Host: ssum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:41 UTC	988	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e95226f412594-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:41 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:41 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gW9DqY0cYHeylMUfsumMMwzr61miclezNJX2ZXW7Va%2B45KPeSXiyOX6Rd1tbJezazMvK5fJmYB%2Fo%2FuSJ6xm9WMZuQpd3L3Hn%2BZl6dhi9IEQN00rAL%2FxTvisMBb1emoSjOj6dqcjAIjt6wg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.16	50730	104.18.36.155	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	520	OUT	GET /usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEB4TS_wvGArfeqKKzVxPONU&google_cver=1 HTTP/1.1 Host: ssum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:41 UTC	982	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e9522ccdc4c04-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:41 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:41 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nTMiko6gfv92D71jgOt2LhW9GzliOiH2oOpAz26XZ4Hv8d1CXpXDRoZQ39PBV14Qh3KqEsK4owJ1ZTH4g4w%2FRtwbEV6oPMXrOFJVAkWes3YcGGhET3Q%2BBW5yyL8IoxZLSJNPxJo3YAANZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.16	50548	35.211.178.172	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	750	OUT	GET /sync?dsp_id=409&expires=14&user_group=1&user_id=717f049b-6e7a-4ed4-8020-58a3b807e659&ssp=fmx HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:41 UTC	531	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //ce.lijit.com/merge?pid=26&3pid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&us_privacy= Set-Cookie: custom_data=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: bsw_origin_init=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.16	50702	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	477	OUT	GET /crum?cm_dsp_id=90&external_user_id=230C3A6911DC4BB0ABF9299139F39B54 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:42 UTC	986	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e952309f6dae1-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:41 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:41 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5ZnkTrSXzBub46lM3yoLCYAmm05GH4iSZa%2BxP9ngLlZmnC0QumuU%2FFla27zkXD1a9SVVm3gfMOBJUB0slGRlcl4S8%2BInAEB8KZX%2BQBKwd7YGQBduBwBL9hHEL1zpE8d70innLFzSTmJ9JQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.16	50571	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	803	OUT	GET /ecm3?ex=pubmatic.com&id=PM_UID5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:41 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: CMHHE5XWMSECY88GZ9ZG Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.16	50612	35.186.193.173	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	861	OUT	GET /int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id] HTTP/1.1 Host: ipac.ctnsnet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cid_75ae24856eb84dc58191e0600d738e77=1
2023-12-19 09:22:41 UTC	649	IN	HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="NOI DSP COR NID CUR OUR NOR" Set-Cookie: cid=75ae24856eb84dc58191e0600d738e77; path=/; domain=.ctnsnet.com; expires=Wed, 18 Dec 2024 09:22:41 GMT; Secure; SameSite=None; Set-Cookie: cid_75ae24856eb84dc58191e0600d738e77=null; path=/; domain=.ctnsnet.com; expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure; SameSite=None; Pragma: no-cache Cache-Control: no-cache, must-revalidate Expires: Fri, 01 Jan 1990 00:00:00 GMT Content-Type: image/gif Content-Length: 43 Date: Tue, 19 Dec 2023 09:22:41 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.16	50662	51.222.39.185	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	456	OUT	GET /match/?int_id=98&gdpr=0&gdpr_consent=&uid=6663647625574893018 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:41 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:59; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.16	50625	104.18.36.155	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	469	OUT	GET /crum?cm_dsp_id=191&external_user_id=030284df-1cd5-54fc-52df3208 HTTP/1.1 Host: dsum.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:42 UTC	974	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e95237c9d6dd3-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:41 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:41 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Z10q9g7asbHtDalHshleS%2FL6xpgpTMK5FuT4ewN%2FAl9Mg2ZZ7iU%2BbVjeL6wvBvCIVFN4qlMxe5uTSEi%2BzSBmW65GAwdNtmCIp5FLI6xEwOof9KONAyqs8d5UEUWQ7JKzeNzjcjT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.16	50583	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	869	OUT	GET /usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7 HTTP/1.1 Host: sync.1rx.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D
2023-12-19 09:22:42 UTC	784	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:41 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%7D; path=/; expires=Wed, 18 Dec 2024 09:22:41 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://sync.targeting.unrulymedia.com/csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 connection: close
2023-12-19 09:22:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.16	50692	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	3058	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; pi=159706:3; SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0; PugT=1702977759
2023-12-19 09:22:42 UTC	780	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:41 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; domain=pubmatic.com; SameSite=None; secure; expires=Tue, 02-Jan-2024 09:22:41 GMT; path=/ Set-Cookie: PugT=1702977761; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:41 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.16	50621	34.233.75.175	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	521	OUT	GET /sync/pubmatic/5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F?gdpr=0&gdpr_consent= HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE
2023-12-19 09:22:42 UTC	778	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:41 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.16	50575	173.231.178.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	816	OUT	GET /bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP/1.1 Host: cm.adgrx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ADGRX_UID=251c4a36-9e50-11ee-a342-3aa302158eab; ADGRX_CM_PUBMATIC_BRIDGED=1
2023-12-19 09:22:41 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close server: Cowboy set-cookie: ADGRX_UID=251c4a36-9e50-11ee-a342-3aa302158eab; Version=1; Expires=Fri, 17-Jan-2025 09:22:41 GMT; Max-Age=34128000; Domain=.adgrx.com; Path=/; Secure; SameSite=None X-RealServer-NX: lga-delivery-3 Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate Pragma: no-cache Expires: Thu, 23 Sep 2004 17:42:04 GMT P3P: CP="NOI OTC OTP OUR NOR" Access-Control-Allow-Origin: *
2023-12-19 09:22:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.16	50667	142.250.189.130	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	639	OUT	GET /pixel?google_nid=rubicon&google_hm=M2Q2ZDU3NWQ1MzFmZGEzNDFmMzYzZmM3NmFlNTcwYjljZTk2MDQyOQ&gdpr=0&us_privacy=1--- HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:41 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/png Date: Tue, 19 Dec 2023 09:22:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Server: HTTP server (unknown) Content-Length: 170 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:41 UTC	170	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 d7 05 1d 0d 0d 2d 51 d5 37 6e 00 00 00 1d 74 45 58 74 43 6f 6d 6d 65 6e 74 00 43 72 65 61 74 65 64 20 77 69 74 68 20 54 68 65 20 47 49 4d 50 ef 64 25 6e 00 00 00 0d 49 44 41 54 08 d7 63 a8 69 79 e5 00 00 05 95 02 2b 03 a2 de f7 00 00 00 00 49 45 4e 44 ae 42 60 82 0a Data Ascii: PNGIHDRbKGDpHYstIME-Q7ntEXtCommentCreated with The GIMPd%nIDATciy+IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.16	50697	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	729	OUT	GET /s/75145?bidder_id=195755&bidder_uuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=ChAKBgjSARDiFgoGCKIBEOIW; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:41 UTC	577	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Length: 0 Connection: close Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0 Set-Cookie: _li_ss=ChcKBgjSARDiFgoGCKIBEOIWCgUIChDiFg; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:41 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:41 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 2 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.16	50671	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	2734	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHTMDn43-HvwMcUnSsAAAAAAA&expiration=1703064151&nuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&is_secure=true&gdpr_consent=&gdpr=0 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; pi=137711:4; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; SyncRTB3=1703808000%3A63%7C1705536000%3A224%7C1704153600%3A3_55_165_166_48_56_96_46_22_178_234_99_233_214_21_5_231_104_7_81_249_176_250_264_243_220_240_54_71_13_238_8%7C1703548800%3A223_15_2_38%7C1704240000%3A35%7C1708128000%3A69; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; PugT=1702977758
2023-12-19 09:22:42 UTC	708	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:02:15 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:02:15 GMT; path=/ Set-Cookie: PugT=1702940535; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:02:15 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:42 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.16	50681	3.213.224.199	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	448	OUT	GET /usersync?b=opx&i=bc35a5c6-637b-0abd-0dee-e98b0c9a5593 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:42 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:42 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.16	50665	51.222.39.185	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	438	OUT	GET /match/?int_id=2&uid=LQC4ZCY6-1I-JWAU&gdpr=0 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:42 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:40:59; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.16	50649	34.98.64.218	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	568	OUT	GET /w/1.0/sd?id=537072991&val=CAESELPt7UfyJF1YSMpdjYoT4B8&google_cver=1 HTTP/1.1 Host: us-u.openx.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK; univ_id=537072971\|134495f3-7e94-4262-b6f5-d7524e6fbdd7\|1702977751750893
2023-12-19 09:22:42 UTC	366	IN	HTTP/1.1 200 OK Vary: Accept Server: OXGW/0.0.0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Expires: Mon, 26 Jul 1997 05:00:00 GMT Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Cache-Control: private, max-age=0, no-cache Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.16	50591	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	902	OUT	GET /csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D186028%26nid%3D4112%26put%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%26expires%3D30%26us_privacy%3D1--- HTTP/1.1 Host: sync.targeting.unrulymedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D
2023-12-19 09:22:42 UTC	613	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:41 GMT content-type: text/html transfer-encoding: chunked set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:41 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&expires=30&us_privacy=1--- etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.16	50617	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	524	OUT	GET /dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZYFg02kDskXAcMABkyNPagAACu4AAAIB&gpp=&gpp_sid= HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:42 UTC	807	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: VEPQSB8N4WQ4NN2YNQMJ Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:41 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:41 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.16	50632	104.36.113.107	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:41 UTC	2454	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; PugT=1702941561; chkChromeAb67Sec=5; pi=156212:4; DPSync3=1703548800%3A252_265_253%7C1704153600%3A261_262_228_260_259_263_245_226_236_235_201%7C1703030400%3A255_248%7C1703894400%3A257%7C1704067200%3A258_256
2023-12-19 09:22:42 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:42 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.16	50546	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	853	OUT	GET /usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D
2023-12-19 09:22:42 UTC	761	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:42 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:42 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=8271700118 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.16	50630	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	1339	OUT	GET /merge?pid=80&3pid=LQC4ZCPI-1J-ELT2&gdpr=0 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:42 UTC	3064	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:42 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.16	50580	54.157.11.141	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	884	OUT	GET /ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP/1.1 Host: pm.w55c.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfivefivec=UzeiMh5u1Rfwja5
2023-12-19 09:22:42 UTC	773	IN	HTTP/1.1 302 Cache-Control: no-cache, must-revalidate Date: Tue, 19 Dec 2023 09:22:41 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:UzeiMh5u1Rfwja5&gdpr=0&gdpr_consent= Pragma: no-cache Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-001e04138de754858@us-east-1e@dxedge-app-us-east-1-prod-asg Set-Cookie: wfivefivec=UzeiMh5u1Rfwja5; Domain=.w55c.net; Expires=Sun, 19-Jan-2025 09:22:42 GMT; Path=/; SameSite=None; Secure Set-Cookie: matchpubmatic=5; Domain=.w55c.net; Expires=Thu, 18-Jan-2024 09:22:42 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.16	50691	192.184.68.215	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	795	OUT	GET /pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: cms.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: d=EFgBDQHZKt-owQA; mc=658160dc-8eeb9-895f2-d0e4b
2023-12-19 09:22:42 UTC	695	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Length: 0 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7 P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Pragma: no-cache Set-Cookie: d=EIQBEgHZKvijDejbEA; expires=Mon, 18-Mar-2024 09:22:42 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Strict-Transport-Security: max-age=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.16	50652	18.209.128.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	816	OUT	GET /pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:42 UTC	337	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Length: 0 Connection: close Server: Kestrel Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=1588db34-d26d-41ca-8110-e71bffc93ce8&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID}

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.16	50656	8.18.47.7	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	558	OUT	GET /usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D HTTP/1.1 Host: match.deepintent.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CDIUSER=di_979c85533fdc4607be2b6; CDIPARTNERS=%7B%221%22%3A%2220231219%22%2C%22143%22%3A%2220231219%22%7D
2023-12-19 09:22:42 UTC	674	IN	HTTP/1.1 303 See Other p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI' location: https://usersync.gumgum.com/usersync?b=dit&i=di_979c85533fdc4607be2b6 set-cookie: CDIUSER=di_979c85533fdc4607be2b6; Max-Age=47260800; SameSite=None; Expires=Wed, 18 Jun 2025 09:22:42 GMT; Domain=deepintent.com; Secure; Path=/ set-cookie: CDIPARTNERS=%7B%221%22%3A%2220231219%22%2C%22142%22%3A%2220231219%22%2C%22143%22%3A%2220231219%22%7D; Max-Age=47260800; SameSite=None; Expires=Wed, 18 Jun 2025 09:22:42 GMT; Domain=deepintent.com; Secure; Path=/ content-type: image/gif content-length: 0 date: Tue, 19 Dec 2023 09:22:41 GMT server: c connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.16	50723	34.233.75.175	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	544	OUT	GET /sync/casale/ZYFg02kDskXAcMABkyNPagAACu4AAAIB?gdpr_consent=&us_privacy=1---&gdpr=&gpp=&gpp_sid= HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE
2023-12-19 09:22:42 UTC	778	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:42 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.16	50623	104.18.25.173	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	905	OUT	GET /i.match?p=b10&u={rubicon_user_token}&redirect=https%3A//pixel.rubiconproject.com/tap.php%3Fv%3D111756%26nid%3D3856%26put%3D%24TF_USER_ID_ENC%24%26expires%3D180&gdpr=0&us_privacy=1--- HTTP/1.1 Host: a.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ANON_ID=aMnvBNR3YWj7UXuRu8rphZdE4WTZaZaEDQvYjPmERPNF0tHAA5CvWXsu4PFIemUJmP6K2wkAq9Nko0sDpOrByUTSAIfZc5Du5TdjNp4RipQtRIZba4xK4Spt8
2023-12-19 09:22:42 UTC	905	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 43 Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 302 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=awnxY1yOZbSFoJTyBrYuRxZaLeh561UutJPw2CyWQZcrWqsj4WDEd5GmASdAiVWY2mD5k59AwPZbWuXttFBGP9UYqZbDQGPZaYUoxZdjMHUnAxQonxAeatmQ6pymnYGbOubvB8FYjZcpLe60; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:42 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=awnxY1yOZbSFoJTyBrYuRxZaLeh561UutJPw2CyWQZcrWqsj4WDEd5GmASdAiVWY2mD5k59AwPZbWuXttFBGP9UYqZbDQGPZaYUoxZdjMHUnAxQonxAeatmQ6pymnYGbOubvB8FYjZcpLe60; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:42 GMT; CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 837e9525db0925e3-MIA alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 40 02 02 44 01 00 3b Data Ascii: GIF89a!,@D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.16	50677	104.26.3.70	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	350	OUT	GET /px.gif?ch=2 HTTP/1.1 Host: ad-delivery.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:42 UTC	1226	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-GUploader-UploadID: ABPtcPoneNYke7fO2kzH0x2YRcqOyFvMbvpKdkHDnNQbhurKfj2gEAJMTj8CoElGm6RQbaLonIYqKBdkTg x-goog-generation: 1620242732037093 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 43 x-goog-hash: crc32c=cpEfJQ== x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace Expires: Thu, 30 Nov 2023 08:00:14 GMT Cache-Control: public, max-age=86400 Age: 1646807 Last-Modified: Wed, 05 May 2021 19:25:32 GMT ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3" CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0yojT%2BsU6xgqfPysVj3cxCUO16PVQX3puFdYBO5fSdsANFC3tfntYtABArorgWpqnBQY1Ju558C0Zp97u6RbeJvTaROv8EkyHyjDKEvtn1mq3XiANmLrhwZr6DBRdNO3tA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 837e9525dc645d0e-MIA
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.16	50462	23.88.86.2	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	814	OUT	GET /sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID HTTP/1.1 Host: matching.truffle.bid Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:42 UTC	150	IN	HTTP/1.1 204 No Content Server: nginx/1.23.1 Date: Tue, 19 Dec 2023 09:22:42 GMT Connection: close Strict-Transport-Security: max-age=15768000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
647	192.168.2.16	50678	104.26.3.70	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	371	OUT	GET /px.gif?ch=1&e=0.5345028333417046 HTTP/1.1 Host: ad-delivery.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:42 UTC	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-GUploader-UploadID: ABPtcPoneNYke7fO2kzH0x2YRcqOyFvMbvpKdkHDnNQbhurKfj2gEAJMTj8CoElGm6RQbaLonIYqKBdkTg x-goog-generation: 1620242732037093 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 43 x-goog-hash: crc32c=cpEfJQ== x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace Expires: Thu, 30 Nov 2023 08:00:14 GMT Cache-Control: public, max-age=86400 Age: 1646807 Last-Modified: Wed, 05 May 2021 19:25:32 GMT ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3" CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5itOl%2FDXxzIT8b3%2FCPqG3vEY%2F3u0KcFNzki5gCo2WtO231epGbE6ZUNpGFNGdj%2FTyzz8NlraiYyBdywRwcCRPpja9%2F78H3AgbAR3S5TjsC5Xq42ZYAqsfrT%2F2mJNbcmvQw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 837e9525e87b09e2-MIA
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.16	50643	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	1347	OUT	GET /merge?pid=2&3pid=09884D8316F241D18C871E186061E89C HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:43 UTC	3079	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:42 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.16	50601	64.227.64.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	740	OUT	GET /pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.adsby.bidtheatre.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:43 UTC	517	IN	HTTP/1.1 302 302 Date: Tue, 19 Dec 2023 09:22:42 GMT Server: Apache P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT" Set-Cookie: __kuid=2233062b-d38a-4eaf-9e54-df74f8af0f43.472191762; Max-Age=604800; Domain=.adsby.bidtheatre.com; SameSite=None; Secure Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:2233062b-d38a-4eaf-9e54-df74f8af0f43&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.16	50616	104.36.113.107	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	2512	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEC26mZVWsxRGoE5JvegKkkg&google_cver=1 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; PugT=1702941561; chkChromeAb67Sec=5; pi=156212:4; DPSync3=1703548800%3A252_265_253%7C1704153600%3A261_262_228_260_259_263_245_226_236_235_201%7C1703030400%3A255_248%7C1703894400%3A257%7C1704067200%3A258_256
2023-12-19 09:22:42 UTC	669	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:40 GMT; path=/ Set-Cookie: PugT=1702977760; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:40 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:42 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.16	50585	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	2986	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:UzeiMh5u1Rfwja5&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; SyncRTB3=1703808000%3A63%7C1705536000%3A224%7C1704153600%3A3_55_165_166_48_56_96_46_22_178_234_99_233_214_21_5_231_104_7_81_249_176_250_264_243_220_240_54_71_13_238_8%7C1703548800%3A223_15_2_38%7C1704240000%3A35%7C1708128000%3A69; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; pi=159706:3; PugT=1702977757
2023-12-19 09:22:42 UTC	614	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:42 GMT; path=/ Set-Cookie: PugT=1702977762; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:42 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:42 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.16	50628	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	1373	OUT	GET /merge?pid=27&3pid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:42 UTC	3084	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:42 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.16	50626	34.98.64.218	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	584	OUT	GET /w/1.0/sd?id=540245193&val=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: us-u.openx.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK; univ_id=537072971\|134495f3-7e94-4262-b6f5-d7524e6fbdd7\|1702977751750893
2023-12-19 09:22:43 UTC	366	IN	HTTP/1.1 200 OK Vary: Accept Server: OXGW/0.0.0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Expires: Mon, 26 Jul 1997 05:00:00 GMT Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 43 Cache-Control: private, max-age=0, no-cache Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
654	192.168.2.16	50676	34.199.50.181	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	471	OUT	GET /api/v1/dsync/Martin?exid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: crb.kargo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ktcid=655d224e-6e9b-0d65-583b-6a0c46f32bd0
2023-12-19 09:22:42 UTC	456	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0 Expires: Thu, 01 Jan 1970 00:00:00 UTC Pragma: no-cache Set-Cookie: ktcid=655d224e-6e9b-0d65-583b-6a0c46f32bd0; Path=/; Domain=kargo.com; Expires=Wed, 18 Dec 2024 09:22:42 GMT; Max-Age=31536000; HttpOnly; Secure; SameSite=None Vary: Origin X-Accel-Expires: 0
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.16	50638	18.239.225.41	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	644	OUT	GET /adscores/g.pixel?sid=9212308278&puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: aa.agkn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:42 UTC	835	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Tue, 19 Dec 2023 09:22:42 GMT Server: AAWebServer P3P: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID" Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type Set-Cookie: ab=0001%3AYIYYZOLnj1EZ0h7fNI9vGFysXeEfOZj%2F; Path=/; Domain=.agkn.com; Expires=Thu, 19-Dec-2024 09:22:42 GMT; Max-Age=31536000; Secure; SameSite=None X-Cache: Miss from cloudfront Via: 1.1 5af319db9b3c24acf5b1e1c9d198ae7e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P8 X-Amz-Cf-Id: q2yRyuuQhNsFjHvQP_yvUgHFXNd2ONxPtBLmZJbrOL5xfMgX2jDoeg==
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.16	50734	130.211.23.194	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	347	OUT	GET /country HTTP/1.1 Host: api.btloader.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:42 UTC	300	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600 Content-Type: application/json Vary: Origin Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Length: 16 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:42 UTC	16	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"country":"US"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.16	50707	74.121.140.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	923	OUT	GET /sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP/1.1 Host: sync.mathtag.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid=7a2e6581-60d7-4800-933d-354f6ed2801e
2023-12-19 09:22:43 UTC	563	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Server: MT3 1237 600843f master iad iad-pixel-x30 config_version:"2575" Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= Expires: Tue, 19 Dec 2023 09:22:41 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.16	50619	34.111.113.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	783	OUT	GET /idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:43 UTC	1095	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:42 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:42 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:42 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:43 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.16	50636	51.222.39.185	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	494	OUT	GET /match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=72801ad7-cfff-40c4-85ce-2c79e9709f58 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:42 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:00; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.16	50699	54.224.142.7	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	1410	OUT	GET /sync?nid=11&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk
2023-12-19 09:22:42 UTC	304	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:42 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= Content-Length: 188 Connection: Close
2023-12-19 09:22:42 UTC	188	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 30 4d 7a 45 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 47 48 5f 4a 76 44 6a 38 56 6a 64 76 72 42 6c 4f 61 76 48 6d 70 32 61 42 6d 4e 51 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent=">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.16	50674	50.57.31.206	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	696	OUT	GET /pubmatic/1/info?sType=sync&sExtCookieId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&sInitiator=external&gdpr=0&gdpr_consent= HTTP/1.1 Host: uipglob.semasio.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:42 UTC	689	IN	HTTP/1.1 302 Found Location: /pubmatic/1/info2?sType=sync&sExtCookieId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&sInitiator=external&gdpr=0&gdpr_consent= UIP-Response-Status: Ok Frontend-ID: 14 Set-Cookie: SEUNCY=807AB52AB40D16D9; Expires=Wed, 18 Dec 2024 09:22:42 GMT; Path=/; Domain=.semasio.net; SameSite=None; HttpOnly; Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2011 12:00:00 GMT P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT" Pragma: no-cache Connection: close Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Length: 0 Routing-Server-ID: -1 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.16	50675	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:43 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:00; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.16	50727	54.224.142.7	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	1326	OUT	GET /sync?nid=50&gdpr=&gdpr_consent=&gdpr_pd=&ssp=krushmedia HTTP/1.1 Host: sync.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk
2023-12-19 09:22:42 UTC	254	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:42 GMT Location: https://x.bidswitch.net/sync?dsp_id=188&user_id=GH_JvDj8VjdvrBlOavHmp2aBmNQ&user_group=1&ssp=krushmedia Content-Length: 138 Connection: Close
2023-12-19 09:22:42 UTC	138	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 78 2e 62 69 64 73 77 69 74 63 68 2e 6e 65 74 2f 73 79 6e 63 3f 64 73 70 5f 69 64 3d 31 38 38 26 61 6d 70 3b 75 73 65 72 5f 69 64 3d 47 48 5f 4a 76 44 6a 38 56 6a 64 76 72 42 6c 4f 61 76 48 6d 70 32 61 42 6d 4e 51 26 61 6d 70 3b 75 73 65 72 5f 67 72 6f 75 70 3d 31 26 61 6d 70 3b 73 73 70 3d 6b 72 75 73 68 6d 65 64 69 61 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://x.bidswitch.net/sync?dsp_id=188&user_id=GH_JvDj8VjdvrBlOavHmp2aBmNQ&user_group=1&ssp=krushmedia">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.16	50745	23.20.118.237	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	502	OUT	GET /sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=5184721251378344538&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.sharethrough.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: stx_user_id=8e71ecfd-8285-4086-9d46-6047ffd70504
2023-12-19 09:22:42 UTC	320	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/png Content-Length: 68 Connection: close Set-Cookie: stx_user_id=8e71ecfd-8285-4086-9d46-6047ffd70504; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:42 GMT; Path=/; Domain=.sharethrough.com; Secure; SameSite=None Cache-Control: no-cache
2023-12-19 09:22:42 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0b 49 44 41 54 78 da 63 f8 ff 1f 00 03 00 01 ff 6f 81 ab b6 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxcoIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.16	50709	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	451	OUT	GET /ecm3?ex=index.com&id=ZYFg05BR8MuggUMSNtG2uQAABfYAAAIB HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:42 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: G2D2ET837YJZWPV5G4SM Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.16	50722	51.222.39.185	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	468	OUT	GET /match/?int_id=3&uid=9db4533c9ac65d1375943e865ca2281c&gdpr_consent=&gdpr=0 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:43 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:00; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.16	50672	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	523	OUT	GET /rum?cm_dsp_id=39&external_user_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&expiration=1705569752&gdpr=0&gdpr_consent= HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:42 UTC	984	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e95280a6609f6-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:42 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:42 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lxJAHjwgD35ujNGpJ9y8goojpt77al4yhvq65Bbi1Jy2R4nh%2Btnr6WB13qM3uf7WDWmyNXKATw5FAvE2yOKmUVpMY1E3h6rs4zEWU45oL%2F2%2FyMnQAADZwv3TqiG9OY1xxgCIFD95gPYssw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.16	50609	54.156.158.209	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	641	OUT	GET /?companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: io.narrative.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:42 UTC	391	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:42 GMT Location: https://io.narrative.io/?io.narrative.guid.v2=297e2810-9e50-11ee-b479-0e71178f036d&companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F Server: nginx/1.22.1 Set-Cookie: io.narrative.guid.v2=297e2810-9e50-11ee-b479-0e71178f036d; Max-Age=47278080; SameSite=None; Secure Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.16	50568	8.28.7.81	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	2630	OUT	GET /AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=48509963&p=156813&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image6.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; PugT=1702977757; pi=156813:4; DPSync3=1703030400%3A248_255%7C1703894400%3A257%7C1704153600%3A261_201_245_263_259_262_260%7C1704067200%3A256_258%7C1703548800%3A253_252_265; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224
2023-12-19 09:22:42 UTC	831	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=5; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: pi=156813:4; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:40 GMT Content-Length: 610 Connection: close
2023-12-19 09:22:42 UTC	610	IN	Data Raw: 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 69 6f 2e 6e 61 72 72 61 74 69 76 65 2e 69 6f 2f 3f 63 6f 6d 70 61 6e 79 49 64 3d 36 37 33 26 69 64 3d 70 75 62 6d 61 74 69 63 5f 69 64 3a 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 09 27 29 3b 50 75 62 4d 61 74 69 63 2e 6c 6f 61 64 41 73 79 6e 63 49 6d 61 67 65 50 69 78 65 6c 28 27 68 74 74 70 73 3a 2f 2f 61 2e 61 75 64 72 74 65 2e 63 6f 6d 2f 6d 61 74 63 68 3f 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 70 3d 4d 31 37 31 37 30 35 34 39 30 31 26 75 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 Data Ascii: PubMatic.loadAsyncImagePixel('https://io.narrative.io/?companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F');PubMatic.loadAsyncImagePixel('https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.16	50594	216.239.38.181	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	1578	OUT	POST /g/collect?v=2&tid=G-R5K71YRXMV&gtm=45je3bt0v877889940z86335967&_p=1702977735272&gcd=11l1l1l1l1&dma=0&tcfd=10000&cid=430166992.1702977739&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&_s=2&sid=1702977739&sct=1&seg=0&dl=https%3A%2F%2Fcaffeine.softonic.com.br%2F&dt=Caffeine%20-%20Download&en=di_request&ep.page_type=program_page&ep.site_language=pt&ep.google_click_id=&ep.test_variant=&ep.pv=undefined&ep.source_details=test&ep.suitable_campaigns=winzip-compression%2Cavast-backup%2Ccarbonate-browser%2Cnorton-secure-browser&ep.detected_country=US&_et=4&tfd=11954 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://caffeine.softonic.com.br X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:43 UTC	458	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://caffeine.softonic.com.br Date: Tue, 19 Dec 2023 09:22:42 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.16	50603	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	471	OUT	GET /ecm3?id=H2KyTBZHDmz9_ZgQSoi2z_V6&ex=sovrn.com&gdpr=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:43 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: B1Z22VPXR5VT69TPMB8X Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.16	50687	162.248.18.34	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	2608	OUT	GET /AdServer/SPug?partnerID=156078&xid=y-O5tWUOxE2uVdZ2jpuKv8kVzN9wV5VWw-~A&gdpr=0 HTTP/1.1 Host: image4.pubmatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; SyncRTB3=1703808000%3A63%7C1705536000%3A224%7C1704153600%3A3_55_165_166_48_56_96_46_22_178_234_99_233_214_21_5_231_104_7_81_249_176_250_264_243_220_240_54_71_13_238_8%7C1703548800%3A223_15_2_38%7C1704240000%3A35%7C1708128000%3A69; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; PugT=1702977758; pi=159706:3
2023-12-19 09:22:42 UTC	408	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:41 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: SPugT=1702977761; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:41 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.16	50728	142.250.217.164	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	764	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-20035800-1&cid=430166992.1702977739&jid=183335909&_u=YCDAgEABAAQCAGAAI~&z=189824434 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:43 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 19 Dec 2023 09:22:42 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:43 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.16	50631	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	503	OUT	GET /crum?cm_dsp_id=18&expiration=1718788950&external_user_id=ae8c4288-8303-465e-8690-01650b07f760 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:43 UTC	988	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e95284cad749e-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:42 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:42 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a8SzcHJc8LGMoXckBjquH1ND8qxbK4f59dFjYjhHOTLH7ZRj519zo%2B%2BwokYOkd%2B9Mbnt1Afapc66%2BC73hiDD%2BbQZOb4OBAU2gYZ92ugTcoxc6tWs8jb3IkLMYDIPS5psK0Wvlw76yDHPKA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.16	50696	35.163.115.57	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	792	OUT	GET /visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=595fce4a-490f-4f40-a00c-a7a6a90a5827&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT} HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:43 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:43 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.16	50642	44.231.162.210	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	577	OUT	GET /visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=6663647625574893018&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:43 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 5 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:43 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.16	50693	69.90.254.78	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	956	OUT	GET /tum?umid=6 HTTP/1.1 Host: ums.acuityplatform.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: auid=866838000893; aum=OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfuANvpCzEMlAUYgLCYelEQlAUYgLCYelEUh+/uGdmVyc2lvbsL7
2023-12-19 09:22:43 UTC	675	IN	HTTP/1.1 302 Found Content-Length: 0 Access-Control-Allow-Origin: * Set-Cookie: auid=866838000893; Domain=.acuityplatform.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Path=/; SameSite=None; Secure Set-Cookie: aum=OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfuANvpCzEMlAUYgLCcwvkQlAUYgLCcwvkUh+/uGdmVyc2lvbsL7; Domain=.acuityplatform.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Path=/; SameSite=None; Secure Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=866838000893
2023-12-19 09:22:43 UTC	956	OUT	GET /tum?umid=6 HTTP/1.1 Host: ums.acuityplatform.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: auid=866838000893; aum=OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfuANvpCzEMlAUYgLCYelEQlAUYgLCYelEUh+/uGdmVyc2lvbsL7
2023-12-19 09:22:43 UTC	675	IN	HTTP/1.1 302 Found Content-Length: 0 Access-Control-Allow-Origin: * Set-Cookie: auid=866838000893; Domain=.acuityplatform.com; Expires=Wed, 18-Dec-2024 09:22:43 GMT; Path=/; SameSite=None; Secure Set-Cookie: aum=OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAMvqNdXNlck1hdGNoaW5nSWTEkWxhc3REcm9wVGltZU1pbGxpcyUBRiAsJSq0mGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUYgLCUqtI90aGlyZFBhcnR5VXNlcklkIfuANvpCzEMlAUYgLCdKukQlAUYgLCdKukUh+/uGdmVyc2lvbsL7; Domain=.acuityplatform.com; Expires=Wed, 18-Dec-2024 09:22:43 GMT; Path=/; SameSite=None; Secure Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=866838000893

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.16	50641	44.231.162.210	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	568	OUT	GET /visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=6663647625574893018&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:42 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 5 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:42 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.16	50561	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	524	OUT	GET /dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZYFg05BR8MuggUMSNtG2uQAABfYAAAIB&gpp=&gpp_sid= HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:43 UTC	807	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: YNXJDQ45306MFBRYMQJN Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:42 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:42 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.16	50605	34.160.176.28	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	427	OUT	GET /?p_age=0&p_bld=mmm_irs_ppi_902_451_o&p_cpua=x64&p_edi=15&p_icar=1&p_lng=en&p_midex=726D6938F596EB31095491F80CE541D51FBFD7EC8A6C63350874DEA10459EBAC&p_ost=0&p_osv=10.0&p_pro=111&p_prod=avg-av&p_ram=8191&p_vbd=8700&p_vep=23&p_ves=12&p_vre=1355&repoid=release& HTTP/1.1 Host: shepherd.avcdn.net User-Agent: libcurl/8.2.1-DEV Schannel zlib/1.2.11 c-ares/1.19.0 nghttp2/1.48.0 Accept: / Accept-Encoding: deflate, gzip
2023-12-19 09:22:43 UTC	586	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: text/plain Content-Length: 661 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Config-Id, Config-Name, Config-Version, Segments, AB-Tests, TTL, TTL-Spread Config-Id: 41 Config-Name: Icarus_ipm-messaging-in-22.11-and-higher_avg-av-release_avg-av-c7bce9a6d6b3db5eaa365fd5b5ae5799414eec77b5c97d4625e7b80f1e86b31b Config-Version: 372 Segments: ipm messaging in 22.11 and higher,avg-av release,avg-av TTL: 86400 TTL-Spread: 43200 Via: 1.1 google Alt-Svc: clear Connection: close
2023-12-19 09:22:43 UTC	661	IN	Data Raw: 5b 75 69 2e 6f 66 66 65 72 2e 61 63 74 69 6f 6e 73 5d 0d 0a 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 69 70 6d 2e 61 76 63 64 6e 2e 6e 65 74 2f 0d 0a 5b 75 69 2e 6f 66 66 65 72 2e 77 65 6c 63 6f 6d 65 5d 0d 0a 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 69 70 6d 2e 61 76 63 64 6e 2e 6e 65 74 2f 0d 0a 5b 62 75 67 72 65 70 6f 72 74 5d 0d 0a 70 72 6f 64 75 63 74 5f 66 69 6e 69 73 68 65 64 5f 65 72 72 6f 72 73 3d 34 35 30 30 35 0d 0a 5b 63 6f 6d 6d 6f 6e 5d 0d 0a 63 6f 6e 66 69 67 2d 64 65 66 2d 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 68 65 70 68 65 72 64 2e 61 76 63 64 6e 2e 6e 65 74 2f 0d 0a 72 65 70 6f 72 74 2d 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 61 6e 61 6c 79 74 69 63 73 2e 61 76 63 64 6e 2e 6e 65 74 2f 76 34 2f 72 65 63 65 69 76 65 2f 6a 73 6f 6e 2f 32 35 0d 0a 5b 75 Data Ascii: [ui.offer.actions]url=https://ipm.avcdn.net/[ui.offer.welcome]url=https://ipm.avcdn.net/[bugreport]product_finished_errors=45005[common]config-def-url=https://shepherd.avcdn.net/report-url=https://analytics.avcdn.net/v4/receive/json/25[u

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.16	50640	44.231.162.210	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	546	OUT	GET /visitor/sync?name=SMILE_WANTED&ttl=720&uid=e77031af9e62c4ae76bee5b9517c4ef4&visitor=21b7e4500fc5676f49206403c549f2b8&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:42 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 2 X-Kong-Proxy-Latency: 1 Via: kong/2.8.3
2023-12-19 09:22:42 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.16	50742	3.213.224.199	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	431	OUT	GET /usersync?b=apn&i=6663647625574893018 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:42 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:42 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.16	50657	23.20.118.237	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	501	OUT	GET /sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: match.sharethrough.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: stx_user_id=8e71ecfd-8285-4086-9d46-6047ffd70504
2023-12-19 09:22:43 UTC	320	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/png Content-Length: 68 Connection: close Set-Cookie: stx_user_id=8e71ecfd-8285-4086-9d46-6047ffd70504; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:42 GMT; Path=/; Domain=.sharethrough.com; Secure; SameSite=None Cache-Control: no-cache
2023-12-19 09:22:43 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0b 49 44 41 54 78 da 63 f8 ff 1f 00 03 00 01 ff 6f 81 ab b6 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxcoIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.16	50737	159.89.246.130	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	461	OUT	GET /usersync?cn=5529&ttt=1&dpui=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: e.serverbid.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSUMABLEID=5dbd0af681dc4dc3bd0af681dc8dc33a
2023-12-19 09:22:43 UTC	462	IN	HTTP/1.1 200 OK access-control-allow-origin: * access-control-allow-headers: origin, content-type, accept access-control-allow-methods: GET, POST, OPTIONS access-control-max-age: 10080 content-type: image/gif content-length: 35 set-cookie: CONSUMABLEID=5dbd0af681dc4dc3bd0af681dc8dc33a; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:42 GMT; Path=/; Domain=.serverbid.com; Secure; SameSite=None date: Tue, 19 Dec 2023 09:22:42 GMT connection: close
2023-12-19 09:22:43 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.16	50756	35.172.99.217	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	787	OUT	GET /usersync?b=pbm&i=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:42 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:42 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.16	50600	35.186.193.173	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	899	OUT	GET /int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id] HTTP/1.1 Host: ipac.ctnsnet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cid_9e96bdcc99834ba48beda23b6dd70e67=1; cid=75ae24856eb84dc58191e0600d738e77
2023-12-19 09:22:42 UTC	649	IN	HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="NOI DSP COR NID CUR OUR NOR" Set-Cookie: cid=75ae24856eb84dc58191e0600d738e77; path=/; domain=.ctnsnet.com; expires=Wed, 18 Dec 2024 09:22:42 GMT; Secure; SameSite=None; Set-Cookie: cid_9e96bdcc99834ba48beda23b6dd70e67=null; path=/; domain=.ctnsnet.com; expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure; SameSite=None; Pragma: no-cache Cache-Control: no-cache, must-revalidate Expires: Fri, 01 Jan 1990 00:00:00 GMT Content-Type: image/gif Content-Length: 43 Date: Tue, 19 Dec 2023 09:22:42 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.16	50701	67.202.105.21	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	692	OUT	GET /ps/?xi=1&xu=LQC4ZCY6-1I-JWAU HTTP/1.1 Host: ssc-cms.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:42 UTC	672	IN	HTTP/1.1 302 p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" set-cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632; Domain=.33across.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Path=/; Secure; SameSite=None referrer-policy: unsafe-url pragma: no-cache cache-control: no-store, no-cache, must-revalidate expires: Thu, 01-Jan-70 00:00:01 GMT x-33x-status: 8000000008200000A server: 33XP014 location: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LQC4ZCY6-1I-JWAU&ts=1702977762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy= content-length: 0 date: Tue, 19 Dec 2023 09:22:42 GMT connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.16	50644	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	1339	OUT	GET /merge?pid=83&3pid=LQC4ZCY6-1I-JWAU&gdpr=0 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:42 UTC	3064	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:42 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:42 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.16	50700	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	3083	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968907273661960568 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0; PugT=1702977759; pi=0:4; DPSync3=1704067200%3A256_258%7C1703548800%3A265_253_252%7C1703894400%3A257%7C1704153600%3A262_263_236_235_228_201_260_226_245_259_261%7C1703030400%3A255_248; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; SPugT=1702942060
2023-12-19 09:22:42 UTC	673	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:32:41 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_18=22947-968907273661960568; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:32:41 GMT; path=/ Set-Cookie: PugT=1702942361; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:32:41 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.16	50724	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	3089	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:230C3A6911DC4BB0ABF9299139F39B54&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; pi=159706:3; PugT=1702977757; SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0
2023-12-19 09:22:42 UTC	404	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:42 GMT Transfer-Encoding: chunked Connection: close Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.16	50755	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	3127	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=trdyDQMND--pvQOH4GCBZQ HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0; pi=0:4; DPSync3=1704067200%3A256_258%7C1703548800%3A265_253_252%7C1703894400%3A257%7C1704153600%3A262_263_236_235_228_201_260_226_245_259_261%7C1703030400%3A255_248; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; PugT=1702940532; SPugT=1702977760
2023-12-19 09:22:43 UTC	672	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:42 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:42 GMT; path=/ Set-Cookie: PugT=1702977762; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:42 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.16	50659	44.193.120.159	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	657	OUT	GET /tag/?id=20909&user_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: bpi.rtactivate.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:42 UTC	140	IN	HTTP/1.1 200 OK Server: awselb/2.0 Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 43 Connection: close
2023-12-19 09:22:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.16	50660	195.244.31.10	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	513	OUT	GET /visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=134495f3-7e94-4262-b6f5-d7524e6fbdd7&name=THE_TRADE_DESK HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:42 UTC	465	IN	HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate content-type: image/gif expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff date: Tue, 19 Dec 2023 09:22:42 GMT content-length: 49 x-envoy-upstream-service-time: 4 server: ayl-lb-usa02 connection: close
2023-12-19 09:22:42 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.16	50739	8.28.7.84	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	2846	OUT	GET /AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage4.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; pi=159706:3; SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0; PugT=1702977759
2023-12-19 09:22:42 UTC	408	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:29:37 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: SPugT=1702942177; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:29:37 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.16	50658	18.209.128.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	893	OUT	GET /pbmtc.gif?puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=ade99547-e71c-4503-9f72-c309ae5a0c29; ss=Q5c%2By3QB7RuLCIcnuvkJXh2%2BVmmHH0BKTeDseY9vCvldIaoGPHgXs98TeAGrQ1P5656MMzqzU7HNmugPmqaZhQ%3D%3D
2023-12-19 09:22:43 UTC	440	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Type: image/gif Content-Length: 42 Connection: close Server: Kestrel Set-Cookie: UID=ade99547-e71c-4503-9f72-c309ae5a0c29; expires=Thu, 19 Dec 2024 09:22:42 GMT; path=/; secure; samesite=none Set-Cookie: ss=ci0qAEO7xtUHyUa8RhJW0HVTyGss2zns7JOr195roNuEewPNgTVwhipKnOM5BSCz9FdDZRu1huZBQvKcIt9S5Q%3D%3D; expires=Thu, 19 Dec 2024 09:22:42 GMT; path=/; secure; samesite=none
2023-12-19 09:22:43 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.16	50688	54.157.11.141	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	890	OUT	GET /ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP/1.1 Host: pm.w55c.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfivefivec=lif0y6A21Rfwjb5
2023-12-19 09:22:43 UTC	773	IN	HTTP/1.1 302 Cache-Control: no-cache, must-revalidate Date: Tue, 19 Dec 2023 09:22:42 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:lif0y6A21Rfwjb5&gdpr=0&gdpr_consent= Pragma: no-cache Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-001e04138de754858@us-east-1e@dxedge-app-us-east-1-prod-asg Set-Cookie: wfivefivec=lif0y6A21Rfwjb5; Domain=.w55c.net; Expires=Sun, 19-Jan-2025 09:22:42 GMT; Path=/; SameSite=None; Secure Set-Cookie: matchpubmatic=5; Domain=.w55c.net; Expires=Thu, 18-Jan-2024 09:22:42 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.16	50729	8.28.7.84	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	2838	OUT	GET /AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage4.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0; PugT=1702977759
2023-12-19 09:22:43 UTC	408	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:42 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: SPugT=1702977762; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:42 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.16	50746	23.83.76.73	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	515	OUT	GET /redir/?partnerid=104&partneruserid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: rtb-csync.smartadserver.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pid=5184721251378344538; csync=86:6663647625574893018\|127:AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:43 UTC	421	IN	HTTP/1.1 200 OK content-type: image/gif date: Tue, 19 Dec 2023 09:22:42 GMT cache-control: no-cache,no-store pragma: no-cache set-cookie: csync=86:6663647625574893018\|104:LQC4ZCY6-1I-JWAU\|127:AACk507LAsIAABM7-sg6gA; expires=Thu, 19 Dec 2024 09:22:43 GMT; domain=smartadserver.com; path=/; SameSite=None; secure transfer-encoding: chunked p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" connection: close
2023-12-19 09:22:43 UTC	54	IN	Data Raw: 32 42 0d 0a 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2BGIF89a!,D;0

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.16	50753	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	694	OUT	GET /match/?int_id=92&uid=y-HjSbKDBE2uGLVp3JXsBsqlttfjoBQA6yKJrnl2o-~A HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:43 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:01; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.16	50732	104.18.38.76	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	404	OUT	GET /ht/htw-pixel.gif?ZYFg02kDskXAcMABkyNPagAA%262798=&us_privacy=1--- HTTP/1.1 Host: cdn.indexww.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:43 UTC	484	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif Content-Length: 43 Connection: close Last-Modified: Tue, 24 Jan 2017 19:36:04 GMT ETag: "902a3d-2b-546dc3a097100" Cache-Control: public, max-age=86400 Expires: Wed, 20 Dec 2023 09:22:43 GMT Edge-Control: cache-maxage=1h P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" CF-Cache-Status: HIT Age: 2555 Accept-Ranges: bytes Server: cloudflare CF-RAY: 837e952affb67498-MIA
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.16	50653	54.239.33.158	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	493	OUT	GET /s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=5184721251378344538&gdpr=0&gdpr_consent= HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:43 UTC	807	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: 7CZ23YDFJA2Q5XVHBMFK Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:43 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:43 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
702	192.168.2.16	50689	162.248.18.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	2426	OUT	GET /AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP/1.1 Host: image8.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; pi=137711:4; DPSync3=1703894400%3A257%7C1703548800%3A253_252_265%7C1704067200%3A256_258%7C1704153600%3A263_260_201_259_245_261_262%7C1703030400%3A248_255; SyncRTB3=1704240000%3A35%7C1705536000%3A224%7C1704153600%3A48_165_233_240_250_231_21_71_176_96_214_243_13_264_56_3_104_8_5_7_22_166_55_46_238_54_220_234_99_81_178_249%7C1703808000%3A63%7C1703548800%3A223_38_15_2%7C1708128000%3A69; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553
2023-12-19 09:22:43 UTC	848	IN	HTTP/1.1 302 Found Cache-Control: private,max-age=86400 Content-Type: text/html; charset=utf-8 Location: https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: ipc=; domain=pubmatic.com; path=/; max-age=0; SameSite=None; secure; Set-Cookie: pi=159706:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=5; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:42 GMT Content-Length: 157 Connection: close
2023-12-19 09:22:43 UTC	157	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 6e 65 74 61 67 2d 73 79 73 2e 63 6f 6d 2f 6d 61 74 63 68 2f 3f 69 6e 74 5f 69 64 3d 31 31 34 26 61 6d 70 3b 67 64 70 72 3d 24 7b 47 44 50 52 7d 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 24 7b 47 44 50 52 5f 53 54 52 49 4e 47 7d 26 61 6d 70 3b 75 69 64 3d 35 44 43 33 35 38 33 39 2d 46 44 46 38 2d 34 43 45 38 2d 41 37 35 43 2d 30 35 43 30 34 45 45 41 41 42 37 46 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
703	192.168.2.16	50721	51.222.39.185	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:42 UTC	472	OUT	GET /match/?int_id=1&uid=7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= HTTP/1.1 Host: onetag-sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:43 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:01; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
704	192.168.2.16	50577	67.202.105.21	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	998	OUT	GET /ps?xi=64&xu=AAAMuYJiaSQd8gNFY4WpAAAAAAA&expiration=1703064158&is_secure=true&us_privacy= HTTP/1.1 Host: ssc-cms.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:44 UTC	683	IN	HTTP/1.1 302 p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" set-cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632; Domain=.33across.com; Expires=Wed, 18-Dec-2024 09:22:43 GMT; Path=/; Secure; SameSite=None referrer-policy: unsafe-url pragma: no-cache cache-control: no-store, no-cache, must-revalidate expires: Thu, 01-Jan-70 00:00:01 GMT x-33x-status: 8000000008200000A server: 33XP002 location: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAMuYJiaSQd8gNFY4WpAAAAAAA&ts=1702977763&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy= content-length: 0 date: Tue, 19 Dec 2023 09:22:42 GMT connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
705	192.168.2.16	50576	192.132.33.69	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	795	OUT	GET /pixel/cookiesyncredir?rurl=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D151%26user_id%3D%7Bglobalid%7D%26expires%3D30%26ssp=fmx HTTP/1.1 Host: bttrack.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: GLOBALID=2uKlc8-sIBd984cSkD72DtjK9bfIrLaH3EaccEUCHlhD8_uP_CjxhO295jvemgz1HpbM-824srMC4Q2
2023-12-19 09:22:43 UTC	585	IN	HTTP/1.1 302 Found Cache-Control: private,no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://x.bidswitch.net/sync?dsp_id=151&user_id=595fce4a-490f-4f40-a00c-a7a6a90a5827&expires=30&ssp=fmx Set-Cookie: GLOBALID=2uKlc8-sIBd984cSkD72DtjK9bfIrLaH3EaccEUCHlhD8_uP_CjxhO295jvemgz1HpbM-824srMC4Q2; domain=.bttrack.com; expires=Mon, 18-Mar-2024 09:21:58 GMT; path=/; secure; SameSite=None X-ServerName: Track002-iad Date: Tue, 19 Dec 2023 09:21:58 GMT Connection: close Content-Length: 232 Strict-Transport-Security: max-age=31536000;
2023-12-19 09:22:43 UTC	232	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 78 2e 62 69 64 73 77 69 74 63 68 2e 6e 65 74 2f 73 79 6e 63 3f 64 73 70 5f 69 64 3d 31 35 31 26 61 6d 70 3b 75 73 65 72 5f 69 64 3d 35 39 35 66 63 65 34 61 2d 34 39 30 66 2d 34 66 34 30 2d 61 30 30 63 2d 61 37 61 36 61 39 30 61 35 38 32 37 26 61 6d 70 3b 65 78 70 69 72 65 73 3d 33 30 26 61 6d 70 3b 73 73 70 3d 66 6d 78 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://x.bidswitch.net/sync?dsp_id=151&user_id=595fce4a-490f-4f40-a00c-a7a6a90a5827&expires=30&ssp=fmx">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
706	192.168.2.16	50604	34.117.223.223	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	244	OUT	POST /v4/receive/json/25 HTTP/1.1 Host: analytics.avcdn.net User-Agent: libcurl/8.2.1-DEV Schannel zlib/1.2.11 c-ares/1.19.0 nghttp2/1.48.0 Accept: / Accept-Encoding: deflate, gzip Content-Type: application/json Content-Length: 2017
2023-12-19 09:22:43 UTC	2017	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 0a 09 22 65 76 65 6e 74 22 20 3a 20 0a 09 7b 0a 09 09 22 72 65 71 75 65 73 74 5f 69 64 22 20 3a 20 22 39 34 63 36 34 36 34 33 2d 33 66 38 61 2d 34 35 33 62 2d 61 63 38 63 2d 64 35 63 32 64 31 35 30 35 62 30 31 22 2c 0a 09 09 22 73 75 62 74 79 70 65 22 20 3a 20 31 2c 0a 09 09 22 74 69 6d 65 22 20 3a 20 31 37 30 32 39 37 37 37 35 37 32 33 38 2c 0a 09 09 22 74 79 70 65 22 20 3a 20 32 35 0a 09 7d 2c 0a 09 22 69 64 65 6e 74 69 74 79 22 20 3a 20 0a 09 7b 0a 09 09 22 65 6e 64 70 6f 69 6e 74 5f 69 64 22 20 3a 20 22 65 36 66 31 36 38 38 33 2d 32 66 33 61 2d 34 61 63 30 2d 61 62 31 37 2d 33 66 34 37 64 64 37 33 38 33 61 63 22 2c 0a 09 09 22 66 69 6e 67 65 72 70 72 69 6e 74 22 20 3a 20 22 41 45 46 30 42 31 33 38 44 38 45 36 36 39 Data Ascii: {"record":[{"event" : {"request_id" : "94c64643-3f8a-453b-ac8c-d5c2d1505b01","subtype" : 1,"time" : 1702977757238,"type" : 25},"identity" : {"endpoint_id" : "e6f16883-2f3a-4ac0-ab17-3f47dd7383ac","fingerprint" : "AEF0B138D8E669
2023-12-19 09:22:44 UTC	216	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: application/json Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:44 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port
707	192.168.2.16	50775	195.244.31.10	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	509	OUT	GET /visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LQC4ZCY6-1I-JWAU&name=RUBICON&gdpr=0&us_privacy=1--- HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:43 UTC	465	IN	HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate content-type: image/gif expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff date: Tue, 19 Dec 2023 09:22:42 GMT content-length: 49 x-envoy-upstream-service-time: 1 server: ayl-lb-usa02 connection: close
2023-12-19 09:22:43 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
708	192.168.2.16	50717	34.200.65.202	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	828	OUT	GET /ups/58824/sync?_origin=0&dpid=58160&ovsid=LQC4ZCY6-1I-JWAU&gdpr=0&redir=true&us_privacy=1--- HTTP/1.1 Host: ups.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; IDSYNC="18z8~2fox:175w~2fox:18vk~2fox"
2023-12-19 09:22:43 UTC	812	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Length: 0 Strict-Transport-Security: max-age=31536000 Set-Cookie: IDSYNC="18z8~2fox:175w~2fox:18vk~2fox:19e0~2fox";Version=1;Domain=.analytics.yahoo.com;Path=/;Max-Age=31536000;Expires=Wed, 18-Dec-2024 09:22:43 GMT;Secure;SameSite=None P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Location: https://hb.yahoo.net/cksync?cs=63&axid_e=eS1TcXNQRUJaRTJ1RklZNjl3MHl1Rl9Ta2JqU3J6emMwcn5B&gdpr=0&ovsid=LQC4ZCY6-1I-JWAU&us_privacy=1---&dpid=58160 Age: 0 Connection: close Server: ATS/9.1.10.94 Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:43 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port
709	192.168.2.16	50733	142.250.217.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	349	OUT	GET /dot.gif?gdpr=0 HTTP/1.1 Host: s0.2mdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:44 UTC	718	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-doubleclick-media" Report-To: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} Content-Length: 43 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 19 Dec 2023 00:41:56 GMT Expires: Wed, 20 Dec 2023 00:41:56 GMT Cache-Control: public, max-age=86400 Age: 31247 Last-Modified: Sun, 01 Feb 2009 08:00:00 GMT Content-Type: image/gif Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
710	192.168.2.16	50735	34.111.113.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	578	OUT	GET /idsync/ex/receive?partner_id=1830&partner_device_id=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=2fbacb1a-cf7e-4185-bc55-8155b145136e%2C%2C HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:43 UTC	1101	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:43 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:43 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:43 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=1!8481;Expires=Sat, 17 Feb 2024 09:22:43 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:43 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
711	192.168.2.16	50757	192.184.68.215	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	795	OUT	GET /pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: cms.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: d=EFgBDQHZKt-owQA; mc=658160dc-8eeb9-895f2-d0e4b
2023-12-19 09:22:43 UTC	695	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Length: 0 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7 P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Pragma: no-cache Set-Cookie: d=EIQBEgHZKvijDejbEA; expires=Mon, 18-Mar-2024 09:22:43 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Strict-Transport-Security: max-age=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
712	192.168.2.16	50610	34.251.97.118	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	653	OUT	GET /match?gdpr=0&gdpr_consent=&p=M1717054901&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: a.audrte.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:43 UTC	1035	IN	HTTP/1.1 302 Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:43 GMT Location: https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=N2RnNWV2bDRqU2FTSXFkYzZUazlQR3NRZw==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%253D%253D%26gdpr%3D0%26gdpr_consent%3D Server: nginx/1.22.1 Set-Cookie: arcki2=7dg5evl4jSaSIqdc6Tk9PGsQg!20220908!1702977763191!ip#102.129.152.212; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:43 GMT; Domain=audrte.com; Path=/; Secure; HttpOnly; SameSite=none; Secure Set-Cookie: arcki2_pubmatic=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F!20220908!1702977763191; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:43 GMT; Domain=audrte.com; Path=/; Secure; HttpOnly; SameSite=none; Secure Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
713	192.168.2.16	50708	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	3072	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; pi=159706:3; PugT=1702977757; SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0
2023-12-19 09:22:43 UTC	800	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:19:26 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:19:26 GMT; path=/ Set-Cookie: PugT=1702941566; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:19:26 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
714	192.168.2.16	50679	35.190.90.30	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	562	OUT	GET /t/v2/sync?tagid=V2_790378&src.visitorId=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&ssp=gumgum2&gdpr=0&gdpr_consent= HTTP/1.1 Host: odr.mookie1.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: id=10595773663510815956; mdata=1\|10595773663510815956\|1702977753177; ov=518597ba867079cab9f2723332aab614
2023-12-19 09:22:43 UTC	884	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:43 GMT Server: Apache P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml" X-Application-Context: application Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: id=10595773663510815956; Domain=.mookie1.com; Expires=Fri, 17-Jan-2025 09:22:43 GMT; Path=/; SameSite=None; Secure Set-Cookie: mdata=1\|10595773663510815956\|1702977753177; Domain=.mookie1.com; Expires=Fri, 17-Jan-2025 09:22:43 GMT; Path=/; SameSite=None; Secure Set-Cookie: ov=518597ba867079cab9f2723332aab614; Domain=.mookie1.com; Expires=Fri, 17-Jan-2025 09:22:43 GMT; Path=/; SameSite=None; Secure Content-Type: image/gif;charset=UTF-8 Content-Length: 43 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
715	192.168.2.16	50720	51.222.39.185	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	492	OUT	GET /match/?gdpr=&gdpr_consent=%24%7BGDPR_STRING%7D&int_id=168&uid=OPUfcf5109a1a63427ca17f2e650a5ade17 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:43 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:01; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
716	192.168.2.16	50806	44.193.120.159	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	657	OUT	GET /tag/?id=20909&user_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: bpi.rtactivate.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:43 UTC	140	IN	HTTP/1.1 200 OK Server: awselb/2.0 Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif Content-Length: 43 Connection: close
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
717	192.168.2.16	50716	34.225.234.246	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	680	OUT	GET /qmap?c=240&tp=PUBM&tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _cc_cc=ctst
2023-12-19 09:22:43 UTC	314	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif Content-Length: 49 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.63.50 Access-Control-Allow-Origin: * Server: Jetty(9.4.38.v20210224)
2023-12-19 09:22:43 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port
718	192.168.2.16	50747	142.250.189.130	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	608	OUT	GET /pixel?google_nid=openx&google_hm=Njc2N2QyN2MtODIxOS02YzRmLTdmNzUtYTNkZjBlMjg5YWI1 HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:43 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/png Date: Tue, 19 Dec 2023 09:22:43 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Server: HTTP server (unknown) Content-Length: 170 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:43 UTC	170	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 d7 05 1d 0d 0d 2d 51 d5 37 6e 00 00 00 1d 74 45 58 74 43 6f 6d 6d 65 6e 74 00 43 72 65 61 74 65 64 20 77 69 74 68 20 54 68 65 20 47 49 4d 50 ef 64 25 6e 00 00 00 0d 49 44 41 54 08 d7 63 a8 69 79 e5 00 00 05 95 02 2b 03 a2 de f7 00 00 00 00 49 45 4e 44 ae 42 60 82 0a Data Ascii: PNGIHDRbKGDpHYstIME-Q7ntEXtCommentCreated with The GIMPd%nIDATciy+IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
719	192.168.2.16	50718	142.250.189.130	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	600	OUT	GET /pixel?google_nid=one_tag&google_hm=AAABjIFiRm47h951NLHqVLuP2oR_-XIHPuWRNw HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:43 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/png Date: Tue, 19 Dec 2023 09:22:43 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Server: HTTP server (unknown) Content-Length: 170 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:43 UTC	170	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 d7 05 1d 0d 0d 2d 51 d5 37 6e 00 00 00 1d 74 45 58 74 43 6f 6d 6d 65 6e 74 00 43 72 65 61 74 65 64 20 77 69 74 68 20 54 68 65 20 47 49 4d 50 ef 64 25 6e 00 00 00 0d 49 44 41 54 08 d7 63 a8 69 79 e5 00 00 05 95 02 2b 03 a2 de f7 00 00 00 00 49 45 4e 44 ae 42 60 82 0a Data Ascii: PNGIHDRbKGDpHYstIME-Q7ntEXtCommentCreated with The GIMPd%nIDATciy+IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
720	192.168.2.16	50713	3.213.224.199	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	469	OUT	GET /usersync?b=sta&i=0-187fc9bc-38fc-5637-6fac-194e6af1e6a7$ip$102.129.152.212 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:43 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:43 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
721	192.168.2.16	50769	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	1345	OUT	GET /merge?3pid=AACk507LAsIAABM7-sg6gA&pid=85&gdpr=0 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:44 UTC	3070	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:43 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:43 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:43 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:43 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:43 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
722	192.168.2.16	50795	34.117.239.71	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	854	OUT	GET /match?liv=h&us_privacy=&bidder_id=25&external_user_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: events-ssc.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:43 UTC	257	IN	HTTP/1.1 200 OK content-type: image/png cache-control: no-cache, no-store, max-age=0, must-revalidate Content-Length: 68 Date: Tue, 19 Dec 2023 09:22:43 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:43 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
723	192.168.2.16	50736	34.111.113.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	529	OUT	GET /idsync/ex/receive?partner_id=3355&partner_device_id=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:44 UTC	1095	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:43 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:43 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:43 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:43 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:44 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
724	192.168.2.16	50704	3.213.224.199	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	431	OUT	GET /usersync?b=sad&i=5184721251378344538 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:43 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:43 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
725	192.168.2.16	50683	52.0.247.215	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	602	OUT	GET /sync-iframe?redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DRISE_CODES%26ttl%3D720%26uid%3D48b439bcf2930e6408d6e795f7f1cdd2%26visitor%3D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: cs-server-s2s.yellowblue.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wrvUserID=u-mxFjSzkp_s
2023-12-19 09:22:43 UTC	642	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close access-control-allow-credentials: true access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE access-control-allow-origin: cs-server-s2s.yellowblue.io set-cookie: wrvUserID=u-mxFjSzkp_s; Path=/; Domain=.yellowblue.io; Expires=Thu, 18 Jan 2024 09:22:43 UTC; Max-Age=2592000; HttpOnly; SameSite=None; Secure x-envoy-upstream-service-time: 2 server: istio-envoy
2023-12-19 09:22:43 UTC	3027	IN	Data Raw: 62 63 63 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 73 63 2d 63 6d 73 2e 33 33 61 63 72 6f 73 73 2e 63 6f 6d 2f 70 73 2f 3f 72 69 3d 30 30 31 35 61 30 30 30 30 32 68 64 56 35 74 41 41 45 26 72 75 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 63 73 2d 73 65 72 76 65 72 2d 73 32 73 2e 79 65 6c 6c 6f 77 62 6c 75 65 2e 69 6f 25 32 46 63 73 25 33 46 61 69 64 25 33 44 31 31 35 38 30 25 32 36 70 75 69 64 25 33 44 33 33 58 55 53 45 52 49 44 33 33 58 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 2f 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 2e 79 69 65 6c 64 6d 6f 2e 63 6f 6d 2f 70 Data Ascii: bcc<html><head><title></title></head><body><img src="https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11580%26puid%3D33XUSERID33X" style="display:none;"/><img src="https://ads.yieldmo.com/p
2023-12-19 09:22:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
726	192.168.2.16	50754	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	3086	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; pi=159706:3; PugT=1702977757; SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0
2023-12-19 09:22:43 UTC	689	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:43 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:43 GMT; path=/ Set-Cookie: PugT=1702977763; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:43 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
727	192.168.2.16	50715	34.199.50.181	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	454	OUT	GET /api/v1/dsync/Rubicon?exid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: crb.kargo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ktcid=655d224e-6e9b-0d65-583b-6a0c46f32bd0
2023-12-19 09:22:43 UTC	456	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0 Expires: Thu, 01 Jan 1970 00:00:00 UTC Pragma: no-cache Set-Cookie: ktcid=655d224e-6e9b-0d65-583b-6a0c46f32bd0; Path=/; Domain=kargo.com; Expires=Wed, 18 Dec 2024 09:22:43 GMT; Max-Age=31536000; HttpOnly; Secure; SameSite=None Vary: Origin X-Accel-Expires: 0
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
728	192.168.2.16	50789	67.72.99.178	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	502	OUT	GET /w/user.sync?ptrid=14&userid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: match.sync.ad.cpe.dotomi.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: DotomiTest=394be2998dfe10ff; DotomiUser=718507358754739980$3$501652885$$1
2023-12-19 09:22:43 UTC	744	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-cache Pragma: no-cache Expires: 0 Accept-CH: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Set-Cookie: DotomiUser=718507358754739980$3$501652885$$1; Expires=Wed, 15 Jan 2025 09:22:43 GMT; Path=/; Domain=.dotomi.com; SameSite=None; Secure Set-Cookie: UP=718507358754739980$3$501652885$$1; Expires=Wed, 18 Dec 2024 09:22:43 GMT; Path=/; Domain=.dotomi.com; Secure; HTTPOnly; SameSite=None; Partitioned Set-Cookie: receive-cookie-deprecation=1; Expires=Wed, 18 Dec 2024 09:22:43 GMT; Path=/; Domain=.dotomi.com; Secure; HTTPOnly; SameSite=None; Partitioned
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
729	192.168.2.16	50763	142.250.217.164	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	1319	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=normal&s=Y5pDg2JnqBHv5hm8ocrLBcGihlxa84Gvmbnw2NCDxhvj7nwAkjTgEp8nImgXSh2unZ-Pn5ovzrhVs24egQXvk69pRWRr0W1dpCJ0jxlefq3Lg8j7mAmnD1o-a2ch4TJcsVGyvXVcGP2b-WcGQ4WLOqqNbHRrq16CiIiNreJwMSm61HzNbYB5xfRw840wumuXWDCXD59Wvp2aR04Zot5D8zw5xq3Evcl_MMaUj5we0WFyWXndmchJd3LY8j_xA1geo5Hxo4I_U9rfG3qmt7XJWgTYglKno0s&cb=b81swjp7dfou Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:43 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Tue, 19 Dec 2023 09:22:43 GMT Date: Tue, 19 Dec 2023 09:22:43 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:43 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 75 2d 78 63 71 33 50 4f 43 57 46 6c 43 72 33 78 38 5f 49 50 78 67 50 75 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js');
2023-12-19 09:22:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
730	192.168.2.16	50743	34.111.113.62	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	547	OUT	GET /idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:44 UTC	1095	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:43 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:43 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:43 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:43 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:44 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
731	192.168.2.16	50778	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	3152	OUT	GET /AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0; pi=0:4; DPSync3=1704067200%3A256_258%7C1703548800%3A265_253_252%7C1703894400%3A257%7C1704153600%3A262_263_236_235_228_201_260_226_245_259_261%7C1703030400%3A255_248; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; SPugT=1702942060; KRTBCOOKIE_18=22947-968907273661960568; PugT=1702940532
2023-12-19 09:22:43 UTC	851	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:31:38 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:31:38 GMT; path=/ Set-Cookie: PugT=1702942298; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:31:38 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
732	192.168.2.16	50703	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	732	OUT	GET /match/?int_id=149&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=xHDGeFAGG4q9&ev=1&us_privacy=&pid=562985 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:43 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:01; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
733	192.168.2.16	50731	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	479	OUT	GET /ecm3?id=LQC4ZCY6-1I-JWAU&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1--- HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:43 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: JD74SYNVS10CQV2SA31V Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
734	192.168.2.16	50776	44.231.162.210	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	543	OUT	GET /visitor/sync?name=ZEMANTA_BANNER&ttl=720&uid=bdef6bd95b7450b4e62a32db8c7d8c9d&visitor=aXQaOqrGBGrZCZrdEc4x&gdpr=0&gdpr_consent=&gdpr=0 HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:43 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:43 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
735	192.168.2.16	50812	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	729	OUT	GET /s/75145?bidder_id=195755&bidder_uuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=ChAKBgjSARDiFgoGCKIBEOIW; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:44 UTC	577	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Length: 0 Connection: close Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0 Set-Cookie: _li_ss=ChcKBgjSARDiFgoGCKIBEOIWCgUIChDiFg; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:43 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:43 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 3 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port
736	192.168.2.16	50764	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	2802	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=866838000893 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; PugT=1702941561; chkChromeAb67Sec=5; pi=156212:4; DPSync3=1703548800%3A252_265_253%7C1704153600%3A261_262_228_260_259_263_245_226_236_235_201%7C1703030400%3A255_248%7C1703894400%3A257%7C1704067200%3A258_256
2023-12-19 09:22:44 UTC	600	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:30:41 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:30:41 GMT; path=/ Set-Cookie: PugT=1702942241; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:30:41 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:44 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
737	192.168.2.16	50740	8.28.7.84	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	2838	OUT	GET /AdServer/SPug?partnerID=156813&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage4.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0; PugT=1702977759
2023-12-19 09:22:43 UTC	408	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:43 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: SPugT=1702977763; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:43 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
738	192.168.2.16	50817	74.119.119.150	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	924	OUT	GET /dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP/1.1 Host: dis.criteo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uid=bcf55414-01bc-4254-873e-0589d6530dae
2023-12-19 09:22:43 UTC	532	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:43 GMT server: Kestrel cache-control: no-cache expires: Tue, 19 Dec 2023 00:00:00 GMT location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent= pragma: no-cache x-errorlevel: 0 p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" cross-origin-resource-policy: cross-origin server-processing-duration-in-ticks: 1208644 strict-transport-security: max-age=31536000; preload; connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
739	192.168.2.16	50712	142.250.189.130	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	603	OUT	GET /pixel?google_nid=lijit_dbm&google_hm=SDJLeVRCWkhEbXo5X1pnUVNvaTJ6X1Y2&gdpr=0 HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:43 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/png Date: Tue, 19 Dec 2023 09:22:43 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Server: HTTP server (unknown) Content-Length: 170 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:43 UTC	170	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 d7 05 1d 0d 0d 2d 51 d5 37 6e 00 00 00 1d 74 45 58 74 43 6f 6d 6d 65 6e 74 00 43 72 65 61 74 65 64 20 77 69 74 68 20 54 68 65 20 47 49 4d 50 ef 64 25 6e 00 00 00 0d 49 44 41 54 08 d7 63 a8 69 79 e5 00 00 05 95 02 2b 03 a2 de f7 00 00 00 00 49 45 4e 44 ae 42 60 82 0a Data Ascii: PNGIHDRbKGDpHYstIME-Q7ntEXtCommentCreated with The GIMPd%nIDATciy+IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
740	192.168.2.16	50781	3.233.88.120	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	427	OUT	GET /cs?aid=11590&id=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: cs.yellowblue.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wrvUserID=u-mxFjSzkp_s
2023-12-19 09:22:44 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: application/javascript Content-Length: 0 Connection: close access-control-allow-credentials: true access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE access-control-allow-origin: cs.yellowblue.io x-envoy-upstream-service-time: 1 server: istio-envoy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
741	192.168.2.16	50714	195.244.31.10	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	551	OUT	GET /visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-187fc9bc-38fc-5637-6fac-194e6af1e6a7$ip$102.129.152.212&name=STACKADAPT&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:43 UTC	465	IN	HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate content-type: image/gif expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff date: Tue, 19 Dec 2023 09:22:43 GMT content-length: 49 x-envoy-upstream-service-time: 5 server: ayl-lb-usa02 connection: close
2023-12-19 09:22:43 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
742	192.168.2.16	50695	52.7.115.91	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	931	OUT	GET /cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=syn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=5184721251378344538&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: bitoIsSecure=ok; checkForPermission=ok; bito=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:44 UTC	652	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:43 GMT location: https://sync.technoratimedia.com/services?uid=AACk507LAsIAABM7-sg6gA&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26userid%3D5184721251378344538%26gdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4&gdpr=0 Server: gunicorn set-cookie: bito=AACk507LAsIAABM7-sg6gA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:43 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
743	192.168.2.16	50698	35.236.220.17	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	873	OUT	GET /pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: um.simpli.fi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: suid=230C3A6911DC4BB0ABF9299139F39B54
2023-12-19 09:22:44 UTC	723	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: text/html Content-Length: 142 Connection: close Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:230C3A6911DC4BB0ABF9299139F39B54&gdpr=0&gdpr_consent= Expires: Mon, 18 Dec 2023 09:22:43 GMT Cache-Control: no-cache Strict-Transport-Security: max-age=63072000; includeSubdomains; preload X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
2023-12-19 09:22:44 UTC	142	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
744	192.168.2.16	50780	35.211.178.172	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	1001	OUT	GET /sync?dsp_id=250&expires=14&user_id=5aea8bca-e090-4802-94d3-585fd3816e26&ssp=the33across HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:44 UTC	514	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //ssc-cms.33across.com/ps/?xi=10&us_privacy=&xu=132eab48-61bf-4eaf-9a69-4fb4f080c8bc Set-Cookie: custom_data=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: bsw_origin_init=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port
745	192.168.2.16	50711	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	869	OUT	GET /usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7 HTTP/1.1 Host: sync.1rx.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D
2023-12-19 09:22:44 UTC	784	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:43 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%7D; path=/; expires=Wed, 18 Dec 2024 09:22:43 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://sync.targeting.unrulymedia.com/csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 connection: close
2023-12-19 09:22:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
746	192.168.2.16	50777	3.84.70.71	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	404	OUT	GET /cs?aid=21479&id=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: cs.minutemedia-prebid.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:44 UTC	488	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: application/javascript Content-Length: 0 Connection: close access-control-allow-credentials: true access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE access-control-allow-origin: cs.minutemedia-prebid.com x-envoy-upstream-service-time: 0 server: istio-envoy

Session ID	Source IP	Source Port	Destination IP	Destination Port
747	192.168.2.16	50772	3.213.224.199	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	439	OUT	GET /usersync?b=zem&i=aXQaOqrGBGrZCZrdEc4x&gdpr=0 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:44 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:44 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
748	192.168.2.16	50833	54.224.142.7	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	1410	OUT	GET /sync?nid=11&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id=s%3A0-187fc9bc-38fc-5637-6fac-194e6af1e6a7.WWICBVLsoQq2IAaYFNMPHmZi8hDvvltbBOTIA0lo4tE; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v2=s%3AGH_JvDj8VjdvrBlOavHmp2aBmNQ.83KQRyNnoCL7%2FW6r%2FMDW6GAtSBq46Jm2qIWzfZJdWRc; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk; sa-user-id-v3=s%3AAQAKIPrL7SANV8TAAVpJbKeV0qhL8pXca8nhssXL_Z8qbymuEHwYBCDZwYWsBjABOgT87-jmQgS4DnVW.qCvJuFj2WaZTNMCBA%2B5b9aDdhMLMEoyQx%2FVvUYOAaxk
2023-12-19 09:22:44 UTC	304	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 19 Dec 2023 09:22:44 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= Content-Length: 188 Connection: Close
2023-12-19 09:22:44 UTC	188	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 30 4d 7a 45 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 47 48 5f 4a 76 44 6a 38 56 6a 64 76 72 42 6c 4f 61 76 48 6d 70 32 61 42 6d 4e 51 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent=">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
749	192.168.2.16	50765	18.209.128.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	816	OUT	GET /pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:44 UTC	337	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Length: 0 Connection: close Server: Kestrel Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=ba980058-5caf-45f8-a0d5-453c01d53d44&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID}

Session ID	Source IP	Source Port	Destination IP	Destination Port
750	192.168.2.16	50802	3.213.224.199	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:43 UTC	448	OUT	GET /usersync?b=vnt&i=92ceaf34-27c5-4c21-b9d3-66c038610988 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:44 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:44 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
751	192.168.2.16	50805	104.18.36.155	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	520	OUT	GET /usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEB4TS_wvGArfeqKKzVxPONU&google_cver=1 HTTP/1.1 Host: ssum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:44 UTC	984	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e9531887f2876-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:44 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:44 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2cUuGgbT1GSzi2cRznoOGPK5iBP6rY7sKNGcNdByOuJAbuR4qZKiUlMIwE9yQo4UNd8ArywCUd4po3CcUKrsCnNV8wb%2BU2uFoOFYy07GOK1ZOYBMqIUN%2BGhHG%2F6tQOzk9PeNg1Lb5eZkuw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
752	192.168.2.16	50738	34.117.239.71	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	1043	OUT	GET /match?bidder_id=99&external_user_id=y-U79fYvJE2uFwP3YGnrrUbmjtr2kCJLYH%7EA&ts=1702977757&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1 Host: events-ssc.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:44 UTC	257	IN	HTTP/1.1 200 OK content-type: image/png cache-control: no-cache, no-store, max-age=0, must-revalidate Content-Length: 68 Date: Tue, 19 Dec 2023 09:22:44 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:44 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
753	192.168.2.16	50790	34.98.64.218	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	630	OUT	GET /w/1.0/sd?id=537072971&val=134495f3-7e94-4262-b6f5-d7524e6fbdd7&ttd_puid=4b0801b6-4b6e-32eb-6a95-f966c4ca54d5&gdpr=0&gdpr_consent= HTTP/1.1 Host: us-u.openx.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK; univ_id=537072971\|134495f3-7e94-4262-b6f5-d7524e6fbdd7\|1702977751750893
2023-12-19 09:22:44 UTC	568	IN	HTTP/1.1 200 OK Vary: Accept Set-Cookie: univ_id=537072971\|134495f3-7e94-4262-b6f5-d7524e6fbdd7\|1702977764122215; Version=1; Expires=Wed, 03-Jan-2024 09:22:44 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None Server: OXGW/0.0.0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Expires: Mon, 26 Jul 1997 05:00:00 GMT Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Cache-Control: private, max-age=0, no-cache Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
754	192.168.2.16	50799	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:44 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:02; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
755	192.168.2.16	50864	13.32.87.97	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	452	OUT	GET /userPixel/sync?partner=rubicon&uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: usr.undertone.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID_EXT_47=LQC4ZCY6-1I-JWAU
2023-12-19 09:22:44 UTC	422	IN	HTTP/1.1 200 Content-Length: 0 Connection: close Date: Tue, 19 Dec 2023 09:22:44 GMT Set-Cookie: UID_EXT_47=LQC4ZCY6-1I-JWAU; Path=/; Domain=undertone.com; Expires=Wed, 18-Dec-2024 15:11:56 GMT; SameSite=None; Secure; X-Cache: Miss from cloudfront Via: 1.1 a849aab265796f3b1c80dee87a056b44.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: JZ0amYydHmqrddUPp1wVWMfqfOu-GQlMupDf3ADVNP3q5alp-Ek8yg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
756	192.168.2.16	50828	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	3048	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1704067200%3A256_258%7C1703548800%3A265_253_252%7C1703894400%3A257%7C1704153600%3A262_263_236_235_228_201_260_226_245_259_261%7C1703030400%3A255_248; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; SPugT=1702977760; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; ipc=0^^0^0; pi=0:3; PugT=1702940535
2023-12-19 09:22:44 UTC	780	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:43 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; domain=pubmatic.com; SameSite=None; secure; expires=Tue, 02-Jan-2024 09:22:43 GMT; path=/ Set-Cookie: PugT=1702977763; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:43 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
757	192.168.2.16	50794	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	3249	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968907273661960568 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; PugT=1702942361; SPugT=1702977762; pi=159706:3
2023-12-19 09:22:44 UTC	582	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_18=22947-968907273661960568; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:43 GMT; path=/ Set-Cookie: PugT=1702977763; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:43 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:44 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
758	192.168.2.16	50791	13.32.87.73	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	482	OUT	GET /syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: synchroscript.deliveryengine.adswizz.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:44 UTC	311	IN	HTTP/1.1 200 OK Server: CloudFront Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Length: 0 Connection: close X-Cache: Error from cloudfront Via: 1.1 3b6959d147738fd4bde35db4104f4052.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C1 X-Amz-Cf-Id: OLxwDUwSIs034JKxkJBF67b47dsViNApDGMqSguo7RcXZWN7g-gmOQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
759	192.168.2.16	50798	65.8.248.42	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	780	OUT	GET /profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQC4ZCY6-1I-JWAU&ckls=true&ci=iE2ICWgiHo&nc=false&trid=-1077850458 HTTP/1.1 Host: sync1.intentiq.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: intentIQ=iE2ICWgiHo; IQver=1.9
2023-12-19 09:22:44 UTC	1333	IN	HTTP/1.1 200 Content-Type: image/gif Content-Length: 43 Connection: close Date: Tue, 19 Dec 2023 09:22:44 GMT Set-Cookie: IQPData=1719769300#1702977764255#0#1702977764255; Domain=.intentiq.com; Expires=Thu, 18 Dec 2025 09:22:44 GMT; Path=/; Secure; SameSite=None P3P: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: ASDT=0; Domain=.intentiq.com; Expires=Thu, 18 Dec 2025 09:22:44 GMT; Path=/; Secure; SameSite=None Set-Cookie: IQver=1.9; Domain=.intentiq.com; Expires=Thu, 18 Dec 2025 09:22:44 GMT; Path=/; Secure; SameSite=None Set-Cookie: intentIQCDate=1702977764256; Domain=.intentiq.com; Expires=Thu, 18 Dec 2025 09:22:44 GMT; Path=/; Secure; SameSite=None Set-Cookie: intentIQ=iE2ICWgiHo; Domain=.intentiq.com; Expires=Thu, 18 Dec 2025 09:22:44 GMT; Path=/; Secure; SameSite=None Set-Cookie: CSDT=UEQ6MTUxMDZfMCZUeXNMOUNV; Domain=.intentiq.com; Expires=Thu, 18 Dec 2025 09:22:44 GMT; Path=/; Secure; SameSite=None Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT X-Cache: Miss from cloudfront Via: 1.1 eeadef659c82cd26db15c4babc8854ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C5 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: HpbIYoQ2MFljlUOCDStq_IhXH9Ik3y9JqKjxublrBvi1UL81ExoKkQ==
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
760	192.168.2.16	50788	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	486	OUT	GET /crum?cm_dsp_id=45&external_user_id=CAESEHn_Pd_rrAcqXrT5_bqGfnQ&google_cver=1 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:44 UTC	990	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e95324ede8e06-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:44 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:44 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bOA9jrnowAT1gGNZYU0%2FWQE%2FSGsaYF9I%2F389pLVevq%2BCR6Ilpw393Bl7yctJKm92WV7eGkd9YSAcuj%2Ff5Lvxzo%2BZG0kWB63mw9LdD6zcxc2soSCI9ANof9VzRj6eBVqQCOMBhS59tw0uOQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
761	192.168.2.16	50831	35.214.128.77	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	819	OUT	GET /?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token} HTTP/1.1 Host: csync.loopme.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port
762	192.168.2.16	50786	34.107.140.113	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	554	OUT	GET /setuid?bidder=rubicon&uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: s2s.t13.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uids=eyJ1aWRzIjp7fSwidGVtcFVJRHMiOnsicnViaWNvbiI6eyJ1aWQiOiJMUUM0WkNZNi0xSS1KV0FVIiwiZXhwaXJlcyI6IjIwMjQtMDEtMDJUMDk6MjI6MzcuMDcxMzQ4NTYzWiJ9fX0=
2023-12-19 09:22:44 UTC	518	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Set-Cookie: uids=eyJ1aWRzIjp7fSwidGVtcFVJRHMiOnsicnViaWNvbiI6eyJ1aWQiOiJMUUM0WkNZNi0xSS1KV0FVIiwiZXhwaXJlcyI6IjIwMjQtMDEtMDJUMDk6MjI6NDQuMjU2MjEzOVoifX19; Max-Age=7776000; Expires=Mon, 18 Mar 2024 09:22:44 GMT; Path=/; Secure; SameSite=None content-type: image/png Content-Length: 86 Date: Tue, 19 Dec 2023 09:22:44 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:44 UTC	86	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 0d 49 44 41 54 08 99 63 60 60 60 60 00 00 00 05 00 01 87 a1 4e d4 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsBIT\|dIDATc````NIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
763	192.168.2.16	50748	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	1479	OUT	GET /merge?pid=87&3pid=5aea8bca-e090-4802-94d3-585fd3816e26 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV
2023-12-19 09:22:44 UTC	2749	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:44 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJw9kEtrAjEQx7%2FLnjuQxzyS3rIxK1oLbdUWvRmz2YNQEL1I6Xdv9tLb8Ps%2FmJmfznTPnbd9RO6DDlGhS9zbISXPyi6UCSlh99Rpbj72XlVTC3itRsBzreBIdJvySSuveKwZmJxmVQiIyLYk%2Bpbcr9Xybrfl8nFwjRlpTFtET9WCjB4BDRvIXAmKkMGRay5Fmtep5t28RzzGtxXoNaTNzjTu582Z2TIKGyJB563Sc73oJtEiWnLWw7AYHGBMDoJQBEXtyJRC6GWY6%2B1%2F%2FYFBr2D9FfYzx8aPh2HSj3x8uZbt93Td31aP%2By4sP2edmh5CvJCSTbitWt%2BrwG3iKcwbzO8yMnKpwnDS5QTKjQymGA9YzyqfJXN20v3%2BAQmMXds%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_87=5aea8bca-e090-4802-94d3-585fd3816e26; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
764	192.168.2.16	50648	44.231.162.210	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	547	OUT	GET /visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=aXQaOqrGBGrZCZrdEc4x&gdpr=0&gdpr_consent=&gdpr=0 HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:44 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:44 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
765	192.168.2.16	50752	35.244.193.51	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	490	OUT	GET /v1/envelope?pid=0013300001kQj1aAAC&src=aps&ver=1.2.0&us_privacy=1--- HTTP/1.1 Host: lexicon.33across.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:44 UTC	257	IN	HTTP/1.1 200 OK cache-control: private, must-revalidate, max-age=28800 content-type: application/json Content-Length: 42 via: 1.1 google date: Tue, 19 Dec 2023 09:22:44 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:44 UTC	42	IN	Data Raw: 7b 22 73 75 63 63 65 65 64 65 64 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 22 3a 22 43 6f 6f 6b 69 65 64 20 55 73 65 72 22 7d Data Ascii: {"succeeded":false,"error":"Cookied User"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
766	192.168.2.16	50822	104.18.25.173	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	996	OUT	GET /i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP/1.1 Host: a.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ANON_ID=aMnvBNR3YWj7UXuRu8rphZdE4WTZaZaEDQvYjPmERPNF0tHAA5CvWXsu4PFIemUJmP6K2wkAq9Nko0sDpOrByUTSAIfZc5Du5TdjNp4RipQtRIZba4xK4Spt8
2023-12-19 09:22:45 UTC	861	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 43 Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 302 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=aYnvBNyKalHobWm8ZaByPtjDxHmaZdeCWLBL3Ail52Uk3VbG3oFaTdyvYcT14EvYm7Cgw5P7fjGZcqRL6Nd3ZcNcl6AgNckZdGhJhcZd366NTrst2rg8l8SwDk; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:44 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=aYnvBNyKalHobWm8ZaByPtjDxHmaZdeCWLBL3Ail52Uk3VbG3oFaTdyvYcT14EvYm7Cgw5P7fjGZcqRL6Nd3ZcNcl6AgNckZdGhJhcZd366NTrst2rg8l8SwDk; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:44 GMT; CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 837e9532becf74b0-MIA alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 40 02 02 44 01 00 3b Data Ascii: GIF89a!,@D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
767	192.168.2.16	50808	51.222.39.185	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	436	OUT	GET /match/?int_id=107&uid=5184721251378344538 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:44 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:02; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
768	192.168.2.16	50782	50.19.110.14	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	588	OUT	GET /insync?gdpr=0&gdpr_consent=&vxii_pdid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&vxii_pid=12&vxii_pid1=10067&vxii_rcid=18084528-0860-4dcc-9aff-4aa340ba369a HTTP/1.1 Host: thrtle.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=eyJpZCI6IjE4MDg0NTI4LTA4NjAtNGRjYy05YWZmLTRhYTM0MGJhMzY5YSIsImwiOjE3MDI5Nzc3NTcwMDQsInQiOjF9
2023-12-19 09:22:44 UTC	353	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close P3p: CP="NOI OUR BUS UNI COM NAV" Set-Cookie: mc=eyJpZCI6IjE4MDg0NTI4LTA4NjAtNGRjYy05YWZmLTRhYTM0MGJhMzY5YSIsImwiOjE3MDI5Nzc3NjQyOTAsInQiOjF9; Path=/; Domain=thrtle.com; Expires=Sat, 06 Jul 2024 09:22:44 GMT; Secure; SameSite=None
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
769	192.168.2.16	50661	172.217.15.198	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	587	OUT	GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUmylr5xssRUldCbV6tWBDUhMt0C_zQbB5GA2KBkYRvR64mwP_aIDD2DJ8M6
2023-12-19 09:22:44 UTC	743	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-doubleclick-media" Report-To: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} Content-Length: 1078 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 19 Dec 2023 09:22:33 GMT Expires: Wed, 20 Dec 2023 09:22:33 GMT Cache-Control: public, max-age=86400 Age: 11 Last-Modified: Tue, 08 May 2012 13:08:06 GMT Content-Type: image/x-icon Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:44 UTC	509	IN	Data Raw: 00 00 01 00 02 00 10 10 10 00 00 00 00 00 28 01 00 00 26 00 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 4e 01 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii: (& N(
2023-12-19 09:22:44 UTC	569	IN	Data Raw: 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
770	192.168.2.16	50768	162.19.138.116	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	684	OUT	POST /gm/v3 HTTP/1.1 Host: id5-sync.com Connection: keep-alive Content-Length: 1084 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://caffeine.softonic.com.br Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://caffeine.softonic.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 3pi=; id5=007d896a-8f1e-732b-999f-36c629c57f99#1702977742775#1
2023-12-19 09:22:44 UTC	1084	OUT	Data Raw: 7b 22 72 65 71 75 65 73 74 73 22 3a 5b 7b 22 72 65 71 75 65 73 74 49 64 22 3a 22 66 66 65 61 33 61 32 66 2d 31 38 32 31 2d 34 64 38 33 2d 61 33 65 65 2d 30 62 65 30 34 38 61 38 34 39 36 63 22 2c 22 72 65 71 75 65 73 74 43 6f 75 6e 74 22 3a 31 2c 22 72 6f 6c 65 22 3a 22 6c 65 61 64 65 72 22 2c 22 70 61 72 74 6e 65 72 22 3a 36 39 31 2c 22 76 22 3a 22 31 2e 30 2e 35 35 22 2c 22 6f 22 3a 22 61 70 69 22 2c 22 74 6d 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 72 65 66 22 3a 6e 75 6c 6c 2c 22 63 75 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 6f 6e 69 63 2e 63 6f 6d 2e 62 72 2f 22 2c 22 75 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 66 66 65 69 6e 65 2e 73 6f 66 74 Data Ascii: {"requests":[{"requestId":"ffea3a2f-1821-4d83-a3ee-0be048a8496c","requestCount":1,"role":"leader","partner":691,"v":"1.0.55","o":"api","tml":"https://caffeine.softonic.com.br/","ref":null,"cu":"https://caffeine.softonic.com.br/","u":"https://caffeine.soft
2023-12-19 09:22:44 UTC	627	IN	HTTP/1.1 200 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers access-control-allow-origin: https://caffeine.softonic.com.br vary: Origin access-control-allow-credentials: true p3p: CP="CAO PSA OUR" set-cookie: id5=007d896a-8f1e-732b-999f-36c629c57f99#1702977742775#2; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:44 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure content-type: application/json;charset=UTF-8 transfer-encoding: chunked date: Tue, 19 Dec 2023 09:22:44 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2023-12-19 09:22:44 UTC	700	IN	Data Raw: 32 42 35 0d 0a 7b 22 67 65 6e 65 72 69 63 22 3a 7b 22 73 69 67 6e 61 74 75 72 65 22 3a 22 49 44 35 5f 41 74 65 41 43 57 32 6e 6b 6b 6d 79 34 56 4d 6f 67 6e 44 41 4a 67 59 48 53 4b 7a 4e 65 71 61 63 6b 6d 75 4a 31 33 69 52 51 68 7a 78 74 51 75 67 45 59 6e 75 4f 79 6f 71 4a 67 65 73 70 78 64 6c 77 69 79 30 43 51 78 55 59 39 7a 63 38 6a 5f 54 47 73 32 42 31 67 39 5f 30 6a 53 4b 78 6f 78 43 52 71 63 31 58 69 4e 34 4c 62 57 75 48 4a 5a 50 72 78 7a 41 59 4f 44 6f 52 56 43 46 43 76 32 2d 46 33 2d 63 42 48 68 75 5a 72 73 30 4e 61 71 65 33 77 38 22 2c 22 63 72 65 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 32 2d 31 39 54 30 39 3a 32 32 3a 32 32 2e 37 37 35 5a 22 2c 22 69 64 35 5f 63 6f 6e 73 65 6e 74 22 3a 74 72 75 65 2c 22 6f 72 69 67 69 6e 61 6c 5f 75 69 64 Data Ascii: 2B5{"generic":{"signature":"ID5_AteACW2nkkmy4VMognDAJgYHSKzNeqackmuJ13iRQhzxtQugEYnuOyoqJgespxdlwiy0CQxUY9zc8j_TGs2B1g9_0jSKxoxCRqc1XiN4LbWuHJZPrxzAYODoRVCFCv2-F3-cBHhuZrs0Naqe3w8","created_at":"2023-12-19T09:22:22.775Z","id5_consent":true,"original_uid
2023-12-19 09:22:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
771	192.168.2.16	50804	34.233.75.175	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	494	OUT	GET /sync/casale/ZYFg02kDskXAcMABkyNPagAACu4AAAIB HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE
2023-12-19 09:22:44 UTC	778	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:44 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
772	192.168.2.16	50719	34.233.75.175	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	504	OUT	GET /sync/openx/dfcf67f2-dbc2-a0a2-5b42-ef933b9d999c?gdpr=0 HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE
2023-12-19 09:22:44 UTC	778	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBNZggWUCENsPeN_nWRdsqDNwkYoC67QFEgEBAQGygmWLZdw80iMA_eMAAA&S=AQAAAgpWUfqdTrIulSVcVa_CJIE; Expires=Wed, 18 Dec 2024 15:22:44 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
773	192.168.2.16	50784	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	853	OUT	GET /usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D
2023-12-19 09:22:44 UTC	761	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:44 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:44 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=6948211115 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
774	192.168.2.16	50832	18.239.225.41	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	644	OUT	GET /adscores/g.pixel?sid=9212308278&puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: aa.agkn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:44 UTC	837	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Tue, 19 Dec 2023 09:22:44 GMT Server: AAWebServer P3P: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID" Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type Set-Cookie: ab=0001%3A3AR7dlh40jdbqgkvl%2Bceu7%2F6waZmxNOd; Path=/; Domain=.agkn.com; Expires=Thu, 19-Dec-2024 09:22:44 GMT; Max-Age=31536000; Secure; SameSite=None X-Cache: Miss from cloudfront Via: 1.1 0bf3bb9805cf147759606d9acffd79a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P8 X-Amz-Cf-Id: SRbxYOUdhRrdBYMSJjKwPtsWU4PcKJQCeyZjMYWInaD7q29FjW4wIw==
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
775	192.168.2.16	50836	50.57.31.206	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	696	OUT	GET /pubmatic/1/info?sType=sync&sExtCookieId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&sInitiator=external&gdpr=0&gdpr_consent= HTTP/1.1 Host: uipglob.semasio.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:44 UTC	688	IN	HTTP/1.1 302 Found Location: /pubmatic/1/info2?sType=sync&sExtCookieId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&sInitiator=external&gdpr=0&gdpr_consent= UIP-Response-Status: Ok Frontend-ID: 4 Set-Cookie: SEUNCY=B12860F49E4A0855; Expires=Wed, 18 Dec 2024 09:22:44 GMT; Path=/; Domain=.semasio.net; SameSite=None; HttpOnly; Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2011 12:00:00 GMT P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT" Pragma: no-cache Connection: close Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Length: 0 Routing-Server-ID: -1 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
776	192.168.2.16	50751	68.67.160.24	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	711	OUT	GET /prebid/setuid?bidder=rubicon&uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6663647625574893018; anj=dTM7k!M4/YCxrEQF']wIg2GU`aghWq!1yIE'Yg-$<@[#3*V!gos0S4uQ2sZ8iq%iMtf8rS)yEAmJYfkG9T5_m!x(#2(:BN@; uids=eyJ0ZW1wVUlEcyI6eyJydWJpY29uIjp7InVpZCI6IkxRQzRaQ1k2LTFJLUpXQVUiLCJleHBpcmVzIjoiMjAyNC0wMy0xOFQwOToyMjozNloifX0sImJpcnRoZGF5IjoiMjAyMy0xMi0xOVQwOToyMjozNloifQ==
2023-12-19 09:22:44 UTC	1368	IN	HTTP/1.1 200 OK Server: nginx/1.21.3 Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: c47e7796-4531-4f2c-b89d-e68c5307b538 Set-Cookie: anj=dTM7k!M4/YCxrEQF']wIg2GU`aghWq!2(5w(3<Syd5tvdXj:Z302bM$GdKmPFw8a3[Xy?j*g8'=D0acm%(3]^%6lQ-Sv?o@; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:44 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: uids=eyJ0ZW1wVUlEcyI6eyJydWJpY29uIjp7InVpZCI6IkxRQzRaQ1k2LTFJLUpXQVUiLCJleHBpcmVzIjoiMjAyNC0wMy0xOFQwOToyMjo0NFoifX0sImJpcnRoZGF5IjoiMjAyMy0xMi0xOVQwOToyMjozNloifQ==; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:44 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: uuid2=6663647625574893018; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 18-Mar-2024 09:22:44 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a!,@L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
777	192.168.2.16	50826	18.209.128.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	816	OUT	GET /pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:44 UTC	337	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Length: 0 Connection: close Server: Kestrel Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID}

Session ID	Source IP	Source Port	Destination IP	Destination Port
778	192.168.2.16	50847	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	1347	OUT	GET /merge?pid=2&3pid=93BC46BA1AC048E6B3FEE9603D02AEE4 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:44 UTC	3079	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:44 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
779	192.168.2.16	50825	54.157.11.141	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	884	OUT	GET /ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP/1.1 Host: pm.w55c.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfivefivec=UzeiMh5u1Rfwja5
2023-12-19 09:22:44 UTC	773	IN	HTTP/1.1 302 Cache-Control: no-cache, must-revalidate Date: Tue, 19 Dec 2023 09:22:44 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:UzeiMh5u1Rfwja5&gdpr=0&gdpr_consent= Pragma: no-cache Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-00176663060b90eb6@us-east-1d@dxedge-app-us-east-1-prod-asg Set-Cookie: wfivefivec=UzeiMh5u1Rfwja5; Domain=.w55c.net; Expires=Sun, 19-Jan-2025 09:22:44 GMT; Path=/; SameSite=None; Secure Set-Cookie: matchpubmatic=5; Domain=.w55c.net; Expires=Thu, 18-Jan-2024 09:22:44 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
780	192.168.2.16	50840	192.184.68.215	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	699	OUT	GET /pixel/p-e4m3Yko6bFYVc.gif?idmatch=0&gdpr=0&us_privacy=1--- HTTP/1.1 Host: cms.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: d=ELMBCwHZKvijAA; mc=658160da-98e44-ad098-ad945
2023-12-19 09:22:44 UTC	577	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Length: 0 Connection: close Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Location: https://pixel.rubiconproject.com/tap.php?v=4939&nid=1902&gdpr=0&put=0XvJftF-lS7Kd8kq03rcLoN-yHfKL5V203tAOIoP P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Pragma: no-cache Set-Cookie: d=EJoBDgHZKvijDCA; expires=Mon, 18-Mar-2024 09:22:44 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Strict-Transport-Security: max-age=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
781	192.168.2.16	50800	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	3285	OUT	GET /AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1704067200%3A256_258%7C1703548800%3A265_253_252%7C1703894400%3A257%7C1704153600%3A262_263_236_235_228_201_260_226_245_259_261%7C1703030400%3A255_248; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; SPugT=1702977760; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; ipc=0^^0^0; pi=0:3; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; PugT=1702977762
2023-12-19 09:22:44 UTC	851	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:43 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:43 GMT; path=/ Set-Cookie: PugT=1702977763; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:43 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
782	192.168.2.16	50801	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	2966	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7562641581956847537 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; pi=137711:4; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; SyncRTB3=1703808000%3A63%7C1705536000%3A224%7C1704153600%3A3_55_165_166_48_56_96_46_22_178_234_99_233_214_21_5_231_104_7_81_249_176_250_264_243_220_240_54_71_13_238_8%7C1703548800%3A223_15_2_38%7C1704240000%3A35%7C1708128000%3A69; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; PugT=1702977758
2023-12-19 09:22:44 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:44 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
783	192.168.2.16	50779	35.211.233.246	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	744	OUT	GET /sync?ssp=bidswitch&bidswitch_ssp_id=onetag HTTP/1.1 Host: a.sportradarserving.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: zuuid=717f049b-6e7a-4ed4-8020-58a3b807e659; c=1702977754; zuuid_lu=1702977757; zuuid_k=1; zuuid_k_lu=1702977757
2023-12-19 09:22:44 UTC	366	IN	HTTP/1.1 302 Moved Temporarily Cache-Control: no-cache, no-store, must-revalidate Content-Length: 0 Date: Tue, 19 Dec 2023 09:22:44 GMT Location: https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=717f049b-6e7a-4ed4-8020-58a3b807e659&ssp=onetag Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
784	192.168.2.16	50767	142.250.217.164	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	1307	OUT	GET /js/bg/mL2Y2df9MP72hJspIKkaS_u6JtFhauYVKQ-w1rT0CAw.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=normal&s=Y5pDg2JnqBHv5hm8ocrLBcGihlxa84Gvmbnw2NCDxhvj7nwAkjTgEp8nImgXSh2unZ-Pn5ovzrhVs24egQXvk69pRWRr0W1dpCJ0jxlefq3Lg8j7mAmnD1o-a2ch4TJcsVGyvXVcGP2b-WcGQ4WLOqqNbHRrq16CiIiNreJwMSm61HzNbYB5xfRw840wumuXWDCXD59Wvp2aR04Zot5D8zw5xq3Evcl_MMaUj5we0WFyWXndmchJd3LY8j_xA1geo5Hxo4I_U9rfG3qmt7XJWgTYglKno0s&cb=b81swjp7dfou Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-19 09:22:44 UTC	812	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 17107 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 16 Dec 2023 09:12:12 GMT Expires: Sun, 15 Dec 2024 09:12:12 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 28 Nov 2023 18:30:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 259832 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:44 UTC	440	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 4d 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 47 3d 66 75 6e 63 74 69 6f 6e 28 4f 2c 57 29 7b 69 66 28 28 4f 3d 28 57 3d 6e 75 6c 6c 2c 4d 2e 74 72 75 73 74 65 64 54 79 70 65 73 29 2c 21 4f 29 7c 7c 21 4f 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 57 3b 74 72 79 7b 57 3d 4f 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 6e 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 6e 2c 63 72 65 61 74 Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var M=this\|\|self,G=function(O,W){if((O=(W=null,M.trustedTypes),!O)\|\|!O.createPolicy)return W;try{W=O.createPolicy("bg",{createHTML:n,createScript:n,creat
2023-12-19 09:22:44 UTC	1252	IN	Data Raw: 57 2e 63 72 65 61 74 65 53 63 72 69 70 74 28 42 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 42 29 7b 72 65 74 75 72 6e 22 22 2b 42 7d 7d 28 4d 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 57 51 3d 66 75 6e 63 74 69 6f 6e 28 4f 2c 57 29 7b 69 66 28 28 4f 3d 28 57 3d 6e 75 6c 6c 2c 50 2e 74 72 75 73 74 65 64 54 79 70 65 73 29 2c 21 4f 29 7c 7c 21 4f 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 57 3b 74 72 79 7b 57 3d 4f 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 4f 34 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 4f 34 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 4f 34 Data Ascii: W.createScript(B)}:function(B){return""+B}}(M)(Array(7824*Math.random()\|0).join("\n")+'(function(){var WQ=function(O,W){if((O=(W=null,P.trustedTypes),!O)\|\|!O.createPolicy)return W;try{W=O.createPolicy("bg",{createHTML:O4,createScript:O4,createScriptURL:O4
2023-12-19 09:22:44 UTC	1252	IN	Data Raw: 72 65 74 75 72 6e 20 57 3b 69 66 28 22 5b 6f 62 6a 65 63 74 20 57 69 6e 64 6f 77 5d 22 3d 3d 28 42 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 4f 29 2c 42 29 29 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3b 69 66 28 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 3d 3d 42 7c 7c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 4f 2e 6c 65 6e 67 74 68 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4f 2e 73 70 6c 69 63 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4f 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 26 26 21 4f 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 28 22 73 70 6c 69 63 65 22 29 29 72 65 74 75 72 6e 22 61 72 72 Data Ascii: return W;if("[object Window]"==(B=Object.prototype.toString.call(O),B))return"object";if("[object Array]"==B\|\|"number"==typeof O.length&&"undefined"!=typeof O.splice&&"undefined"!=typeof O.propertyIsEnumerable&&!O.propertyIsEnumerable("splice"))return"arr
2023-12-19 09:22:44 UTC	1252	IN	Data Raw: 5a 7d 7d 7a 28 4f 2c 31 38 37 2c 57 29 7d 7d 2c 5a 62 3d 66 75 6e 63 74 69 6f 6e 28 4f 2c 57 29 7b 72 65 74 75 72 6e 20 4f 3d 4f 2e 63 72 65 61 74 65 28 29 2e 73 68 69 66 74 28 29 2c 57 2e 57 2e 63 72 65 61 74 65 28 29 2e 6c 65 6e 67 74 68 7c 7c 57 2e 47 2e 63 72 65 61 74 65 28 29 2e 6c 65 6e 67 74 68 7c 7c 28 57 2e 57 3d 76 6f 69 64 20 30 2c 57 2e 47 3d 76 6f 69 64 20 30 29 2c 4f 7d 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 4f 2c 57 2c 42 2c 6e 2c 65 2c 5a 29 7b 69 66 28 4f 2e 4c 2e 6c 65 6e 67 74 68 29 7b 28 4f 2e 4e 3d 28 4f 2e 4e 26 26 30 28 29 2c 74 72 75 65 29 2c 4f 29 2e 61 53 3d 57 3b 74 72 79 7b 6e 3d 4f 2e 67 28 29 2c 4f 2e 6a 3d 6e 2c 4f 2e 58 3d 30 2c 4f 2e 59 3d 6e 2c 65 3d 45 34 28 57 2c 4f 29 2c 5a 3d 4f 2e 67 28 29 2d 4f 2e 6a 2c 4f 2e 50 2b 3d Data Ascii: Z}}z(O,187,W)}},Zb=function(O,W){return O=O.create().shift(),W.W.create().length\|\|W.G.create().length\|\|(W.W=void 0,W.G=void 0),O},l=function(O,W,B,n,e,Z){if(O.L.length){(O.N=(O.N&&0(),true),O).aS=W;try{n=O.g(),O.j=n,O.X=0,O.Y=n,e=E4(W,O),Z=O.g()-O.j,O.P+=
2023-12-19 09:22:44 UTC	1252	IN	Data Raw: 2b 47 29 7d 2c 28 51 28 66 75 6e 63 74 69 6f 6e 28 4d 2c 47 29 7b 4d 3d 53 28 28 47 3d 54 28 4d 29 2c 4d 2e 48 29 2c 47 29 2c 4d 5b 30 5d 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 4d 5b 31 5d 2c 4d 5b 32 5d 2c 62 29 7d 2c 28 51 28 66 75 6e 63 74 69 6f 6e 28 4d 2c 47 2c 56 2c 61 29 7b 47 3d 53 28 28 56 3d 53 28 4d 2c 28 61 3d 28 56 3d 54 28 28 47 3d 54 28 4d 29 2c 4d 29 29 2c 54 29 28 4d 29 2c 56 29 29 2c 4d 29 2c 47 29 2c 7a 28 4d 2c 61 2c 47 20 69 6e 20 56 7c 30 29 7d 2c 31 31 34 2c 28 51 28 66 75 6e 63 74 69 6f 6e 28 4d 29 7b 41 70 28 34 2c 4d 29 7d 2c 28 51 28 66 75 6e 63 74 69 6f 6e 28 4d 29 7b 65 30 28 4d 2c 34 29 7d 2c 34 35 33 2c 28 7a 28 42 2c 28 7a 28 42 2c 34 31 33 2c 5b 31 36 30 2c 30 2c 28 51 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: +G)},(Q(function(M,G){M=S((G=T(M),M.H),G),M[0].removeEventListener(M[1],M[2],b)},(Q(function(M,G,V,a){G=S((V=S(M,(a=(V=T((G=T(M),M)),T)(M),V)),M),G),z(M,a,G in V\|0)},114,(Q(function(M){Ap(4,M)},(Q(function(M){e0(M,4)},453,(z(B,(z(B,413,[160,0,(Q(function(
2023-12-19 09:22:44 UTC	1252	IN	Data Raw: 75 65 2c 74 72 75 65 29 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 61 53 28 28 4d 3d 28 47 3d 53 28 28 47 3d 54 28 28 45 3d 28 58 3d 54 28 4d 29 2c 54 28 4d 29 29 2c 61 3d 54 28 4d 29 2c 4d 29 29 2c 4d 29 2c 47 29 2c 58 3d 53 28 4d 2c 58 29 2c 45 3d 53 28 4d 2c 45 29 2c 53 28 4d 2c 61 29 29 2c 58 29 29 29 7b 66 6f 72 28 56 20 69 6e 20 61 3d 5b 5d 2c 58 29 61 2e 70 75 73 68 28 56 29 3b 58 3d 61 7d 66 6f 72 28 4d 3d 28 56 3d 58 2e 6c 65 6e 67 74 68 2c 30 3c 4d 29 3f 4d 3a 31 2c 61 3d 30 3b 61 3c 56 3b 61 2b 3d 4d 29 45 28 58 2e 73 6c 69 63 65 28 61 2c 28 61 7c 30 29 2b 28 4d 7c 30 29 29 2c 47 29 7d 7d 2c 28 51 28 66 75 6e 63 74 69 6f 6e 28 4d 2c 47 2c 56 2c 61 29 7b 21 55 28 4d 2c 47 2c 74 72 75 65 2c 66 61 6c 73 65 29 26 26 28 47 3d 71 31 28 4d 29 2c 56 Data Ascii: ue,true)){if("object"==aS((M=(G=S((G=T((E=(X=T(M),T(M)),a=T(M),M)),M),G),X=S(M,X),E=S(M,E),S(M,a)),X))){for(V in a=[],X)a.push(V);X=a}for(M=(V=X.length,0<M)?M:1,a=0;a<V;a+=M)E(X.slice(a,(a\|0)+(M\|0)),G)}},(Q(function(M,G,V,a){!U(M,G,true,false)&&(G=q1(M),V
2023-12-19 09:22:44 UTC	1252	IN	Data Raw: 3a 31 3b 66 6f 72 28 58 3d 28 47 3d 28 72 3d 28 28 72 7c 30 29 2d 31 29 2e 74 6f 53 74 72 69 6e 67 28 32 29 2e 6c 65 6e 67 74 68 2c 30 29 2c 5b 5d 29 3b 47 3c 61 3b 47 2b 2b 29 45 5b 47 5d 7c 7c 28 58 5b 47 5d 3d 4b 28 72 29 29 3b 66 6f 72 28 72 3d 30 3b 72 3c 61 3b 72 2b 2b 29 45 5b 72 5d 26 26 28 58 5b 72 5d 3d 54 28 4d 29 29 3b 66 6f 72 28 66 3d 5b 5d 3b 56 2d 2d 3b 29 66 2e 70 75 73 68 28 53 28 4d 2c 54 28 4d 29 29 29 3b 51 28 66 75 6e 63 74 69 6f 6e 28 41 2c 76 2c 49 2c 46 2c 6b 4b 29 7b 66 6f 72 28 46 3d 28 76 3d 28 6b 4b 3d 5b 5d 2c 5b 5d 29 2c 30 29 3b 46 3c 61 3b 46 2b 2b 29 7b 69 66 28 21 45 5b 49 3d 58 5b 46 5d 2c 46 5d 29 7b 66 6f 72 28 3b 49 3e 3d 76 2e 6c 65 6e 67 74 68 3b 29 76 2e 70 75 73 68 28 54 28 41 29 29 3b 49 3d 76 5b 49 5d 7d 6b 4b Data Ascii: :1;for(X=(G=(r=((r\|0)-1).toString(2).length,0),[]);G<a;G++)E[G]\|\|(X[G]=K(r));for(r=0;r<a;r++)E[r]&&(X[r]=T(M));for(f=[];V--;)f.push(S(M,T(M)));Q(function(A,v,I,F,kK){for(F=(v=(kK=[],[]),0);F<a;F++){if(!E[I=X[F],F]){for(;I>=v.length;)v.push(T(A));I=v[I]}kK
2023-12-19 09:22:44 UTC	1252	IN	Data Raw: 2c 4f 2e 49 29 2c 4f 2e 4c 29 2e 70 75 73 68 28 5b 42 51 2c 6e 2c 42 3f 57 2b 31 3a 57 5d 29 2c 6c 73 29 2c 74 72 75 65 7d 2c 6a 30 3d 66 75 6e 63 74 69 6f 6e 28 4f 2c 57 2c 42 2c 6e 2c 65 2c 5a 2c 4d 2c 47 29 7b 72 65 74 75 72 6e 20 5a 3d 48 5b 4f 3d 5b 36 34 2c 2d 34 39 2c 36 30 2c 39 34 2c 2d 35 35 2c 2d 32 30 2c 4f 2c 28 47 3d 7a 5a 2c 36 38 29 2c 33 36 2c 28 65 3d 57 26 37 2c 36 39 29 5d 2c 6e 2e 4b 5d 28 6e 2e 77 48 29 2c 5a 5b 6e 2e 4b 5d 3d 66 75 6e 63 74 69 6f 6e 28 56 29 7b 4d 3d 56 2c 65 2b 3d 36 2b 37 2a 57 2c 65 26 3d 37 7d 2c 5a 2e 63 6f 6e 63 61 74 3d 66 75 6e 63 74 69 6f 6e 28 56 29 7b 72 65 74 75 72 6e 28 4d 3d 28 56 3d 28 56 3d 2b 65 2d 28 56 3d 42 25 31 36 2b 31 2c 56 2a 4d 29 2d 20 2d 35 32 35 31 2a 4d 2d 20 2d 32 38 39 31 2a 42 2a 4d Data Ascii: ,O.I),O.L).push([BQ,n,B?W+1:W]),ls),true},j0=function(O,W,B,n,e,Z,M,G){return Z=H[O=[64,-49,60,94,-55,-20,O,(G=zZ,68),36,(e=W&7,69)],n.K](n.wH),Z[n.K]=function(V){M=V,e+=6+7W,e&=7},Z.concat=function(V){return(M=(V=(V=+e-(V=B%16+1,VM)- -5251M- -2891B*M
2023-12-19 09:22:44 UTC	1252	IN	Data Raw: 65 6e 65 72 28 5a 2c 4d 2c 62 29 7d 7d 72 65 74 75 72 6e 20 4d 7d 2c 6d 3d 66 75 6e 63 74 69 6f 6e 28 4f 2c 57 2c 42 2c 6e 2c 65 2c 5a 29 7b 69 66 28 4f 2e 48 3d 3d 4f 29 66 6f 72 28 5a 3d 53 28 4f 2c 57 29 2c 32 35 31 3d 3d 57 7c 7c 32 36 32 3d 3d 57 3f 28 57 3d 66 75 6e 63 74 69 6f 6e 28 4d 2c 47 2c 56 2c 61 29 7b 69 66 28 5a 2e 67 48 21 3d 28 47 3d 28 28 56 3d 5a 2e 6c 65 6e 67 74 68 2c 56 29 7c 30 29 2d 34 3e 3e 33 2c 47 29 29 7b 47 3d 5b 30 2c 30 2c 65 5b 31 5d 2c 28 61 3d 28 47 3c 3c 33 29 2d 28 5a 2e 67 48 3d 47 2c 34 29 2c 65 29 5b 32 5d 5d 3b 74 72 79 7b 5a 2e 6d 72 3d 76 51 28 47 2c 4b 44 28 61 2c 5a 29 2c 4b 44 28 28 61 7c 30 29 2b 34 2c 5a 29 29 7d 63 61 74 63 68 28 45 29 7b 74 68 72 6f 77 20 45 3b 7d 7d 5a 2e 70 75 73 68 28 5a 2e 6d 72 5b 56 Data Ascii: ener(Z,M,b)}}return M},m=function(O,W,B,n,e,Z){if(O.H==O)for(Z=S(O,W),251==W\|\|262==W?(W=function(M,G,V,a){if(Z.gH!=(G=((V=Z.length,V)\|0)-4>>3,G)){G=[0,0,e[1],(a=(G<<3)-(Z.gH=G,4),e)[2]];try{Z.mr=vQ(G,KD(a,Z),KD((a\|0)+4,Z))}catch(E){throw E;}}Z.push(Z.mr[V
2023-12-19 09:22:44 UTC	1252	IN	Data Raw: 6e 2c 65 2c 5a 29 7b 66 6f 72 28 42 3d 28 6e 3d 54 28 28 5a 3d 28 28 57 3d 28 65 3d 4f 5b 46 77 5d 7c 7c 7b 7d 2c 54 29 28 4f 29 2c 65 29 2e 49 53 3d 54 28 4f 29 2c 65 2e 4a 3d 5b 5d 2c 4f 2e 48 3d 3d 4f 29 3f 28 4c 28 4f 29 7c 30 29 2d 31 3a 31 2c 4f 29 29 2c 30 29 3b 42 3c 5a 3b 42 2b 2b 29 65 2e 4a 2e 70 75 73 68 28 54 28 4f 29 29 3b 66 6f 72 28 3b 5a 2d 2d 3b 29 65 2e 4a 5b 5a 5d 3d 53 28 4f 2c 65 2e 4a 5b 5a 5d 29 3b 72 65 74 75 72 6e 28 65 2e 45 34 3d 53 28 4f 2c 57 29 2c 65 29 2e 4b 4c 3d 53 28 4f 2c 6e 29 2c 65 7d 2c 76 51 3d 66 75 6e 63 74 69 6f 6e 28 4f 2c 57 2c 42 2c 6e 2c 65 29 7b 66 6f 72 28 65 3d 28 4f 3d 4f 5b 33 5d 7c 28 6e 3d 4f 5b 32 5d 7c 30 2c 30 29 2c 30 29 3b 31 34 3e 65 3b 65 2b 2b 29 42 3d 42 3e 3e 3e 38 7c 42 3c 3c 32 34 2c 4f 3d Data Ascii: n,e,Z){for(B=(n=T((Z=((W=(e=O[Fw]\|\|{},T)(O),e).IS=T(O),e.J=[],O.H==O)?(L(O)\|0)-1:1,O)),0);B<Z;B++)e.J.push(T(O));for(;Z--;)e.J[Z]=S(O,e.J[Z]);return(e.E4=S(O,W),e).KL=S(O,n),e},vQ=function(O,W,B,n,e){for(e=(O=O[3]\|(n=O[2]\|0,0),0);14>e;e++)B=B>>>8\|B<<24,O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
785	192.168.2.16	50815	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	738	OUT	GET /s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=ChcKBgjSARDiFgoGCKIBEOIWCgUIChDiFg; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:44 UTC	606	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Length: 0 Connection: close Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 Set-Cookie: _li_ss=CiIKBgjSARDiFgoGCKIBEOIWCgUIChDiFgoJCP____8HEOwW; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:44 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:44 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port
786	192.168.2.16	50843	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	454	OUT	GET /ecm3?ex=gg.com&id=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:44 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: K19A9GP384SP6C2YB5FQ Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
787	192.168.2.16	50862	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	1387	OUT	GET /merge?pid=16&3pid=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:44 UTC	3098	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:44 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
788	192.168.2.16	50762	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:45 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:02; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
789	192.168.2.16	50759	172.105.220.23	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	688	OUT	GET /pubmatic HTTP/1.1 Host: gocm.c.appier.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	627	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 153 Connection: close Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version Cache-Control: no-store Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=43oyCfC7C9qx1UXE5GCBZQ P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: _auid=43oyCfC7C9qx1UXE5GCBZQ; Path=/; Domain=c.appier.net; Expires=Thu, 19 Dec 2024 09:22:44 GMT; Max-Age=31536000; HttpOnly; Secure; SameSite=None
2023-12-19 09:22:45 UTC	153	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 79 4d 44 49 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 34 33 6f 79 43 66 43 37 43 39 71 78 31 55 58 45 35 47 43 42 5a 51 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=43oyCfC7C9qx1UXE5GCBZQ">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
790	192.168.2.16	50827	107.178.254.65	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	680	OUT	GET /api/sync?pid=5324&it=1&iv=e1e6e9ca5a3835d98a6158bd0159f65aaf47eec7d6aa31cf529966de7ef58217791426b5417dce21&_=2 HTTP/1.1 Host: pippio.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:44 UTC	959	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=e1e6e9ca5a3835d98a6158bd0159f65aaf47eec7d6aa31cf529966de7ef58217791426b5417dce21&rand=05989153 P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: did=jOOdTch8J-O5AN50; Path=/; Domain=pippio.com; Expires=Wed, 18 Dec 2024 09:22:44 GMT; Secure; SameSite=None Set-Cookie: didts=1702977764; Path=/; Domain=pippio.com; Expires=Wed, 18 Dec 2024 09:22:44 GMT; Secure; SameSite=None Set-Cookie: nnls=; Path=/; Domain=pippio.com; Expires=Sat, 17 Feb 2024 09:22:44 GMT; Secure; SameSite=None Set-Cookie: pxrc=COTBhawGEgYIgr0rEAA=; Path=/; Domain=pippio.com; Expires=Sat, 17 Feb 2024 09:22:44 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
791	192.168.2.16	50848	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	789	OUT	GET /usersync/turn/7402232151745586090?dspret=1&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22zdxidn%22%3A%222069.80%22%2C%22nxtrdr%22%3Afalse%7D
2023-12-19 09:22:44 UTC	734	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:44 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%7D; path=/; expires=Wed, 18 Dec 2024 09:22:44 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://sync.targeting.unrulymedia.com/csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D97%263pid%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%26us_privacy%3D1--- connection: close
2023-12-19 09:22:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
792	192.168.2.16	50816	51.222.39.185	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	465	OUT	GET /match/?int_id=106&google_gid=CAESEBV6UFJEVZiVnNP6YpSJcqk&google_cver=1 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:44 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:02; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
793	192.168.2.16	50842	34.98.64.218	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	568	OUT	GET /w/1.0/sd?id=537072991&val=CAESELPt7UfyJF1YSMpdjYoT4B8&google_cver=1 HTTP/1.1 Host: us-u.openx.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=98a43eef-e2e9-0d1c-3043-318ea0ed6728\|1702977747; pd=v2\|1702977748\|vMgavPkWgyiK; univ_id=537072971\|134495f3-7e94-4262-b6f5-d7524e6fbdd7\|1702977751750893
2023-12-19 09:22:44 UTC	366	IN	HTTP/1.1 200 OK Vary: Accept Server: OXGW/0.0.0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Expires: Mon, 26 Jul 1997 05:00:00 GMT Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Cache-Control: private, max-age=0, no-cache Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
794	192.168.2.16	50819	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	1919	OUT	GET /merge?pid=26&3pid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&us_privacy= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; _ljtrtb_80=LQC4ZCY6-1I-JWAU; ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn
2023-12-19 09:22:44 UTC	3471	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:44 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNUU1v2zAM%2FS8%2Bl4C%2BSEm7yY4dOHWWJW6WJpfCsiwXCNAtS7E1HfbfK%2B28w27E43uPj%2BTvAk3xqcBFJdFIC82iMaCq2oDTWAHDiqm6dq7UTXFXcEpcspZFEQNYziZQY4xgUPNU%2BYEzy2iKHggNJxYQEFEmpbJJuV%2Bx5avsw3l3NAkTOmFcKmUxStCTVaAECfAUEYJGoSaKPgSduYlqZVkpKh13KZSpqZRNXVticsGEq2uVaIYlXret1Kk6EvAWVge3T7jNeiKSpDQJRK2MlYznFJr%2F%2F%2F5G%2FtveqISfjs3Mb%2F50fwn9y3zZX9vb64Nbfs19TH3nqjMy3blrm%2FzWGq4zzS6Hy3fYPYIcI%2FdqEEDkBSgVBRhJEqKxo%2FBcTkYhMIbZ8O8jDrfO3vC9aqrjrx9f%2BrflYrbrwXfmgXWTbL%2Bf5ftmNj%2Ff5DV%2FIGdvts9Pbbn%2F3Mp2U%2FYrtt3uLve7b23brzeHx8Aa%2FtR2B3jJd8kjhJ4oRE0w8DAAMxOBCMKCiiPzo%2FbkjS7%2BfACc0JDf; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_26=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
795	192.168.2.16	50834	52.7.115.91	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	699	OUT	GET /cookie-sync/stv?gdpr=0&gdpr_consent= HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: bitoIsSecure=ok; checkForPermission=ok; bito=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:44 UTC	421	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:44 GMT location: https://ads.stickyadstv.com/user-registering?userId=AACk507LAsIAABM7-sg6gA&dataProviderId=817&gdpr=0 Server: gunicorn set-cookie: bito=AACk507LAsIAABM7-sg6gA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:44 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
796	192.168.2.16	50818	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	480	OUT	GET /crum?cm_dsp_id=46&external_user_id=6663647625574893018&us_privacy=1--- HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:45 UTC	986	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e9534dbda5c78-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:44 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:44 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B56GqqVIQFyinUDn8bnuDRYdSiWKE2hfICPYHRoQ%2FzR49QI6Evvvry%2FwVyyqvrCnjDcSB3TMfvkxObz6itSJbRZJ9EXGEx9NheGaw75Edp140h%2FnS3vZvM%2F3Q1HjlBTLt0ws8ftmxQJvMA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
797	192.168.2.16	50785	15.197.193.217	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	950	OUT	GET /track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5625528590 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUYASABKAIyCwjAzLvy2J_APBAFOAFaC2FkY29uZHVjdG9yYAI.
2023-12-19 09:22:44 UTC	606	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Length: 181 Connection: close server: Kestrel location: https://sync.1rx.io/usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7 set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:44 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUYASABKAIyCwiS9Lag2Z_APBAFOAFaC2FkY29uZHVjdG9yYAI.; expires=Thu, 19 Dec 2024 09:22:44 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:44 UTC	181	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 74 72 61 64 65 64 65 73 6b 2f 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 22 3e 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 74 72 61 64 65 64 65 73 6b 2f 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://sync.1rx.io/usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7">https://sync.1rx.io/usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
798	192.168.2.16	50835	50.57.31.206	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	730	OUT	GET /pubmatic/1/info2?sType=sync&sExtCookieId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&sInitiator=external&gdpr=0&gdpr_consent= HTTP/1.1 Host: uipglob.semasio.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: SEUNCY=807AB52AB40D16D9
2023-12-19 09:22:44 UTC	580	IN	HTTP/1.1 200 OK Content-Type: image/gif UIP-Response-Status: Ok Frontend-ID: 8 Set-Cookie: SEUNCY=807AB52AB40D16D9; Expires=Wed, 18 Dec 2024 09:22:44 GMT; Path=/; Domain=.semasio.net; SameSite=None; HttpOnly; Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2011 12:00:00 GMT P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT" Pragma: no-cache Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Length: 42 Routing-Server-ID: -1 Access-Control-Allow-Origin: * Connection: close
2023-12-19 09:22:44 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
799	192.168.2.16	50773	54.239.33.158	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	463	OUT	GET /s/ecm3?ex=rubiconprojectHMT&id=WUd4fstsQC6nKZ8ZipRYBg&gdpr=0 HTTP/1.1 Host: aax-eu.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:44 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: DBSRGPZFP8ZMWCQW04MV Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
800	192.168.2.16	50783	3.210.17.75	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	524	OUT	GET /sync?pn_id=rc&id=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: ads.yieldmo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ptrrc=LQC4ZCY6-1I-JWAU; yieldmo_id=3zYO8rrWWOrGlOM3v7w9%7C1702944000000%7C0; ptrkm=ae67145e-4e6a-59f0-a89d-071ebeee2681
2023-12-19 09:22:44 UTC	771	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif;charset=utf-8 Content-Length: 43 Connection: close Set-Cookie: yieldmo_id=3zYO8rrWWOrGlOM3v7w9%7C1702944000000%7C0; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:44 GMT; Domain=yieldmo.com; Path=/; Secure; SameSite=None Set-Cookie: ptrrc=LQC4ZCY6-1I-JWAU; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:44 GMT; Domain=ads.yieldmo.com; Path=/; Secure; SameSite=None Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Cache-Control, Pragma, * Access-Control-Allow-Methods: POST, GET, OPTIONS Pragma: no-cache Accept-CH: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
801	192.168.2.16	50865	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	720	OUT	GET /match/?int_id=90&gdpr=0&gdpr_consent=&uid=AQEI-aejzhWWDQIc55yUAQEBAQE&expiration=1703064160 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:44 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:02; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
802	192.168.2.16	50866	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	707	OUT	GET /match/?int_id=29&uid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent= HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:45 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:02; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
803	192.168.2.16	50803	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	490	OUT	GET /crum?cm_dsp_id=130&external_user_id=AACk507LAsIAABM7-sg6gA&expiration=1704187355 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:45 UTC	986	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e9535da3a31d4-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:44 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:44 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y0KZR7ZhJf2X2s55Ojc%2BhUHkUDDAZ2OLR1jO0i3taKd55i1yLzWX%2FN4HfD8fIpyQ6wt6UAjoKgTRis0HB%2FSPnPm5ZXa1qYWErhGau%2BKV1gxrhpdL4cgtDcaibt0hLgErL6Y5xPEGElMlCw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
804	192.168.2.16	50793	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	1365	OUT	GET /merge?pid=49&3pid=UJ0Gt3SdkRY8&ev=1&pid=558511&gdpr_consent=&gdpr=0 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:44 UTC	3060	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:44 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:44 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
805	192.168.2.16	50796	173.231.178.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	816	OUT	GET /bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP/1.1 Host: cm.adgrx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ADGRX_UID=251c4a36-9e50-11ee-a342-3aa302158eab; ADGRX_CM_PUBMATIC_BRIDGED=1
2023-12-19 09:22:44 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close server: Cowboy set-cookie: ADGRX_UID=251c4a36-9e50-11ee-a342-3aa302158eab; Version=1; Expires=Fri, 17-Jan-2025 09:22:44 GMT; Max-Age=34128000; Domain=.adgrx.com; Path=/; Secure; SameSite=None X-RealServer-NX: lga-delivery-3 Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate Pragma: no-cache Expires: Thu, 23 Sep 2004 17:42:04 GMT P3P: CP="NOI OTC OTP OUR NOR" Access-Control-Allow-Origin: *
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
806	192.168.2.16	50770	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	482	OUT	GET /dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=13de7dcb-57c4-8911-aa9b-7bf1acf99f35 HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:44 UTC	807	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: ZP80P0MDTTM172C4H7NH Set-Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jul-2024 09:22:44 GMT; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Mon, 01-Jan-2029 09:22:44 GMT; Path=/; Secure; HttpOnly; SameSite=None Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
807	192.168.2.16	50820	34.117.239.71	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	1027	OUT	GET /match?bidder_id=33&external_user_id=2271281487850057919730&ts=1702977760&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1 Host: events-ssc.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:45 UTC	257	IN	HTTP/1.1 200 OK content-type: image/png cache-control: no-cache, no-store, max-age=0, must-revalidate Content-Length: 68 Date: Tue, 19 Dec 2023 09:22:45 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:45 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
808	192.168.2.16	50813	15.197.193.217	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	836	OUT	GET /track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUYASABKAIyCwjKveDy2J_APBAFOAFaC2FkY29uZHVjdG9yYAI.
2023-12-19 09:22:44 UTC	659	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Length: 215 Connection: close server: Kestrel location: https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:44 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUSGQoKbGl2ZWludGVudBILCJLGr_XCn8A8EAUYASABKAIyCwjYvLKi2Z_APBAFOAFaCmxpdmVpbnRlbnRgAg..; expires=Thu, 19 Dec 2024 09:22:44 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:44 UTC	215	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 2e 6c 69 61 64 6d 2e 63 6f 6d 2f 73 2f 33 35 37 35 39 3f 62 69 64 64 65 72 5f 69 64 3d 34 34 34 38 39 26 62 69 64 64 65 72 5f 75 75 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 22 3e 68 74 74 70 73 3a 2f 2f 69 2e 6c 69 61 64 6d 2e 63 6f 6d 2f 73 2f 33 35 37 35 39 3f 62 69 64 64 65 72 5f 69 64 3d 34 34 34 38 39 26 62 69 64 64 65 72 5f 75 75 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7">https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port
809	192.168.2.16	50852	54.156.158.209	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	641	OUT	GET /?companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: io.narrative.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:44 UTC	391	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:44 GMT Location: https://io.narrative.io/?io.narrative.guid.v2=2ad92430-9e50-11ee-9828-02e4221a2b5f&companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F Server: nginx/1.22.1 Set-Cookie: io.narrative.guid.v2=2ad92430-9e50-11ee-9828-02e4221a2b5f; Max-Age=47278080; SameSite=None; Secure Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
810	192.168.2.16	50837	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	841	OUT	GET /usersync/tradedesk/134495f3-7e94-4262-b6f5-d7524e6fbdd7 HTTP/1.1 Host: sync.1rx.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%7D
2023-12-19 09:22:44 UTC	313	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:44 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache location: https://sync.targeting.unrulymedia.com/csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 connection: close
2023-12-19 09:22:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
811	192.168.2.16	50879	44.193.120.159	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	657	OUT	GET /tag/?id=20909&user_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: bpi.rtactivate.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	140	IN	HTTP/1.1 200 OK Server: awselb/2.0 Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Connection: close
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
812	192.168.2.16	50838	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	1006	OUT	GET /csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: sync.targeting.unrulymedia.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D
2023-12-19 09:22:45 UTC	628	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:45 GMT content-type: text/html transfer-encoding: chunked set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:45 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
813	192.168.2.16	50849	74.121.140.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	872	OUT	GET /sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=8271700118 HTTP/1.1 Host: sync.mathtag.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid=7a2e6581-60d7-4800-933d-354f6ed2801e
2023-12-19 09:22:45 UTC	496	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Server: MT3 1237 600843f master iad iad-pixel-x13 config_version:"2575" Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" location: https://sync.1rx.io/usersync3/mediamathtest/1508/7a2e6581-60d7-4800-933d-354f6ed2801e?zcc=0&sspret=1 Expires: Tue, 19 Dec 2023 09:22:43 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
814	192.168.2.16	50881	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	3018	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1704067200%3A256_258%7C1703548800%3A265_253_252%7C1703894400%3A257%7C1704153600%3A262_263_236_235_228_201_260_226_245_259_261%7C1703030400%3A255_248; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; SPugT=1702977760; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; ipc=0^^0^0; pi=0:3; PugT=1702940535
2023-12-19 09:22:45 UTC	410	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Transfer-Encoding: chunked Connection: close Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
815	192.168.2.16	50877	23.193.106.169	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	703	OUT	GET /cksync?cs=63&axid_e=eS1TcXNQRUJaRTJ1RklZNjl3MHl1Rl9Ta2JqU3J6emMwcn5B&gdpr=0&ovsid=LQC4ZCY6-1I-JWAU&us_privacy=1---&dpid=58160 HTTP/1.1 Host: hb.yahoo.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	885	IN	HTTP/1.1 200 OK Server: Apache Content-Length: 57 Content-Type: image/gif Set-Cookie: visitor-id=3459793656930032000V10; Expires=Sun, 16 Jun 2024 09:22:45 GMT; domain=.hb.yahoo.net; Path=/; sameSite=none; secure=true Set-Cookie: data-mag=LQC4ZCY6-1I-JWAU~~63;Expires=Wed, 18 Dec 2024 09:22:45 GMT;path=/;domain=.hb.yahoo.net; sameSite=none; secure=true p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" P3P: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA P3P: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA Strict-Transport-Security: max-age=86400 ; includeSubDomains Strict-Transport-Security: max-age=604800 x-mnet-hl2: E Expires: Tue, 19 Dec 2023 09:22:45 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 19 Dec 2023 09:22:45 GMT Connection: close
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 37 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 04 0a 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF87a!,L;
2023-12-19 09:22:45 UTC	14	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
816	192.168.2.16	50850	18.215.67.38	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	421	OUT	GET /tag/?id=20909&user_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: bpi.rtactivate.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	140	IN	HTTP/1.1 200 OK Server: awselb/2.0 Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 43 Connection: close
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
817	192.168.2.16	50860	35.211.178.172	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	737	OUT	GET /sync?dsp_id=188&user_id=GH_JvDj8VjdvrBlOavHmp2aBmNQ&user_group=1&ssp=krushmedia HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:45 UTC	528	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //cs.krushmedia.com/e08dd6156d5e964da4fe396e97a25abc.gif?puid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc Set-Cookie: custom_data=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: bsw_origin_init=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port
818	192.168.2.16	50846	23.88.86.2	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	814	OUT	GET /sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID HTTP/1.1 Host: matching.truffle.bid Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	150	IN	HTTP/1.1 204 No Content Server: nginx/1.23.1 Date: Tue, 19 Dec 2023 09:22:45 GMT Connection: close Strict-Transport-Security: max-age=15768000

Session ID	Source IP	Source Port	Destination IP	Destination Port
819	192.168.2.16	50814	34.111.113.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	949	OUT	GET /idsync/ex/push?partner_id=2499&partner_device_id=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&partner_url=https%3A%2F%2Fr.casalemedia.com%2Frum%3Fcm_dsp_id%3D64%26external_user_id%3D6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:45 UTC	1215	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:45 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:45 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:45 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:45 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Location: https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent= Content-Length: 0 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
820	192.168.2.16	50811	173.231.178.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:44 UTC	816	OUT	GET /bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP/1.1 Host: cm.adgrx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ADGRX_CM_PUBMATIC_BRIDGED=1; ADGRX_UID=269c0ff4-9e50-11ee-bb93-3aa3a7cfa5b7
2023-12-19 09:22:45 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 43 Connection: close server: Cowboy set-cookie: ADGRX_UID=269c0ff4-9e50-11ee-bb93-3aa3a7cfa5b7; Version=1; Expires=Fri, 17-Jan-2025 09:22:45 GMT; Max-Age=34128000; Domain=.adgrx.com; Path=/; Secure; SameSite=None X-RealServer-NX: lga-delivery-3 Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate Pragma: no-cache Expires: Thu, 23 Sep 2004 17:42:04 GMT P3P: CP="NOI OTC OTP OUR NOR" Access-Control-Allow-Origin: *
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
821	192.168.2.16	50824	195.5.165.20	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	708	OUT	GET /cookiesync?gdpr=0&gdpr_consent= HTTP/1.1 Host: core.iprom.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	234	IN	HTTP/1.1 200 OK Vary: Accept-Encoding X-adserver-worker: komodo-cb7b7d27ea64@version_1.579 Connection: close X-server-arch: v2 Content-Type: image/gif Content-Length: 43 X-core-time: 0ms Date: Tue, 19 Dec 2023 09:22:45 GMT
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
822	192.168.2.16	50863	64.227.64.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	803	OUT	GET /pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.adsby.bidtheatre.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __kuid=264187a7-eca5-4baa-b291-3de237129b1c.472191757
2023-12-19 09:22:45 UTC	517	IN	HTTP/1.1 302 302 Date: Tue, 19 Dec 2023 09:22:45 GMT Server: Apache P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT" Set-Cookie: __kuid=264187a7-eca5-4baa-b291-3de237129b1c.472191765; Max-Age=604800; Domain=.adsby.bidtheatre.com; SameSite=None; Secure Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:264187a7-eca5-4baa-b291-3de237129b1c&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
823	192.168.2.16	50889	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	500	OUT	GET /crum?cm_dsp_id=109&external_user_id=75ae24856eb84dc58191e0600d738e77&expiration=1705569757 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:45 UTC	984	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e9537a83a5c82-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:45 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:45 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q9EPB29HgpIZJ%2B5OvOWHMgz0zKi%2F6GIRd40sLJCaH2NpfmXzqgpwojMcIMPUfglBWCNZ4LRcezWSxi4zE%2BLvvfl06Wsfw0r7vXYc8bIBQxxNGtaGqY3STlo8prz5bbfSE4gJQTwl5mzteA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
824	192.168.2.16	50884	34.194.40.200	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	422	OUT	GET /v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: sync.ex.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	454	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/png Content-Length: 86 Connection: close Vary: Origin Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Set-Cookie: exco-uids={"rubicon":{"UID":"LQC4ZCY6-1I-JWAU","Expire":"2023-12-26T09:22:45.104111482Z"}}; Expires=2024-03-18 09:22:45.104128181 +0000 UTC m=+8155295.391958943; Domain=.ex.co; Path=/; HTTPOnly; SameSite=None; Secure=true; Partitioned;
2023-12-19 09:22:45 UTC	86	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 0d 49 44 41 54 08 99 63 60 60 60 60 00 00 00 05 00 01 87 a1 4e d4 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsBIT\|dIDATc````NIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
825	192.168.2.16	50875	195.244.31.10	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	529	OUT	GET /visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&name=BIDSWITCH&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:45 UTC	465	IN	HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate content-type: image/gif expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff date: Tue, 19 Dec 2023 09:22:44 GMT content-length: 49 x-envoy-upstream-service-time: 1 server: ayl-lb-usa02 connection: close
2023-12-19 09:22:45 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
826	192.168.2.16	50797	18.239.225.91	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	1170	OUT	GET /pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=968907273661960568&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3Da4612a01-e9ec-45c4-bd44-397ee7f54411%253A1702977757.5650773%26pid%3D500040%26it%3D1%26iv%3Da4612a01-e9ec-45c4-bd44-397ee7f54411%253A1702977757.5650773%26_%3D1702977757.5676894 HTTP/1.1 Host: live.rezync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: zync-uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411:1702977757.5650773; sd-session-id=eyJfcGVybWFuZW50Ijp0cnVlLCJzZXNzaW9uX2lkIjoiYTQ2MTJhMDEtZTllYy00NWM0LWJkNDQtMzk3ZWU3ZjU0NDExOjE3MDI5Nzc3NTcuNTY1MDc3MyJ9.ZYFg4A.HVP6tb5G70vDaIgR_XXCDC8gUKI
2023-12-19 09:22:45 UTC	1069	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 651 Connection: close Date: Tue, 19 Dec 2023 09:22:45 GMT Location: https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977757.5650773&pid=500040&it=1&iv=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977757.5650773&_=1702977757.5676894 Set-Cookie: zync-uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411:1702977757.5650773; Domain=rezync.com; Expires=Sun, 12 Jan 2025 09:22:45 GMT; Path=/; SameSite=None; Secure Set-Cookie: sd-session-id=.eJwNylEOgyAMANC79FsWKqW1XMYw7BKyyRZxPzPefX6-5B0wf2xbc7O2Q9q3rw1QXvVSh3RAr7_VnpBAeVIvowRmVPaRJzgH6NZ7fbe5LlfJxDhmj87UiqNYyN0XIhdUzOQRiRATih9VRKLcIkcvEuD8A5LaJVc.ZYFg5Q.WLtUFq4p_JT-CsoamxKMWDWMZx8; Expires=Sun, 12 Jan 2025 09:22:45 GMT; HttpOnly; Path=/; SameSite=None; Secure Vary: Cookie Server: lighttpd/1.4.69 X-Cache: Miss from cloudfront Via: 1.1 0ccbfb6540bd7c32dd0a28eee84ed060.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P8 X-Amz-Cf-Id: rGEwyHSTyvvh_I60FZAjcitN6t2FLeV3tEpErU7gpxvgpXc4Thf02A==
2023-12-19 09:22:45 UTC	651	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 73 68 6f 75 6c 64 20 62 65 20 72 65 64 69 72 65 63 74 65 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 74 6f 20 74 68 65 20 74 61 72 67 65 74 20 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 2e 6c 69 61 64 6d 2e 63 6f 6d 2f 73 2f 35 36 34 30 39 3f 62 69 64 64 65 72 5f 69 64 3d 32 30 30 34 34 32 26 61 6d 70 3b 62 69 64 64 65 72 5f 75 75 69 64 3d 61 34 36 31 32 61 30 31 2d 65 39 65 63 2d 34 35 63 34 2d 62 64 34 34 2d 33 39 37 65 65 37 66 35 34 34 31 31 25 33 41 Data Ascii: <!doctype html><html lang=en><title>Redirecting...</title><h1>Redirecting...</h1><p>You should be redirected automatically to the target URL: <a href="https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A

Session ID	Source IP	Source Port	Destination IP	Destination Port
827	192.168.2.16	50744	44.231.162.210	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	541	OUT	GET /visitor/sync?name=ADMIXER&ttl=720&uid=0f4b0fcde45fe67019618f4c5f35f52e&visitor=f34834d64b984ac2ad5e1a43f09751fe&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:45 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 5 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:45 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
828	192.168.2.16	50829	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3120	OUT	GET /AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=1588db34-d26d-41ca-8110-e71bffc93ce8&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1704067200%3A256_258%7C1703548800%3A265_253_252%7C1703894400%3A257%7C1704153600%3A262_263_236_235_228_201_260_226_245_259_261%7C1703030400%3A255_248; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; SPugT=1702977760; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; ipc=0^^0^0; pi=0:3; PugT=1702940535
2023-12-19 09:22:45 UTC	781	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:29:25 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_1278=23329-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23340-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23498-1588db34-d26d-41ca-8110-e71bffc93ce8; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:29:25 GMT; path=/ Set-Cookie: PugT=1702942165; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:29:25 GMT; path=/ Location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
829	192.168.2.16	50883	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3311	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968907273661960568 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; SPugT=1702977763; PugT=1702942241
2023-12-19 09:22:45 UTC	582	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:43 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_18=22947-968907273661960568; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:43 GMT; path=/ Set-Cookie: PugT=1702977763; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:43 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:45 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
830	192.168.2.16	50750	54.221.226.34	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	476	OUT	GET /usersync?b=pln&i=xHDGeFAGG4q9&ev=1&gpp_sid=$&gpp=$&us_privacy=${us_privacy}&pid=558355 HTTP/1.1 Host: rtb.gumgum.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:45 UTC	263	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif;charset=UTF-8 Content-Length: 35 Connection: close Server: nginx Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache Timing-Allow-Origin: *
2023-12-19 09:22:45 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
831	192.168.2.16	50851	44.231.162.210	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	525	OUT	GET /visitor/sync?name=33ACROSS&ttl=720&uid=2f9442d7df2189f76c8b593d5f54ce95&visitor=212294706585447&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:45 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 4 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:45 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
832	192.168.2.16	50821	82.145.213.8	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	758	OUT	GET /pub/sync?pubid=pub8730968190912 HTTP/1.1 Host: t.adx.opera.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17
2023-12-19 09:22:45 UTC	809	IN	HTTP/1.1 302 Found Server: Tengine Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 166 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17 Pragma: no-cache Set-Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17; Path=/; Domain=adx.opera.com; Max-Age=31536000; Secure; SameSite=None
2023-12-19 09:22:45 UTC	166	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 30 4f 44 6b 6d 64 47 77 39 4e 44 4d 79 4d 44 41 3d 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 4f 50 55 66 63 66 35 31 30 39 61 31 61 36 33 34 32 37 63 61 31 37 66 32 65 36 35 30 61 35 61 64 65 31 37 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
833	192.168.2.16	50890	44.211.9.18	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	482	OUT	GET /qmap?c=240&tp=PUBM&tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _cc_dc=0; _cc_id=99830540d7b420848ea61ac1fc0bd701
2023-12-19 09:22:45 UTC	315	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 49 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.61.130 Access-Control-Allow-Origin: * Server: Jetty(9.4.38.v20210224)
2023-12-19 09:22:45 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port
834	192.168.2.16	50839	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	463	OUT	GET /ecm3?ex=onetag.com&id=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:45 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: K87S6XRP0F0TVVYHSR6G Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
835	192.168.2.16	50878	34.225.234.246	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	680	OUT	GET /qmap?c=240&tp=PUBM&tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _cc_cc=ctst
2023-12-19 09:22:45 UTC	314	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 49 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.9.238 Access-Control-Allow-Origin: * Server: Jetty(9.4.38.v20210224)
2023-12-19 09:22:45 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port
836	192.168.2.16	50830	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	1643	OUT	GET /merge?pid=84&3pid=ZYFg1ybZKqdSngqUsIytTAGV HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; _ljtrtb_80=LQC4ZCY6-1I-JWAU; ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn
2023-12-19 09:22:45 UTC	3459	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:45 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNUU1v2zAM%2FS8%2Bl4C%2BSEm7yY4dOHWWJW6WJpfCsiwXCNAtS7E1HfbfK%2B28w27E43uPj%2BTvAk3xqcBFJdFIC82iMaCq2oDTWAHDiqm6dq7UTXFXcEpcspZFEQNYziZQY4xgUPNU%2BYEzy2iKHggNJxYQEFEmpbJJuV%2Bx5avsw3l3NAkTOmFcKmUxStCTVaAECfAUEYJGoSaKPgSduYlqZVkpKh13KZSpqZRNXVticsGEq2uVaIYlXret1Kk6EvAWVge3T7jNeiKSpDQJRK2MlYznFJr%2F%2F%2F5G%2FtveqISfjs3Mb%2F50fwn9y3zZX9vb64Nbfs19TH3nqjMy3blrm%2FzWGq4zzS6Hy3fYPYIcI%2FdqEEDkBSgVBRhJEqKxo%2FBcTkYhMIbZ8O8jDrfO3vC9aqrjrx9f%2BrflYrbrwXfmgXWTbL%2Bf5ftmNj%2Ff5DV%2FIGdvts9Pbbn%2F3Mp2U%2FYrtt3uLve7b23brzeHx8Aa%2FtR2B3jJd8kjhJ4oRE0w8DAAMxOBCMKCiiPzo%2FbkjS7%2BfACc0JDf; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
837	192.168.2.16	50853	23.227.146.18	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	1016	OUT	GET /csync?t=a&ep=281178&extuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&traffic_source=snippet&session=14A0FC939D6A6483&sp=750078&pb=612004&c=570607&a=281178&domain=visitor.omnitagjs.com HTTP/1.1 Host: sync.spotim.market Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vmuid=36de1d8845678e06; a482928=72d68e79-f2f1-0102-0119-397345919658; a281178=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F If-None-Match: 36de1d8845678e06
2023-12-19 09:22:45 UTC	440	IN	HTTP/1.1 200 OK Server: Spotim Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif Content-Length: 43 Etag: 36de1d8845678e06 Set-Cookie: vmuid=36de1d8845678e06; expires=Mon, 19 Feb 2024 09:22:45 GMT; domain=.spotim.market; path=/; secure; SameSite=None Set-Cookie: a281178=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; expires=Mon, 19 Feb 2024 09:22:45 GMT; domain=.spotim.market; path=/; secure; SameSite=None Connection: close
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
838	192.168.2.16	50887	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	456	OUT	GET /ecm3?ex=rubiconprojectHMT&id=Tw4728KPQIaXIzG5auIVXg&gdpr=0 HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:45 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: 57MXDP43GMFA5DT41YCV Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
839	192.168.2.16	50871	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3278	OUT	GET /AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; PugT=1702942361; SPugT=1702977762; pi=159706:3
2023-12-19 09:22:45 UTC	760	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:44 GMT; path=/ Set-Cookie: PugT=1702977764; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:44 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:45 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
840	192.168.2.16	50844	54.156.158.209	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	766	OUT	GET /?io.narrative.guid.v2=297e2810-9e50-11ee-b479-0e71178f036d&companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: io.narrative.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: io.narrative.guid.v2=297e2810-9e50-11ee-b479-0e71178f036d
2023-12-19 09:22:45 UTC	242	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Date: Tue, 19 Dec 2023 09:22:45 GMT Server: nginx/1.22.1 Set-Cookie: io.narrative.guid.v2=297e2810-9e50-11ee-b479-0e71178f036d; Max-Age=47278080; SameSite=None; Secure Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
841	192.168.2.16	50903	67.202.105.21	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	971	OUT	GET /ps/?xi=10&us_privacy=&xu=132eab48-61bf-4eaf-9a69-4fb4f080c8bc HTTP/1.1 Host: ssc-cms.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:45 UTC	692	IN	HTTP/1.1 302 p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" set-cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632; Domain=.33across.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Path=/; Secure; SameSite=None referrer-policy: unsafe-url pragma: no-cache cache-control: no-store, no-cache, must-revalidate expires: Thu, 01-Jan-70 00:00:01 GMT x-33x-status: 8000000008200000A server: 33XP007 location: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&ts=1702977765&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy= content-length: 0 date: Tue, 19 Dec 2023 09:22:44 GMT connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
842	192.168.2.16	50845	162.55.236.224	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	679	OUT	GET /056f32ee5cf49404607e368bd8d3f2af/?gdpr=0&euconsent=&uid=9f860467-d79c-45d4-bcf9-51ad3d856e68 HTTP/1.1 Host: sync.richaudience.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pdid=64f4bbfb-8ac7-4d56-b41c-1zz1702977725; avcid-imd-uid=9f860467-d79c-45d4-bcf9-51ad3d856e68; avcid-inx-uid=ZYFg02kDskXAcMABkyNPagAACu4AAAIB; avcid-bsx-uid=AACk507LAsIAABM7-sg6gA; avcid-bsw-uid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc
2023-12-19 09:22:45 UTC	431	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:16:31 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.2.4 P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: avcid-imd-uid=9f860467-d79c-45d4-bcf9-51ad3d856e68; expires=Mon, 18 Mar 2024 09:16:31 GMT; Max-Age=7776000; path=/; domain=.richaudience.com; secure; HttpOnly; SameSite=None
2023-12-19 09:22:45 UTC	106	IN	Data Raw: 35 66 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 5fPNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port
843	192.168.2.16	50895	74.119.119.150	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	924	OUT	GET /dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP/1.1 Host: dis.criteo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uid=bcf55414-01bc-4254-873e-0589d6530dae
2023-12-19 09:22:45 UTC	531	IN	HTTP/1.1 302 Found content-length: 0 date: Tue, 19 Dec 2023 09:22:44 GMT server: Kestrel cache-control: no-cache expires: Tue, 19 Dec 2023 00:00:00 GMT location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent= pragma: no-cache x-errorlevel: 0 p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" cross-origin-resource-policy: cross-origin server-processing-duration-in-ticks: 796905 strict-transport-security: max-age=31536000; preload; connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
844	192.168.2.16	50867	35.211.178.172	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	737	OUT	GET /sync?dsp_id=151&user_id=595fce4a-490f-4f40-a00c-a7a6a90a5827&expires=30&ssp=fmx HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:45 UTC	531	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //ce.lijit.com/merge?pid=26&3pid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&us_privacy= Set-Cookie: custom_data=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: bsw_origin_init=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port
845	192.168.2.16	50891	44.211.9.18	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	487	OUT	GET /qmap?c=240&tp=PUBM&tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent=&ct=y HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _cc_dc=0; _cc_id=99830540d7b420848ea61ac1fc0bd701
2023-12-19 09:22:45 UTC	314	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 49 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.3.244 Access-Control-Allow-Origin: * Server: Jetty(9.4.38.v20210224)
2023-12-19 09:22:45 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port
846	192.168.2.16	50874	35.214.128.77	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	756	OUT	GET /?pubid=11466&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=1---&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP/1.1 Host: csync.loopme.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port
847	192.168.2.16	50893	34.251.97.118	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	653	OUT	GET /match?gdpr=0&gdpr_consent=&p=M1717054901&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: a.audrte.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	1035	IN	HTTP/1.1 302 Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:45 GMT Location: https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=N2RnVktlbktMNFhUVm1CaURUNk9ZdDhOZw==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%253D%253D%26gdpr%3D0%26gdpr_consent%3D Server: nginx/1.22.1 Set-Cookie: arcki2=7dgVKenKL4XTVmBiDT6OYt8Ng!20220908!1702977765378!ip#102.129.152.212; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:45 GMT; Domain=audrte.com; Path=/; Secure; HttpOnly; SameSite=none; Secure Set-Cookie: arcki2_pubmatic=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F!20220908!1702977765378; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:45 GMT; Domain=audrte.com; Path=/; Secure; HttpOnly; SameSite=none; Secure Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
848	192.168.2.16	50886	70.42.32.223	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	424	OUT	GET /cookie-sync?p=rubicon&uid=LQC4ZCY6-1I-JWAU&obUid=&initiator=&gdpr=0&us_privacy=1--- HTTP/1.1 Host: sync.outbrain.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	306	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Length: 0 Connection: close Cache-Control: no-cache X-TraceId: 46eb89642730f175a9c250e4257d7d58 Set-Cookie: obuid=53ce004a-9b81-4e3f-8188-dd7cd8ebbdf0; Path=/; Domain=.outbrain.com; Max-Age=7776000; Expires=Mon, 18 Mar 2024 09:22:45 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
849	192.168.2.16	50882	74.121.140.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	923	OUT	GET /sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP/1.1 Host: sync.mathtag.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid=7a2e6581-60d7-4800-933d-354f6ed2801e
2023-12-19 09:22:45 UTC	562	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Server: MT3 1237 600843f master iad iad-pixel-x3 config_version:"2575" Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= Expires: Tue, 19 Dec 2023 09:22:44 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
850	192.168.2.16	50921	8.28.7.84	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3121	OUT	GET /AdServer/SPug?partnerID=137711&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage4.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; SPugT=1702977763; PugT=1702942241
2023-12-19 09:22:45 UTC	408	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:33:10 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: SPugT=1702942390; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:33:10 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
851	192.168.2.16	50873	52.46.128.147	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	479	OUT	GET /ecm3?id=LQC4ZCY6-1I-JWAU&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1--- HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ad-id=A_Dxe7zY7UUVsIqNnAsy7XM; ad-privacy=0
2023-12-19 09:22:45 UTC	431	IN	HTTP/1.1 200 OK Server: Server Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 43 Connection: close x-amz-rid: Y25C91AEJNYQ14BGDW5A Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Vary: Content-Type,Accept-Encoding,User-Agent Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
852	192.168.2.16	50856	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	1692	OUT	GET /merge?pid=86&3pid=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s&pi=sovrn&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; _ljtrtb_80=LQC4ZCY6-1I-JWAU; ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn
2023-12-19 09:22:45 UTC	3478	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:45 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNUU1v2zAM%2FS8%2Bl4C%2BSEm7yY4dOHWWJW6WJpfCsiwXCNAtS7E1HfbfK%2B28w27E43uPj%2BTvAk3xqcBFJdFIC82iMaCq2oDTWAHDiqm6dq7UTXFXcEpcspZFEQNYziZQY4xgUPNU%2BYEzy2iKHggNJxYQEFEmpbJJuV%2Bx5avsw3l3NAkTOmFcKmUxStCTVaAECfAUEYJGoSaKPgSduYlqZVkpKh13KZSpqZRNXVticsGEq2uVaIYlXret1Kk6EvAWVge3T7jNeiKSpDQJRK2MlYznFJr%2F%2F%2F5G%2FtveqISfjs3Mb%2F50fwn9y3zZX9vb64Nbfs19TH3nqjMy3blrm%2FzWGq4zzS6Hy3fYPYIcI%2FdqEEDkBSgVBRhJEqKxo%2FBcTkYhMIbZ8O8jDrfO3vC9aqrjrx9f%2BrflYrbrwXfmgXWTbL%2Bf5ftmNj%2Ff5DV%2FIGdvts9Pbbn%2F3Mp2U%2FYrtt3uLve7b23brzeHx8Aa%2FtR2B3jJd8kjhJ4oRE0w8DAAMxOBCMKCiiPzo%2FbkjS7%2BfACc0JDf; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
853	192.168.2.16	50858	34.117.239.71	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	775	OUT	GET /match?bidder_id=30&external_user_id=LQC4ZCY6-1I-JWAU&ts=1702977762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1 Host: events-ssc.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:45 UTC	257	IN	HTTP/1.1 200 OK content-type: image/png cache-control: no-cache, no-store, max-age=0, must-revalidate Content-Length: 68 Date: Tue, 19 Dec 2023 09:22:45 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:45 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
854	192.168.2.16	50841	162.55.236.224	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	675	OUT	GET /2066127a3f7c6635eb4f6cac536feb5a/?gdpr=0&euconsent=&uid=ZYFg02kDskXAcMABkyNPagAACu4AAAIB HTTP/1.1 Host: sync.richaudience.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pdid=64f4bbfb-8ac7-4d56-b41c-1zz1702977725; avcid-imd-uid=9f860467-d79c-45d4-bcf9-51ad3d856e68; avcid-inx-uid=ZYFg02kDskXAcMABkyNPagAACu4AAAIB; avcid-bsx-uid=AACk507LAsIAABM7-sg6gA; avcid-bsw-uid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc
2023-12-19 09:22:45 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:16:31 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.2.4 P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: avcid-inx-uid=ZYFg02kDskXAcMABkyNPagAACu4AAAIB; expires=Mon, 18 Mar 2024 09:16:31 GMT; Max-Age=7776000; path=/; domain=.richaudience.com; secure; HttpOnly; SameSite=None
2023-12-19 09:22:45 UTC	106	IN	Data Raw: 35 66 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 5fPNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port
855	192.168.2.16	50899	195.244.31.10	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	500	OUT	GET /visitor/sync?uid=f04f5c55f88ffea7a3ce5b2d908a6e71&visitor=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:45 UTC	466	IN	HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate content-type: image/gif expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff date: Tue, 19 Dec 2023 09:22:45 GMT content-length: 49 x-envoy-upstream-service-time: 11 server: ayl-lb-usa02 connection: close
2023-12-19 09:22:45 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
856	192.168.2.16	50854	44.231.162.210	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	553	OUT	GET /visitor/sync?name=ADOTMOB&ttl=720&uid=b989ee06df7dfc250798f7f0dfc4ddee&visitor=09ef2204008941e33a02d6b0&gdpr=0&gdpr_consent=&gdpr=0&gdprConsent= HTTP/1.1 Host: visitor-us-west-2.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:45 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 49 Connection: close cache-control: no-cache, no-store, must-revalidate expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff X-Kong-Upstream-Latency: 5 X-Kong-Proxy-Latency: 0 Via: kong/2.8.3
2023-12-19 09:22:45 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
857	192.168.2.16	50855	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3054	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:UzeiMh5u1Rfwja5&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1704067200%3A256_258%7C1703548800%3A265_253_252%7C1703894400%3A257%7C1704153600%3A262_263_236_235_228_201_260_226_245_259_261%7C1703030400%3A255_248; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; SPugT=1702977760; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; ipc=0^^0^0; pi=0:3; PugT=1702940535
2023-12-19 09:22:45 UTC	699	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:45 GMT; path=/ Set-Cookie: PugT=1702977765; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
858	192.168.2.16	50916	74.121.140.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	872	OUT	GET /sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=6948211115 HTTP/1.1 Host: sync.mathtag.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid=7a2e6581-60d7-4800-933d-354f6ed2801e
2023-12-19 09:22:45 UTC	495	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Server: MT3 1237 600843f master iad iad-pixel-x2 config_version:"2575" Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" location: https://sync.1rx.io/usersync3/mediamathtest/1508/7a2e6581-60d7-4800-933d-354f6ed2801e?zcc=0&sspret=1 Expires: Tue, 19 Dec 2023 09:22:44 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
859	192.168.2.16	50912	34.111.113.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	547	OUT	GET /idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:45 UTC	1095	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:45 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:45 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:45 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:45 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
860	192.168.2.16	50906	3.213.224.199	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	436	OUT	GET /usersync?b=dit&i=di_979c85533fdc4607be2b6 HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:45 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:45 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
861	192.168.2.16	50911	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:45 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:03; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
862	192.168.2.16	50928	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	1373	OUT	GET /merge?pid=27&3pid=134495f3-7e94-4262-b6f5-d7524e6fbdd7&gdpr=0&gdpr_consent= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; ljtrtb=eJw9jbFuAjEQBf%2FFNSt51%2BvddTpjDunQISUSKEo6jM8UKSkj%2Fj2%2BJu28Gb1fR%2B7N%2BWTGBwsoR2I8oBVTnNDEC06Wits50uFhYE6xB9A1MTAJQZUeoWkkXqXX1nS45oe7fBT%2BLu8z4Amm5UKDp%2B1LRIKwCsWobCl4tC0J%2F8mXAM5w%2BszXjcfBcy4%2F0euSn3PO%2B7PC8yGPPFaVsZKu0roK3LDdwNsqQI0ScL%2F7etcq1dS9%2FgAOMDa%2B; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s
2023-12-19 09:22:45 UTC	3084	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:45 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
863	192.168.2.16	50909	35.214.128.77	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	645	OUT	GET /?partner_id=1441&vt=&uid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: csync.loopme.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port
864	192.168.2.16	50915	193.122.128.135	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	985	OUT	GET /services?uid=AACk507LAsIAABM7-sg6gA&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26userid%3D5184721251378344538%26gdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4&gdpr=0 HTTP/1.1 Host: sync.technoratimedia.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	1499	IN	HTTP/1.1 307 Temporary Redirect Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 0 Connection: close Location: https://ssum-sec.casalemedia.com/usermatchredir?s=191740&cb=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26nuid%3D1DFC2673216041848E6CCDABE1F44351%26att%3D1%26pid%3D82%26cb%3Dhttps%253A%252F%252Fmatch.prod.bidr.io%252Fcookie-sync%253Fgdpr%253D0%2526gdpr%253D0%2526userid%253D5184721251378344538%2526gdpr%253D0%2526gdpr_consent%253D%2526bee_sync_partners%253Dpm%2526bee_sync_current_partner%253Dsyn%2526bee_sync_initiator%253Dadx%2526bee_sync_hop_count%253D4%26uid%3D Set-Cookie: tads_uidp_73=AACk507LAsIAABM7-sg6gA; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:45 GMT; Path=/; Domain=.technoratimedia.com; Secure; SameSite=None set-cookie: tads_uid=1DFC2673216041848E6CCDABE1F44351; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:45 GMT; Path=/; Domain=.technoratimedia.com; Secure; SameSite=None set-cookie: tads_uid_cd=20231219092245+0000; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:45 GMT; Path=/; Domain=.technoratimedia.com; Secure; SameSite=None set-cookie: tads_zora=2; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:45 GMT; Path=/; Domain=.technoratimedia.com; Secure; SameSite=None access-control-allow-origin: https://ads.pubmatic.com/ access-control-allow-credentials: true access-control-allow-methods: POST,GET,HEAD,OPTIONS X-Varnish: 344719593 Age: 0 Via: 1.1 varnish

Session ID	Source IP	Source Port	Destination IP	Destination Port
865	192.168.2.16	50933	50.57.31.206	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	696	OUT	GET /pubmatic/1/info?sType=sync&sExtCookieId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&sInitiator=external&gdpr=0&gdpr_consent= HTTP/1.1 Host: uipglob.semasio.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	689	IN	HTTP/1.1 302 Found Location: /pubmatic/1/info2?sType=sync&sExtCookieId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&sInitiator=external&gdpr=0&gdpr_consent= UIP-Response-Status: Ok Frontend-ID: 11 Set-Cookie: SEUNCY=82C3B63DC9B7334D; Expires=Wed, 18 Dec 2024 09:22:45 GMT; Path=/; Domain=.semasio.net; SameSite=None; HttpOnly; Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2011 12:00:00 GMT P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT" Pragma: no-cache Connection: close Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Length: 0 Routing-Server-ID: -1 Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
866	192.168.2.16	50809	35.186.193.173	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	899	OUT	GET /int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id] HTTP/1.1 Host: ipac.ctnsnet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cid_9e96bdcc99834ba48beda23b6dd70e67=1; cid=75ae24856eb84dc58191e0600d738e77
2023-12-19 09:22:45 UTC	649	IN	HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="NOI DSP COR NID CUR OUR NOR" Set-Cookie: cid=75ae24856eb84dc58191e0600d738e77; path=/; domain=.ctnsnet.com; expires=Wed, 18 Dec 2024 09:22:45 GMT; Secure; SameSite=None; Set-Cookie: cid_9e96bdcc99834ba48beda23b6dd70e67=null; path=/; domain=.ctnsnet.com; expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure; SameSite=None; Pragma: no-cache Cache-Control: no-cache, must-revalidate Expires: Fri, 01 Jan 1990 00:00:00 GMT Content-Type: image/gif Content-Length: 43 Date: Tue, 19 Dec 2023 09:22:44 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
867	192.168.2.16	50726	82.145.213.8	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	758	OUT	GET /pub/sync?pubid=pub8730968190912 HTTP/1.1 Host: t.adx.opera.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17
2023-12-19 09:22:45 UTC	809	IN	HTTP/1.1 302 Found Server: Tengine Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 166 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17 Pragma: no-cache Set-Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17; Path=/; Domain=adx.opera.com; Max-Age=31536000; Secure; SameSite=None
2023-12-19 09:22:45 UTC	166	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 30 4f 44 6b 6d 64 47 77 39 4e 44 4d 79 4d 44 41 3d 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 4f 50 55 66 63 66 35 31 30 39 61 31 61 36 33 34 32 37 63 61 31 37 66 32 65 36 35 30 61 35 61 64 65 31 37 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
868	192.168.2.16	50810	44.219.168.194	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	529	OUT	GET /sync?pn_id=km&id=ae67145e-4e6a-59f0-a89d-071ebeee2681 HTTP/1.1 Host: sync-km.ads.yieldmo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ptrrc=LQC4ZCY6-1I-JWAU; yieldmo_id=3zYO8rrWWOrGlOM3v7w9%7C1702944000000%7C0; ptrkm=ae67145e-4e6a-59f0-a89d-071ebeee2681
2023-12-19 09:22:45 UTC	791	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif;charset=utf-8 Content-Length: 43 Connection: close Set-Cookie: yieldmo_id=3zYO8rrWWOrGlOM3v7w9%7C1702944000000%7C0; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:45 GMT; Domain=yieldmo.com; Path=/; Secure; SameSite=None Set-Cookie: ptrkm=ae67145e-4e6a-59f0-a89d-071ebeee2681; Max-Age=31536000; Expires=Wed, 18 Dec 2024 09:22:45 GMT; Domain=ads.yieldmo.com; Path=/; Secure; SameSite=None Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Cache-Control, Pragma, * Access-Control-Allow-Methods: POST, GET, OPTIONS Pragma: no-cache Accept-CH: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
869	192.168.2.16	50904	18.209.128.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	889	OUT	GET /pbmtc.gif?puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=ade99547-e71c-4503-9f72-c309ae5a0c29; ss=ci0qAEO7xtUHyUa8RhJW0HVTyGss2zns7JOr195roNuEewPNgTVwhipKnOM5BSCz9FdDZRu1huZBQvKcIt9S5Q%3D%3D
2023-12-19 09:22:45 UTC	452	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 42 Connection: close Server: Kestrel Set-Cookie: UID=ade99547-e71c-4503-9f72-c309ae5a0c29; expires=Thu, 19 Dec 2024 09:22:45 GMT; path=/; secure; samesite=none Set-Cookie: ss=dxunW1YIg090YBEhMx0lWk%2BcCMxMadxe%2FnKO%2BTQ21%2FLa3V9nBsTB85LR%2B6nK4JxPaFMwZz%2FW9jDvBu3rELPJ2A%3D%3D; expires=Thu, 19 Dec 2024 09:22:45 GMT; path=/; secure; samesite=none
2023-12-19 09:22:45 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
870	192.168.2.16	50902	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	1692	OUT	GET /merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C
2023-12-19 09:22:45 UTC	3475	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:45 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNUcuO2zAM%2FBefS0BPiurNUexAWafZvJpNLgvLslwgwLZpFu1mi%2F57pR567o0YzgyH5K9KU%2FWx0nMnNUkL7bwlUK4hqI12wLRjqmnqemba6kPFMXPRWpZEimA5G0ENKQFpw3MVes4swzEFQE0cWdSgtZZZqWxWHpZs8Sp38bI9UcaEyRiXSlmdJJjRKlACBQRMGqLRQo2YQoymcDOVWSI1J8mxFYrPOTkyvOGEDHlD1mUasczrNk6d3aMHvoSm24uM26JHRInKoNDaKLKS8ZLC8P%2Ffn%2BQ%2F%2BxMC97A81oeCq4yfT%2B3E7%2BH8cI27l%2Bl6uPn7675efC59nft17S6ama6%2B%2Bey3MnCbcKpLuHKH7RPIIfGgegGIQYBSSQBJlJDIDiJwOZLSwJguhn8fcbx39q7fXetOP78%2F7t4W88mu%2BtDRnnWj9N8u8n090Y83eSsfKNnbzZdnPzt88tKvZ7sl22y214ftV%2B93q%2FXxKbKWP%2FvuCC%2FlLmWEMCPGZBB6HntgNCKIKCyoNLAwmICBTPX7D%2Bh0kGg%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:45 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
871	192.168.2.16	50861	35.244.154.8	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	476	OUT	GET /1000.gif?memo=CKW1KxoNCNzBhawGEgUI6AcQAEIASgA HTTP/1.1 Host: id.rlcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rlas3=MHABhT+qp66wsId1Fg21eZ28T3wf8tQnMIZvDxAxAZU=; pxrc=COHBhawGEgUI6AcQABIFCOhHEAA=
2023-12-19 09:22:45 UTC	620	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=wYwtMZbMImOwsId1Fg21eZ28T3wf8tQnMIZvDxAxAZU=; Path=/; Domain=rlcdn.com; Expires=Wed, 18 Dec 2024 09:22:45 GMT; Secure; SameSite=None Set-Cookie: pxrc=COHBhawGEgUI6AcQBBIFCOhHEAA=; Path=/; Domain=rlcdn.com; Expires=Sat, 17 Feb 2024 09:22:45 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:45 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
872	192.168.2.16	50896	96.46.186.182	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	477	OUT	GET /cookiesyncendpoint?biddername=5&auid=&key=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: sync.aniview.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1_C_5=LQC4ZCY6-1I-JWAU; 1_C_5=LQC4ZCY6-1I-JWAU
2023-12-19 09:22:45 UTC	326	IN	HTTP/1.1 200 OK set-cookie: 1_C_5=LQC4ZCY6-1I-JWAU; Path=/; Domain=aniview.com; Expires=Fri, 29 Dec 2023 09:22:45 GMT; Secure; SameSite=None set-cookie: 1_C_5=LQC4ZCY6-1I-JWAU; Path=/; Expires=Fri, 29 Dec 2023 09:22:45 GMT; Secure; SameSite=None date: Tue, 19 Dec 2023 09:22:45 GMT content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
873	192.168.2.16	50869	34.111.113.62	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	783	OUT	GET /idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:45 UTC	1095	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:45 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:45 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:45 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:45 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
874	192.168.2.16	50907	3.213.224.199	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	444	OUT	GET /usersync?b=mag&i=LQC4ZCY6-1I-JWAU&us_privacy=1--- HTTP/1.1 Host: usersync.gumgum.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: vst=u_c2d2b933-fc5b-4b15-a82f-f69660bcac7a
2023-12-19 09:22:45 UTC	210	IN	HTTP/1.1 200 Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-store, must-revalidate, max-age=0 Expires: 0 Pragma: no-cache
2023-12-19 09:22:45 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
875	192.168.2.16	50927	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	739	OUT	GET /s/75145?bidder_id=195755&bidder_uuid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=ChcKBgjSARDiFgoGCKIBEOIWCgUIChDiFg; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:45 UTC	598	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Length: 0 Connection: close Location: https://x.dlx.addthis.com/e/live_intent_sync?na_exid=a0aee609-2968-45de-a5d3-b77df9a421f0 Set-Cookie: _li_ss=Ch8KBgjSARDiFgoGCKIBEOIWCgUIChDiFgoGCIsBEOIW; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:45 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:45 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 3 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port
876	192.168.2.16	50914	52.22.5.155	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	429	OUT	GET /usersync/redirect?partner=rubicon&partnerId=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: exchange.mediavine.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	239	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Vary: Origin, Accept-Encoding Access-Control-Allow-Credentials: true Cache-Control: private, no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
877	192.168.2.16	50892	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3284	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:lif0y6A21Rfwjb5&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; ipc=0^^0^0; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; pi=156813:4; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; PugT=1702942361; SPugT=1702977762
2023-12-19 09:22:45 UTC	705	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_107=1471-uid:lif0y6A21Rfwjb5&KRTB&23421-uid:lif0y6A21Rfwjb5; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:45 GMT; path=/ Set-Cookie: PugT=1702977765; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
878	192.168.2.16	50926	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3315	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=43oyCfC7C9qx1UXE5GCBZQ HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; SPugT=1702977763; PugT=1702977763
2023-12-19 09:22:45 UTC	587	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_904=16787-43oyCfC7C9qx1UXE5GCBZQ; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ Set-Cookie: PugT=1702977765; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:45 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
879	192.168.2.16	50920	18.239.225.41	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	644	OUT	GET /adscores/g.pixel?sid=9212308278&puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: aa.agkn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:45 UTC	835	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Tue, 19 Dec 2023 09:22:45 GMT Server: AAWebServer P3P: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID" Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type Set-Cookie: ab=0001%3AYCSHjnZmwUZbqgkvl%2Bceu0BdLzKeX50m; Path=/; Domain=.agkn.com; Expires=Thu, 19-Dec-2024 09:22:45 GMT; Max-Age=31536000; Secure; SameSite=None X-Cache: Miss from cloudfront Via: 1.1 4491f677b159939aafd3462cd45568ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P8 X-Amz-Cf-Id: MPAP6nqeXoXLMqorB1sAzxnp4jAkMa4x2hxjDXkeAxEZPG0sEWbEYg==
2023-12-19 09:22:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
880	192.168.2.16	50931	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	866	OUT	GET /usersync3/mediamathtest/1508/7a2e6581-60d7-4800-933d-354f6ed2801e?zcc=0&sspret=1 HTTP/1.1 Host: sync.1rx.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%7D
2023-12-19 09:22:45 UTC	488	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:45 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache location: https://sync.targeting.unrulymedia.com/csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 connection: close
2023-12-19 09:22:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
881	192.168.2.16	50888	34.117.239.71	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	537	OUT	GET /match?bidder_id=30&external_user_id=LQC4ZCY6-1I-JWAU&ts=1702977755&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: events-ssc.33across.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:45 UTC	257	IN	HTTP/1.1 200 OK content-type: image/png cache-control: no-cache, no-store, max-age=0, must-revalidate Content-Length: 68 Date: Tue, 19 Dec 2023 09:22:45 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:45 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
882	192.168.2.16	50946	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3272	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=6074270596568283332 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; PugT=1702942361; SPugT=1702977762; pi=159706:3
2023-12-19 09:22:46 UTC	646	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ Set-Cookie: PugT=1702977765; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
883	192.168.2.16	50934	173.231.178.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	711	OUT	GET /bridge.gif?AG_PID=rubicon&gdpr=0&us_privacy=1--- HTTP/1.1 Host: cm.adgrx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ADGRX_CM_PUBMATIC_BRIDGED=1; ADGRX_UID=269c0ff4-9e50-11ee-bb93-3aa3a7cfa5b7
2023-12-19 09:22:45 UTC	817	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 0 Connection: close server: Cowboy set-cookie: ADGRX_UID=269c0ff4-9e50-11ee-bb93-3aa3a7cfa5b7; Version=1; Expires=Fri, 17-Jan-2025 09:22:45 GMT; Max-Age=34128000; Domain=.adgrx.com; Path=/; Secure; SameSite=None set-cookie: ADGRX_CM_RUBICON_BRIDGED=1; Version=1; Expires=Wed, 20-Dec-2023 09:22:45 GMT; Max-Age=86400; Domain=.adgrx.com; Path=/; Secure; SameSite=None Location: https://pixel.rubiconproject.com/tap.php?v=144054&nid=4032&put=269c0ff4-9e50-11ee-bb93-3aa3a7cfa5b7&expires=60 X-RealServer-NX: lga-delivery-3 Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate Pragma: no-cache Expires: Thu, 23 Sep 2004 17:42:04 GMT P3P: CP="NOI OTC OTP OUR NOR" Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
884	192.168.2.16	50924	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3294	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; PugT=1702942361; SPugT=1702977762; pi=159706:3
2023-12-19 09:22:45 UTC	604	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:44 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:44 GMT; path=/ Set-Cookie: PugT=1702977764; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:44 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:45 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
885	192.168.2.16	50905	162.19.138.120	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	349	OUT	GET /lb/v1 HTTP/1.1 Host: lb.eu-1-id5-sync.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:46 UTC	309	IN	HTTP/1.1 200 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers content-type: application/json;charset=UTF-8 transfer-encoding: chunked date: Tue, 19 Dec 2023 09:22:45 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2023-12-19 09:22:46 UTC	39	IN	Data Raw: 32 31 0d 0a 7b 22 6c 62 22 3a 22 2b 65 76 44 70 76 37 58 75 4e 54 64 69 41 4d 4e 4f 73 36 69 62 51 3d 3d 22 7d 0d 0a Data Ascii: 21{"lb":"+evDpv7XuNTdiAMNOs6ibQ=="}
2023-12-19 09:22:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
886	192.168.2.16	50908	195.244.31.10	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	509	OUT	GET /visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LQC4ZCY6-1I-JWAU&name=RUBICON&gdpr=0&us_privacy=1--- HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08
2023-12-19 09:22:46 UTC	465	IN	HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate content-type: image/gif expires: 0 p3p: CP="CAO PSA OUR" pragma: no-cache set-cookie: ayl_visitor=da2e1841566f4d1e6fa4fa9cd4b48a08; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None vary: Accept-Encoding x-content-type-options: nosniff date: Tue, 19 Dec 2023 09:22:45 GMT content-length: 49 x-envoy-upstream-service-time: 3 server: ayl-lb-usa02 connection: close
2023-12-19 09:22:46 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
887	192.168.2.16	50900	34.117.239.71	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	1032	OUT	GET /match?bidder_id=64&external_user_id=AAAMuYJiaSQd8gNFY4WpAAAAAAA&ts=1702977763&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1 Host: events-ssc.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:46 UTC	257	IN	HTTP/1.1 200 OK content-type: image/png cache-control: no-cache, no-store, max-age=0, must-revalidate Content-Length: 68 Date: Tue, 19 Dec 2023 09:22:46 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:46 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
888	192.168.2.16	50932	3.223.167.169	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	696	OUT	GET /s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 HTTP/1.1 Host: i6.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:46 UTC	226	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif Content-Length: 43 Connection: close Request-Time: 0 Cache-Control: no-store Strict-Transport-Security: max-age=31536000; includeSubDomains
2023-12-19 09:22:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
889	192.168.2.16	50937	15.197.193.217	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	872	OUT	GET /track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUSGQoKbGl2ZWludGVudBILCLTq9tDCn8A8EAUYASABKAIyCwiQ4fn92J_APBAFOAFaCmxpdmVpbnRlbnRgAg..
2023-12-19 09:22:46 UTC	659	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Length: 215 Connection: close server: Kestrel location: https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:45 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUSGQoKbGl2ZWludGVudBILCLSToYDDn8A8EAUYASABKAIyCwj2iaSt2Z_APBAFOAFaCmxpdmVpbnRlbnRgAg..; expires=Thu, 19 Dec 2024 09:22:45 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:46 UTC	215	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 2e 6c 69 61 64 6d 2e 63 6f 6d 2f 73 2f 33 35 37 35 39 3f 62 69 64 64 65 72 5f 69 64 3d 34 34 34 38 39 26 62 69 64 64 65 72 5f 75 75 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 22 3e 68 74 74 70 73 3a 2f 2f 69 2e 6c 69 61 64 6d 2e 63 6f 6d 2f 73 2f 33 35 37 35 39 3f 62 69 64 64 65 72 5f 69 64 3d 34 34 34 38 39 26 62 69 64 64 65 72 5f 75 75 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7">https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port
890	192.168.2.16	50941	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3072	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; pi=159706:3; SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0; PugT=1702977759
2023-12-19 09:22:46 UTC	800	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:31:22 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:31:22 GMT; path=/ Set-Cookie: PugT=1702942282; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:31:22 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
891	192.168.2.16	50913	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3400	OUT	GET /AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=ba980058-5caf-45f8-a0d5-453c01d53d44&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; PugT=1702941566; SPugT=1702977763
2023-12-19 09:22:46 UTC	781	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_1278=23329-ba980058-5caf-45f8-a0d5-453c01d53d44&KRTB&23340-ba980058-5caf-45f8-a0d5-453c01d53d44&KRTB&23498-ba980058-5caf-45f8-a0d5-453c01d53d44; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:45 GMT; path=/ Set-Cookie: PugT=1702977765; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ Location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
892	192.168.2.16	50919	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3311	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968907273661960568 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; SPugT=1702977763; PugT=1702977763
2023-12-19 09:22:46 UTC	582	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_18=22947-968907273661960568; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:45 GMT; path=/ Set-Cookie: PugT=1702977765; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
893	192.168.2.16	50943	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	3328	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; SPugT=1702977763; KRTBCOOKIE_1278=23329-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23340-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23498-1588db34-d26d-41ca-8110-e71bffc93ce8; PugT=1702977764
2023-12-19 09:22:46 UTC	695	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:32:44 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 01-Jan-2024 23:32:44 GMT; path=/ Set-Cookie: PugT=1702942364; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:32:44 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
894	192.168.2.16	50925	35.236.220.17	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	873	OUT	GET /pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: um.simpli.fi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: suid=230C3A6911DC4BB0ABF9299139F39B54
2023-12-19 09:22:46 UTC	723	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: text/html Content-Length: 142 Connection: close Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:230C3A6911DC4BB0ABF9299139F39B54&gdpr=0&gdpr_consent= Expires: Mon, 18 Dec 2023 09:22:46 GMT Cache-Control: no-cache Strict-Transport-Security: max-age=63072000; includeSubdomains; preload X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
2023-12-19 09:22:46 UTC	142	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
895	192.168.2.16	50917	50.57.31.206	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	730	OUT	GET /pubmatic/1/info2?sType=sync&sExtCookieId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&sInitiator=external&gdpr=0&gdpr_consent= HTTP/1.1 Host: uipglob.semasio.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: SEUNCY=B12860F49E4A0855
2023-12-19 09:22:46 UTC	581	IN	HTTP/1.1 200 OK Content-Type: image/gif UIP-Response-Status: Ok Frontend-ID: 11 Set-Cookie: SEUNCY=B12860F49E4A0855; Expires=Wed, 18 Dec 2024 09:22:46 GMT; Path=/; Domain=.semasio.net; SameSite=None; HttpOnly; Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2011 12:00:00 GMT P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT" Pragma: no-cache Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Length: 42 Routing-Server-ID: -1 Access-Control-Allow-Origin: * Connection: close
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
896	192.168.2.16	50922	54.157.11.141	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	884	OUT	GET /ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP/1.1 Host: pm.w55c.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfivefivec=UzeiMh5u1Rfwja5
2023-12-19 09:22:46 UTC	773	IN	HTTP/1.1 302 Cache-Control: no-cache, must-revalidate Date: Tue, 19 Dec 2023 09:22:45 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:UzeiMh5u1Rfwja5&gdpr=0&gdpr_consent= Pragma: no-cache Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-086eafd346e9e6097@us-east-1b@dxedge-app-us-east-1-prod-asg Set-Cookie: wfivefivec=UzeiMh5u1Rfwja5; Domain=.w55c.net; Expires=Sun, 19-Jan-2025 09:22:46 GMT; Path=/; SameSite=None; Secure Set-Cookie: matchpubmatic=5; Domain=.w55c.net; Expires=Thu, 18-Jan-2024 09:22:46 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
897	192.168.2.16	50923	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	1662	OUT	GET /merge?pid=97&3pid=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C
2023-12-19 09:22:46 UTC	3478	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:46 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNUcuO2zAM%2FBefS0BPiurNUexAWafZvJpNLgvLslwgwLZpFu1mi%2F57pR567o0YzgyH5K9KU%2FWx0nMnNUkL7bwlUK4hqI12wLRjqmnqemba6kPFMXPRWpZEimA5G0ENKQFpw3MVes4swzEFQE0cWdSgtZZZqWxWHpZs8Sp38bI9UcaEyRiXSlmdJJjRKlACBQRMGqLRQo2YQoymcDOVWSI1J8mxFYrPOTkyvOGEDHlD1mUasczrNk6d3aMHvoSm24uM26JHRInKoNDaKLKS8ZLC8P%2Ffn%2BQ%2F%2BxMC97A81oeCq4yfT%2B3E7%2BH8cI27l%2Bl6uPn7675efC59nft17S6ama6%2B%2Bey3MnCbcKpLuHKH7RPIIfGgegGIQYBSSQBJlJDIDiJwOZLSwJguhn8fcbx39q7fXetOP78%2F7t4W88mu%2BtDRnnWj9N8u8n090Y83eSsfKNnbzZdnPzt88tKvZ7sl22y214ftV%2B93q%2FXxKbKWP%2FvuCC%2FlLmWEMCPGZBB6HntgNCKIKCyoNLAwmICBTPX7D%2Bh0kGg%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:46 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:46 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:46 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:46 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
898	192.168.2.16	50936	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	831	OUT	GET /csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: sync.targeting.unrulymedia.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D
2023-12-19 09:22:46 UTC	387	IN	HTTP/1.1 200 OK date: Tue, 19 Dec 2023 09:22:46 GMT content-length: 43 set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:46 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" connection: close
2023-12-19 09:22:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 ff ff ff 00 00 00 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
899	192.168.2.16	50949	18.209.128.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:45 UTC	623	OUT	GET /rb.gif?gdpr=0&us_privacy=1--- HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:46 UTC	660	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Length: 0 Connection: close Server: Kestrel Location: https://pixel.rubiconproject.com/tap.php?v=711370&nid=5504&put=06541c94-4d82-4719-9759-25cada24ab50&expires=365&next=https%3A%2F%2Fbeacon.lynx.cognitivlabs.com%2Fpixel%3Ftype%3Dsync%26source%3Drubicon%26inventory_source%3D0 Set-Cookie: UID=06541c94-4d82-4719-9759-25cada24ab50; expires=Thu, 19 Dec 2024 09:22:46 GMT; path=/; secure; samesite=none Set-Cookie: ss=ivL7tDqEWCR5i12WLITZN5D%2BbkPt0%2Fagb2iNYxknszBP%2Bkl9gGnkbwCHJ4S6GXaFuoXow3D5zUdBTdOrL%2B1zbg%3D%3D; expires=Thu, 19 Dec 2024 09:22:46 GMT; path=/; secure; samesite=none

Session ID	Source IP	Source Port	Destination IP	Destination Port
900	192.168.2.16	50939	104.18.25.173	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	996	OUT	GET /i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP/1.1 Host: a.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ANON_ID=aMnvBNR3YWj7UXuRu8rphZdE4WTZaZaEDQvYjPmERPNF0tHAA5CvWXsu4PFIemUJmP6K2wkAq9Nko0sDpOrByUTSAIfZc5Du5TdjNp4RipQtRIZba4xK4Spt8
2023-12-19 09:22:46 UTC	861	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 43 Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 302 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=aKnvBNxNeTgBeZdwQyuT79LD1Lwhi7drk7HvSZaGxirmmdv2PPAaR9AytHaxXcnQYSwqviyvZbNCIYHdMYaZbw17dMZbgVV84xeH2Kyt8yC0Sw4fbkZbq0SHC2; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:46 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=aKnvBNxNeTgBeZdwQyuT79LD1Lwhi7drk7HvSZaGxirmmdv2PPAaR9AytHaxXcnQYSwqviyvZbNCIYHdMYaZbw17dMZbgVV84xeH2Kyt8yC0Sw4fbkZbq0SHC2; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:46 GMT; CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 837e953e5d2909f6-MIA alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 40 02 02 44 01 00 3b Data Ascii: GIF89a!,@D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
901	192.168.2.16	50930	162.55.236.224	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	688	OUT	GET /697a8452aebbe5875da0878cfaf3d0d0/?uid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&us_ps= HTTP/1.1 Host: sync.richaudience.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pdid=64f4bbfb-8ac7-4d56-b41c-1zz1702977725; avcid-imd-uid=9f860467-d79c-45d4-bcf9-51ad3d856e68; avcid-inx-uid=ZYFg02kDskXAcMABkyNPagAACu4AAAIB; avcid-bsx-uid=AACk507LAsIAABM7-sg6gA; avcid-bsw-uid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc
2023-12-19 09:22:46 UTC	431	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:16:32 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.2.4 P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: avcid-bsw-uid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; expires=Mon, 18 Mar 2024 09:16:32 GMT; Max-Age=7776000; path=/; domain=.richaudience.com; secure; HttpOnly; SameSite=None
2023-12-19 09:22:46 UTC	106	IN	Data Raw: 35 66 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 5fPNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port
902	192.168.2.16	50935	63.251.86.49	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	1658	OUT	GET /merge?pid=80&3pid=LQC4ZCY6-1I-JWAU&gdpr=0&us_privacy=1--- HTTP/1.1 Host: ce.lijit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; ljtrtb=eJyNkE9PAjEQxb%2FLnp2k%2F2baeiulSxaXiAISuFG63QOJESEKGL%2B7XQ%2BevU3e%2B73Jm%2Fmq0FT3FY69RCMt1OPagPLBgNPogaFnKgTnRrqu7ipOhSVrWRY5geWsA7XPGQxqXqa448wy6nIEQsOJJQRElCWpbEmupmxylot0eN6YogldNC6Vspgl6M4qUIIERMoISaNQHeWYkh7Yglo58opGjrtSygQayToES0yOmXAhqIIZVrj2yautnzfApxDapSi6HfJEJElpEohaGSsZH1po%2Fv%2F7jfxbvyHgDUzXbjXoqujbTd3za9w%2BHNPitT%2BuTs31vHSTl8HH4jvnD8h0605N2TfTcOqpd4P7%2B9X1tbVXvPnabz7f54vLZNzb2S62ZsnaTjZvB3l77M3HRZ6G0kNE6I5S1gQ7nnbATEcgkrCg8p7FvY4Uja6%2BfwBs0Xcn; _ljtrtb_80=LQC4ZCPI-1J-ELT2; _ljtrtb_2=09884D8316F241D18C871E186061E89C
2023-12-19 09:22:46 UTC	3451	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:46 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCPI-1J-ELT2; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=09884D8316F241D18C871E186061E89C; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNUcuO2zAM%2FBefS0BPiurNUexAWafZvJpNLgvLslwgwLZpFu1mi%2F57pR567o0YzgyH5K9KU%2FWx0nMnNUkL7bwlUK4hqI12wLRjqmnqemba6kPFMXPRWpZEimA5G0ENKQFpw3MVes4swzEFQE0cWdSgtZZZqWxWHpZs8Sp38bI9UcaEyRiXSlmdJJjRKlACBQRMGqLRQo2YQoymcDOVWSI1J8mxFYrPOTkyvOGEDHlD1mUasczrNk6d3aMHvoSm24uM26JHRInKoNDaKLKS8ZLC8P%2Ffn%2BQ%2F%2BxMC97A81oeCq4yfT%2B3E7%2BH8cI27l%2Bl6uPn7675efC59nft17S6ama6%2B%2Bey3MnCbcKpLuHKH7RPIIfGgegGIQYBSSQBJlJDIDiJwOZLSwJguhn8fcbx39q7fXetOP78%2F7t4W88mu%2BtDRnnWj9N8u8n090Y83eSsfKNnbzZdnPzt88tKvZ7sl22y214ftV%2B93q%2FXxKbKWP%2FvuCC%2FlLmWEMCPGZBB6HntgNCKIKCyoNLAwmICBTPX7D%2Bh0kGg%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:46 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_80=LQC4ZCY6-1I-JWAU; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:46 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:46 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:46 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap1dca1
2023-12-19 09:22:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
903	192.168.2.16	50940	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	866	OUT	GET /usersync3/mediamathtest/1508/7a2e6581-60d7-4800-933d-354f6ed2801e?zcc=0&sspret=1 HTTP/1.1 Host: sync.1rx.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%7D
2023-12-19 09:22:46 UTC	488	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:46 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache location: https://sync.targeting.unrulymedia.com/csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 connection: close
2023-12-19 09:22:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
904	192.168.2.16	50944	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:46 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:04; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
905	192.168.2.16	50938	54.156.158.209	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	641	OUT	GET /?companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: io.narrative.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:46 UTC	391	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:46 GMT Location: https://io.narrative.io/?io.narrative.guid.v2=2bafae10-9e50-11ee-a180-0a02e9f38595&companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F Server: nginx/1.22.1 Set-Cookie: io.narrative.guid.v2=2bafae10-9e50-11ee-a180-0a02e9f38595; Max-Age=47278080; SameSite=None; Secure Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
906	192.168.2.16	50958	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	3306	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=866838000893 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; SPugT=1702977762; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; PugT=1702942298
2023-12-19 09:22:46 UTC	600	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:29:26 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:29:26 GMT; path=/ Set-Cookie: PugT=1702942166; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:29:26 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
907	192.168.2.16	50942	172.105.220.23	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	688	OUT	GET /pubmatic HTTP/1.1 Host: gocm.c.appier.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:46 UTC	627	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 153 Connection: close Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version Cache-Control: no-store Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=UJIm7FQxC_S75-Ey5mCBZQ P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: _auid=UJIm7FQxC_S75-Ey5mCBZQ; Path=/; Domain=c.appier.net; Expires=Thu, 19 Dec 2024 09:22:46 GMT; Max-Age=31536000; HttpOnly; Secure; SameSite=None
2023-12-19 09:22:46 UTC	153	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 79 4d 44 49 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 55 4a 49 6d 37 46 51 78 43 5f 53 37 35 2d 45 79 35 6d 43 42 5a 51 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=UJIm7FQxC_S75-Ey5mCBZQ">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
908	192.168.2.16	50948	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	3328	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_1278=23329-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23340-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23498-1588db34-d26d-41ca-8110-e71bffc93ce8; SPugT=1702942390; PugT=1702977765; KRTBCOOKIE_904=16787-43oyCfC7C9qx1UXE5GCBZQ; KRTBCOOKIE_107=1471-uid:lif0y6A21Rfwjb5&KRTB&23421-uid:lif0y6A21Rfwjb5
2023-12-19 09:22:46 UTC	695	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; domain=pubmatic.com; SameSite=None; secure; expires=Tue, 02-Jan-2024 09:22:45 GMT; path=/ Set-Cookie: PugT=1702977765; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
909	192.168.2.16	50897	44.193.54.186	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	487	OUT	GET /map/ct=y/c=14701/tp=MTAI/tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F/gdpr=0/gdpr_consent= HTTP/1.1 Host: bcp.crwdcntrl.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _cc_dc=0; _cc_id=99830540d7b420848ea61ac1fc0bd701
2023-12-19 09:22:46 UTC	313	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: image/gif Content-Length: 49 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.11.4 Access-Control-Allow-Origin: * Server: Jetty(9.4.38.v20210224)
2023-12-19 09:22:46 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
910	192.168.2.16	50951	195.5.165.20	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	708	OUT	GET /cookiesync?gdpr=0&gdpr_consent= HTTP/1.1 Host: core.iprom.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:46 UTC	234	IN	HTTP/1.1 200 OK Vary: Accept-Encoding X-adserver-worker: erebus-02e2cf428441@version_1.579 Connection: close X-server-arch: v2 Content-Type: image/gif Content-Length: 43 X-core-time: 0ms Date: Tue, 19 Dec 2023 09:22:46 GMT
2023-12-19 09:22:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
911	192.168.2.16	50953	23.88.86.2	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	814	OUT	GET /sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID HTTP/1.1 Host: matching.truffle.bid Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:46 UTC	150	IN	HTTP/1.1 204 No Content Server: nginx/1.23.1 Date: Tue, 19 Dec 2023 09:22:46 GMT Connection: close Strict-Transport-Security: max-age=15768000

Session ID	Source IP	Source Port	Destination IP	Destination Port
912	192.168.2.16	50945	35.211.178.172	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	755	OUT	GET /sync?dsp_id=409&expires=14&user_group=1&user_id=717f049b-6e7a-4ed4-8020-58a3b807e659&ssp=onetag HTTP/1.1 Host: x.bidswitch.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: c=1702977747; tuuid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; tuuid_lu=1702977750
2023-12-19 09:22:46 UTC	536	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Location: //onetag-sys.com/match/?int_id=30&uid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&us_privacy= Set-Cookie: custom_data=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure Set-Cookie: bsw_origin_init=; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.bidswitch.net; samesite=none; secure

Session ID	Source IP	Source Port	Destination IP	Destination Port
913	192.168.2.16	50952	34.225.234.246	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	680	OUT	GET /qmap?c=240&tp=PUBM&tpid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _cc_cc=ctst
2023-12-19 09:22:46 UTC	314	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: image/gif Content-Length: 49 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.57.98 Access-Control-Allow-Origin: * Server: Jetty(9.4.38.v20210224)
2023-12-19 09:22:46 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port
914	192.168.2.16	50961	50.57.31.206	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	729	OUT	GET /pubmatic/1/info?sType=sync&sExtCookieId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&sInitiator=external&gdpr=0&gdpr_consent= HTTP/1.1 Host: uipglob.semasio.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: SEUNCY=807AB52AB40D16D9
2023-12-19 09:22:46 UTC	580	IN	HTTP/1.1 200 OK Content-Type: image/gif UIP-Response-Status: Ok Frontend-ID: 8 Set-Cookie: SEUNCY=807AB52AB40D16D9; Expires=Wed, 18 Dec 2024 09:22:46 GMT; Path=/; Domain=.semasio.net; SameSite=None; HttpOnly; Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2011 12:00:00 GMT P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT" Pragma: no-cache Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Length: 42 Routing-Server-ID: -1 Access-Control-Allow-Origin: * Connection: close
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
915	192.168.2.16	50950	64.227.64.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	803	OUT	GET /pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.adsby.bidtheatre.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __kuid=2233062b-d38a-4eaf-9e54-df74f8af0f43.472191762
2023-12-19 09:22:46 UTC	517	IN	HTTP/1.1 302 302 Date: Tue, 19 Dec 2023 09:22:46 GMT Server: Apache P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT" Set-Cookie: __kuid=2233062b-d38a-4eaf-9e54-df74f8af0f43.472191766; Max-Age=604800; Domain=.adsby.bidtheatre.com; SameSite=None; Secure Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:2233062b-d38a-4eaf-9e54-df74f8af0f43&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
916	192.168.2.16	50955	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	2527	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent= HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; DPSync3=1703548800%3A253_265_252%7C1704153600%3A245_262_201_259_260_261_263%7C1703894400%3A257%7C1703030400%3A248_255%7C1704067200%3A258_256; SyncRTB3=1704153600%3A46_249_21_220_5_165_8_13_71_231_166_55_104_233_22_54_48_240_176_250_178_3%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab
2023-12-19 09:22:46 UTC	767	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:45 GMT; path=/ Set-Cookie: PugT=1702977765; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
917	192.168.2.16	50947	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	1006	OUT	GET /csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: sync.targeting.unrulymedia.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D
2023-12-19 09:22:46 UTC	628	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:46 GMT content-type: text/html transfer-encoding: chunked set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:46 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
918	192.168.2.16	50962	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	735	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visitor.omnitagjs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:46 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:04; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
919	192.168.2.16	50966	34.111.113.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	783	OUT	GET /idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:46 UTC	1095	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:46 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:46 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:46 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:46 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:46 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
920	192.168.2.16	50965	18.239.225.41	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	698	OUT	GET /adscores/g.pixel?sid=9212308278&puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: aa.agkn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ab=0001%3AYIYYZOLnj1EZ0h7fNI9vGFysXeEfOZj%2F
2023-12-19 09:22:46 UTC	835	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Tue, 19 Dec 2023 09:22:46 GMT Server: AAWebServer P3P: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID" Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type Set-Cookie: ab=0001%3AYIYYZOLnj1EZ0h7fNI9vGFysXeEfOZj%2F; Path=/; Domain=.agkn.com; Expires=Thu, 19-Dec-2024 09:22:46 GMT; Max-Age=31536000; Secure; SameSite=None X-Cache: Miss from cloudfront Via: 1.1 5ae109f86d7ae6f6423c92c14b951cf6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P8 X-Amz-Cf-Id: z3dJrWRFa-90KJMceDMUxS-wYHEkatkrikx0FksmoV_r_dV5gEFXCA==
2023-12-19 09:22:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
921	192.168.2.16	50963	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	3400	OUT	GET /AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; SPugT=1702977763; PugT=1702942241
2023-12-19 09:22:46 UTC	781	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:45 GMT; path=/ Set-Cookie: PugT=1702977765; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ Location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
922	192.168.2.16	50957	74.121.140.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	923	OUT	GET /sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP/1.1 Host: sync.mathtag.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid=7a2e6581-60d7-4800-933d-354f6ed2801e
2023-12-19 09:22:46 UTC	563	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: image/gif Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Server: MT3 1237 600843f master iad iad-pixel-x29 config_version:"2575" Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= Expires: Tue, 19 Dec 2023 09:22:45 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
923	192.168.2.16	50968	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	2966	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7562641581956847537 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; pi=137711:4; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; SyncRTB3=1703808000%3A63%7C1705536000%3A224%7C1704153600%3A3_55_165_166_48_56_96_46_22_178_234_99_233_214_21_5_231_104_7_81_249_176_250_264_243_220_240_54_71_13_238_8%7C1703548800%3A223_15_2_38%7C1704240000%3A35%7C1708128000%3A69; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; PugT=1702977758
2023-12-19 09:22:46 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:31:22 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
924	192.168.2.16	50959	34.251.97.118	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	653	OUT	GET /match?gdpr=0&gdpr_consent=&p=M1717054901&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: a.audrte.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:46 UTC	1035	IN	HTTP/1.1 302 Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:46 GMT Location: https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=N2RncTRjN1FGSXpUSHVUQU9JSjR3bU84dw==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%253D%253D%26gdpr%3D0%26gdpr_consent%3D Server: nginx/1.22.1 Set-Cookie: arcki2=7dgq4c7QFIzTHuTAOIJ4wmO8w!20220908!1702977766779!ip#102.129.152.212; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:46 GMT; Domain=audrte.com; Path=/; Secure; HttpOnly; SameSite=none; Secure Set-Cookie: arcki2_pubmatic=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F!20220908!1702977766779; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:46 GMT; Domain=audrte.com; Path=/; Secure; HttpOnly; SameSite=none; Secure Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
925	192.168.2.16	50969	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	1228	OUT	GET /usermatchredir?s=191740&cb=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26nuid%3D1DFC2673216041848E6CCDABE1F44351%26att%3D1%26pid%3D82%26cb%3Dhttps%253A%252F%252Fmatch.prod.bidr.io%252Fcookie-sync%253Fgdpr%253D0%2526gdpr%253D0%2526userid%253D5184721251378344538%2526gdpr%253D0%2526gdpr_consent%253D%2526bee_sync_partners%253Dpm%2526bee_sync_current_partner%253Dsyn%2526bee_sync_initiator%253Dadx%2526bee_sync_hop_count%253D4%26uid%3D HTTP/1.1 Host: ssum-sec.casalemedia.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:46 UTC	1358	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Length: 0 Connection: close Location: https://sync.technoratimedia.com/services?srv=cs&nuid=1DFC2673216041848E6CCDABE1F44351&att=1&pid=82&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26userid%3D5184721251378344538%26gdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4&uid=ZYFg02kDskXAcMABkyNPagAA%262798 CF-Ray: 837e95415dd8da9b-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:46 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:46 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PIRQsE38QOsAZD2IfiQiUQtCRnPi0sD1FCNB4rWy%2BQQ4KF%2FwBZDJTv1f4Ry8qzt0vC5t2w%2BRUpWc%2BrnCFXpVMEXZJ1UWYA7ytFu3tktOePbzwn%2FfZMO1Oqw37sdrJHDvoED9YH%2BaE%2For5Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
926	192.168.2.16	50970	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	3359	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:230C3A6911DC4BB0ABF9299139F39B54&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; SPugT=1702977763; PugT=1702977763
2023-12-19 09:22:46 UTC	318	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	1	IN	Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
927	192.168.2.16	50971	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	3298	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; PugT=1702941566; SPugT=1702977763
2023-12-19 09:22:46 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
928	192.168.2.16	50964	82.145.213.8	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	758	OUT	GET /pub/sync?pubid=pub8730968190912 HTTP/1.1 Host: t.adx.opera.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17
2023-12-19 09:22:46 UTC	809	IN	HTTP/1.1 302 Found Server: Tengine Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 166 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17 Pragma: no-cache Set-Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17; Path=/; Domain=adx.opera.com; Max-Age=31536000; Secure; SameSite=None
2023-12-19 09:22:46 UTC	166	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 30 4f 44 6b 6d 64 47 77 39 4e 44 4d 79 4d 44 41 3d 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 4f 50 55 66 63 66 35 31 30 39 61 31 61 36 33 34 32 37 63 61 31 37 66 32 65 36 35 30 61 35 61 64 65 31 37 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
929	192.168.2.16	50967	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	773	OUT	GET /usersync/rubicon/LQC4ZCY6-1I-JWAU?gdpr=0&us_privacy=1--- HTTP/1.1 Host: sync.1rx.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%221508%22%7D
2023-12-19 09:22:46 UTC	804	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:46 GMT content-type: text/html transfer-encoding: chunked cache-control: no-store, no-cache, must-revalidate expires: 0 pragma: no-cache set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%2C%22nxtrdr%22%3Afalse%7D; path=/; expires=Wed, 18 Dec 2024 09:22:46 GMT; domain=.1rx.io; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://sync.targeting.unrulymedia.com/csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%26us_privacy%3D1--- connection: close
2023-12-19 09:22:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
930	192.168.2.16	50954	82.145.213.8	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	673	OUT	GET /pub/sync?pubid=pub10014056052800&gdpr=0&gdpr_consent= HTTP/1.1 Host: t.adx.opera.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17
2023-12-19 09:22:46 UTC	764	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 131 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://ce.lijit.com/merge?3pid=OPUfcf5109a1a63427ca17f2e650a5ade17&gdpr=0&gdpr_consent=&pid=103 Pragma: no-cache Set-Cookie: UID=OPUfcf5109a1a63427ca17f2e650a5ade17; Path=/; Domain=adx.opera.com; Max-Age=31536000; Secure; SameSite=None
2023-12-19 09:22:46 UTC	131	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 65 2e 6c 69 6a 69 74 2e 63 6f 6d 2f 6d 65 72 67 65 3f 33 70 69 64 3d 4f 50 55 66 63 66 35 31 30 39 61 31 61 36 33 34 32 37 63 61 31 37 66 32 65 36 35 30 61 35 61 64 65 31 37 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 61 6d 70 3b 70 69 64 3d 31 30 33 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://ce.lijit.com/merge?3pid=OPUfcf5109a1a63427ca17f2e650a5ade17&gdpr=0&gdpr_consent=&pid=103">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
931	192.168.2.16	50973	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	2681	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent= HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; PugT=1702977757; pi=156813:4; DPSync3=1703030400%3A248_255%7C1703894400%3A257%7C1704153600%3A261_201_245_263_259_262_260%7C1704067200%3A256_258%7C1703548800%3A253_252_265; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224
2023-12-19 09:22:46 UTC	676	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:29:27 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:29:27 GMT; path=/ Set-Cookie: PugT=1702942167; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:29:27 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
932	192.168.2.16	50972	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	3337	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; SPugT=1702977763; KRTBCOOKIE_1278=23329-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23340-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23498-1588db34-d26d-41ca-8110-e71bffc93ce8; PugT=1702942165
2023-12-19 09:22:46 UTC	663	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:45 GMT; path=/ Set-Cookie: PugT=1702977765; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
933	192.168.2.16	50977	54.157.11.141	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	884	OUT	GET /ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP/1.1 Host: pm.w55c.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfivefivec=UzeiMh5u1Rfwja5
2023-12-19 09:22:46 UTC	773	IN	HTTP/1.1 302 Cache-Control: no-cache, must-revalidate Date: Tue, 19 Dec 2023 09:22:45 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:UzeiMh5u1Rfwja5&gdpr=0&gdpr_consent= Pragma: no-cache Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-0572a62ae9dd5d694@us-east-1e@dxedge-app-us-east-1-prod-asg Set-Cookie: wfivefivec=UzeiMh5u1Rfwja5; Domain=.w55c.net; Expires=Sun, 19-Jan-2025 09:22:46 GMT; Path=/; SameSite=None; Secure Set-Cookie: matchpubmatic=5; Domain=.w55c.net; Expires=Thu, 18-Jan-2024 09:22:46 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
934	192.168.2.16	50974	18.209.128.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	901	OUT	GET /pbmtc.gif?puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=ade99547-e71c-4503-9f72-c309ae5a0c29; ss=dxunW1YIg090YBEhMx0lWk%2BcCMxMadxe%2FnKO%2BTQ21%2FLa3V9nBsTB85LR%2B6nK4JxPaFMwZz%2FW9jDvBu3rELPJ2A%3D%3D
2023-12-19 09:22:46 UTC	452	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: image/gif Content-Length: 42 Connection: close Server: Kestrel Set-Cookie: UID=ade99547-e71c-4503-9f72-c309ae5a0c29; expires=Thu, 19 Dec 2024 09:22:46 GMT; path=/; secure; samesite=none Set-Cookie: ss=xe%2BvQOO%2B%2Ff7dILiQkh6QQUPVdLivkmWOrPwk9qU%2FnwW4G%2BvfqXjc%2FV2POFxH3WI2VdwWQtPz3cUpwtb1rUULqA%3D%3D; expires=Thu, 19 Dec 2024 09:22:46 GMT; path=/; secure; samesite=none
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
935	192.168.2.16	50975	34.160.176.28	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	422	OUT	GET /?p_age=0&p_bld=mmm_irs_ppi_902_451_o&p_cpua=x64&p_icar=1&p_lng=en&p_midex=726D6938F596EB31095491F80CE541D51FBFD7EC8A6C63350874DEA10459EBAC&p_ost=0&p_osv=10.0&p_pro=111&p_prod=avg-av-vps&p_ram=8191&p_vbd=1900&p_vep=23&p_ves=12&p_vre=4230&repoid=release& HTTP/1.1 Host: shepherd.avcdn.net User-Agent: libcurl/8.2.1-DEV Schannel zlib/1.2.11 c-ares/1.19.0 nghttp2/1.48.0 Accept: / Accept-Encoding: deflate, gzip
2023-12-19 09:22:46 UTC	592	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: text/plain Content-Length: 491 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Config-Id, Config-Name, Config-Version, Segments, AB-Tests, TTL, TTL-Spread Config-Id: 41 Config-Name: Icarus_ipm-messaging-in-22.11-and-higher_avg-av-vps-fulldump-test-2e75917ebac582f694031228641c0672b0ee3aa8bd9aa18137e7dde9627f7412 Config-Version: 372 Segments: ipm messaging in 22.11 and higher,avg-av-vps fulldump test TTL: 86400 TTL-Spread: 43200 Via: 1.1 google Alt-Svc: clear Connection: close
2023-12-19 09:22:46 UTC	491	IN	Data Raw: 5b 75 69 2e 6f 66 66 65 72 2e 61 63 74 69 6f 6e 73 5d 0d 0a 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 69 70 6d 2e 61 76 63 64 6e 2e 6e 65 74 2f 0d 0a 5b 75 69 2e 6f 66 66 65 72 2e 77 65 6c 63 6f 6d 65 5d 0d 0a 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 69 70 6d 2e 61 76 63 64 6e 2e 6e 65 74 2f 0d 0a 5b 63 6f 6d 6d 6f 6e 5d 0d 0a 63 6f 6e 66 69 67 2d 64 65 66 2d 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 68 65 70 68 65 72 64 2e 61 76 63 64 6e 2e 6e 65 74 2f 0d 0a 72 65 70 6f 72 74 2d 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 61 6e 61 6c 79 74 69 63 73 2e 61 76 63 64 6e 2e 6e 65 74 2f 76 34 2f 72 65 63 65 69 76 65 2f 6a 73 6f 6e 2f 32 35 0d 0a 5b 75 69 5d 0d 0a 65 6e 61 62 6c 65 5f 73 75 72 76 65 79 3d 31 0d 0a 5b 75 70 64 61 74 69 6e 67 5d 0d 0a 63 6f 6e 63 65 61 6c 5f 68 6f 75 Data Ascii: [ui.offer.actions]url=https://ipm.avcdn.net/[ui.offer.welcome]url=https://ipm.avcdn.net/[common]config-def-url=https://shepherd.avcdn.net/report-url=https://analytics.avcdn.net/v4/receive/json/25[ui]enable_survey=1[updating]conceal_hou

Session ID	Source IP	Source Port	Destination IP	Destination Port
936	192.168.2.16	50978	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	3334	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:UzeiMh5u1Rfwja5&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; SPugT=1702977763; PugT=1702942241
2023-12-19 09:22:46 UTC	614	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:46 GMT; path=/ Set-Cookie: PugT=1702977766; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:46 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
937	192.168.2.16	50976	15.197.193.217	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	872	OUT	GET /track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUSGQoKbGl2ZWludGVudBILCLTq9tDCn8A8EAUYASABKAIyCwiQ4fn92J_APBAFOAFaCmxpdmVpbnRlbnRgAg..
2023-12-19 09:22:46 UTC	659	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Length: 215 Connection: close server: Kestrel location: https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 set-cookie: TDID=134495f3-7e94-4262-b6f5-d7524e6fbdd7; expires=Thu, 19 Dec 2024 09:22:46 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESFwoIcHVibWF0aWMSCwjUgufVwZ_APBAFEhUKBmNhc2FsZRILCIr-huPBn8A8EAUSFgoHcnViaWNvbhILCJDE54nCn8A8EAUSGQoKbGl2ZWludGVudBILCILh-IfDn8A8EAUYASABKAIyCwiS1vu02Z_APBAFOAFaCmxpdmVpbnRlbnRgAg..; expires=Thu, 19 Dec 2024 09:22:46 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2023-12-19 09:22:46 UTC	215	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 2e 6c 69 61 64 6d 2e 63 6f 6d 2f 73 2f 33 35 37 35 39 3f 62 69 64 64 65 72 5f 69 64 3d 34 34 34 38 39 26 62 69 64 64 65 72 5f 75 75 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 22 3e 68 74 74 70 73 3a 2f 2f 69 2e 6c 69 61 64 6d 2e 63 6f 6d 2f 73 2f 33 35 37 35 39 3f 62 69 64 64 65 72 5f 69 64 3d 34 34 34 38 39 26 62 69 64 64 65 72 5f 75 75 69 64 3d 31 33 34 34 39 35 66 33 2d 37 65 39 34 2d 34 32 36 32 2d 62 36 66 35 2d 64 37 35 32 34 65 36 66 62 64 64 37 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7">https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port
938	192.168.2.16	50980	104.18.25.173	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	996	OUT	GET /i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP/1.1 Host: a.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ANON_ID=aMnvBNR3YWj7UXuRu8rphZdE4WTZaZaEDQvYjPmERPNF0tHAA5CvWXsu4PFIemUJmP6K2wkAq9Nko0sDpOrByUTSAIfZc5Du5TdjNp4RipQtRIZba4xK4Spt8
2023-12-19 09:22:47 UTC	853	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:47 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 43 Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 302 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=apnvBNRkP6i6eCno6oTrtCheOfZairsXgFdU83CVhbO2VQvU7YATFyi2quZcnq7U36wNrlqGhg0CTVHm4HnJ3VS2GYKObXScK342qAIvXDpWhD8mq0SQYv; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:46 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=apnvBNRkP6i6eCno6oTrtCheOfZairsXgFdU83CVhbO2VQvU7YATFyi2quZcnq7U36wNrlqGhg0CTVHm4HnJ3VS2GYKObXScK342qAIvXDpWhD8mq0SQYv; path=/; domain=.tribalfusion.com; expires=Mon, 18-Mar-2024 09:22:46 GMT; CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 837e95436d14743c-MIA alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 40 02 02 44 01 00 3b Data Ascii: GIF89a!,@D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
939	192.168.2.16	50979	35.236.220.17	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	873	OUT	GET /pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: um.simpli.fi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: suid=230C3A6911DC4BB0ABF9299139F39B54
2023-12-19 09:22:47 UTC	723	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 19 Dec 2023 09:22:47 GMT Content-Type: text/html Content-Length: 142 Connection: close Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:230C3A6911DC4BB0ABF9299139F39B54&gdpr=0&gdpr_consent= Expires: Mon, 18 Dec 2023 09:22:47 GMT Cache-Control: no-cache Strict-Transport-Security: max-age=63072000; includeSubdomains; preload X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
2023-12-19 09:22:47 UTC	142	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
940	192.168.2.16	50981	54.156.158.209	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	708	OUT	GET /?companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: io.narrative.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: io.narrative.guid.v2=297e2810-9e50-11ee-b479-0e71178f036d
2023-12-19 09:22:47 UTC	242	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Date: Tue, 19 Dec 2023 09:22:47 GMT Server: nginx/1.22.1 Set-Cookie: io.narrative.guid.v2=297e2810-9e50-11ee-b479-0e71178f036d; Max-Age=47278080; SameSite=None; Secure Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
941	192.168.2.16	50982	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:47 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:05; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
942	192.168.2.16	50983	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	718	OUT	GET /match/?int_id=30&uid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&us_privacy= HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetag-sys.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:47 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:05; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
943	192.168.2.16	50989	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	3419	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=UJIm7FQxC_S75-Ey5mCBZQ HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_904=16787-43oyCfC7C9qx1UXE5GCBZQ; KRTBCOOKIE_107=1471-uid:lif0y6A21Rfwjb5&KRTB&23421-uid:lif0y6A21Rfwjb5; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-ba980058-5caf-45f8-a0d5-453c01d53d44&KRTB&23340-ba980058-5caf-45f8-a0d5-453c01d53d44&KRTB&23498-ba980058-5caf-45f8-a0d5-453c01d53d44; PugT=1702977765
2023-12-19 09:22:47 UTC	587	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:47 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:47 GMT; path=/ Set-Cookie: PugT=1702977767; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:47 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
944	192.168.2.16	50990	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	3356	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; SPugT=1702977763; KRTBCOOKIE_1278=23329-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23340-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23498-1588db34-d26d-41ca-8110-e71bffc93ce8; PugT=1702977764
2023-12-19 09:22:47 UTC	604	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:45 GMT; path=/ Set-Cookie: PugT=1702977765; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:45 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
945	192.168.2.16	50993	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	3287	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1704067200%3A256_258%7C1703548800%3A265_253_252%7C1703894400%3A257%7C1704153600%3A262_263_236_235_228_201_260_226_245_259_261%7C1703030400%3A255_248; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; SPugT=1702977760; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; ipc=0^^0^0; pi=0:3; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; PugT=1702977762
2023-12-19 09:22:47 UTC	800	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:31:42 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:31:42 GMT; path=/ Set-Cookie: PugT=1702942302; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:31:42 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
946	192.168.2.16	50992	34.111.113.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	783	OUT	GET /idsync/ex/receive?partner_id=3203&partner_device_id=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&gdpr=0&gdpr_consent= HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TapAd_TS=1702977748903; TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e; TapAd_3WAY_SYNCS=
2023-12-19 09:22:47 UTC	1095	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:47 GMT Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Mobile Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 P3P: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: TapAd_TS=1702977748903;Expires=Sat, 17 Feb 2024 09:22:47 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_DID=2fbacb1a-cf7e-4185-bc55-8155b145136e;Expires=Sat, 17 Feb 2024 09:22:47 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Set-Cookie: TapAd_3WAY_SYNCS=;Expires=Sat, 17 Feb 2024 09:22:47 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None Content-Type: image/png Content-Length: 95 Server: Jetty(11.0.13) Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:47 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
947	192.168.2.16	50985	74.121.140.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:46 UTC	923	OUT	GET /sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP/1.1 Host: sync.mathtag.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid=7a2e6581-60d7-4800-933d-354f6ed2801e
2023-12-19 09:22:47 UTC	562	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 19 Dec 2023 09:22:47 GMT Content-Type: image/gif Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Server: MT3 1237 600843f master iad iad-pixel-x2 config_version:"2575" Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= Expires: Tue, 19 Dec 2023 09:22:46 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
948	192.168.2.16	50994	193.122.128.135	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	1165	OUT	GET /services?srv=cs&nuid=1DFC2673216041848E6CCDABE1F44351&att=1&pid=82&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26userid%3D5184721251378344538%26gdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4&uid=ZYFg02kDskXAcMABkyNPagAA%262798 HTTP/1.1 Host: sync.technoratimedia.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tads_uidp_73=AACk507LAsIAABM7-sg6gA; tads_uid=1DFC2673216041848E6CCDABE1F44351; tads_uid_cd=20231219092245+0000; tads_zora=2
2023-12-19 09:22:47 UTC	1216	IN	HTTP/1.1 307 Temporary Redirect Server: nginx Date: Tue, 19 Dec 2023 09:22:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 0 Connection: close Location: https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&userid=5184721251378344538&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=4 Set-Cookie: tads_uidp_82=ZYFg02kDskXAcMABkyNPagAA&2798; Max-Age=259200; Expires=Fri, 22 Dec 2023 09:22:47 GMT; Path=/; Domain=.technoratimedia.com; Secure; SameSite=None set-cookie: tads_uid=1DFC2673216041848E6CCDABE1F44351; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:47 GMT; Path=/; Domain=.technoratimedia.com; Secure; SameSite=None set-cookie: tads_uid_cd=20231219092245+0000; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:47 GMT; Path=/; Domain=.technoratimedia.com; Secure; SameSite=None set-cookie: tads_zora=2; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:47 GMT; Path=/; Domain=.technoratimedia.com; Secure; SameSite=None access-control-allow-origin: https://ads.pubmatic.com/ access-control-allow-credentials: true access-control-allow-methods: POST,GET,HEAD,OPTIONS X-Varnish: 342571094 Age: 0 Via: 1.1 varnish

Session ID	Source IP	Source Port	Destination IP	Destination Port
949	192.168.2.16	50995	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	3306	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=866838000893 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; PugT=1702941566; SPugT=1702977763
2023-12-19 09:22:47 UTC	600	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:02:21 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:02:21 GMT; path=/ Set-Cookie: PugT=1702940541; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:02:21 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
950	192.168.2.16	50996	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	2966	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7562641581956847537 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; pi=137711:4; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; SyncRTB3=1703808000%3A63%7C1705536000%3A224%7C1704153600%3A3_55_165_166_48_56_96_46_22_178_234_99_233_214_21_5_231_104_7_81_249_176_250_264_243_220_240_54_71_13_238_8%7C1703548800%3A223_15_2_38%7C1704240000%3A35%7C1708128000%3A69; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; PugT=1702977758
2023-12-19 09:22:47 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:45 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
951	192.168.2.16	50987	23.88.86.2	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	814	OUT	GET /sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID HTTP/1.1 Host: matching.truffle.bid Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:47 UTC	150	IN	HTTP/1.1 204 No Content Server: nginx/1.23.1 Date: Tue, 19 Dec 2023 09:22:47 GMT Connection: close Strict-Transport-Security: max-age=15768000

Session ID	Source IP	Source Port	Destination IP	Destination Port
952	192.168.2.16	50991	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	1006	OUT	GET /csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: sync.targeting.unrulymedia.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D
2023-12-19 09:22:47 UTC	628	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:47 GMT content-type: text/html transfer-encoding: chunked set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:47 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
953	192.168.2.16	50998	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	3463	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:230C3A6911DC4BB0ABF9299139F39B54&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_904=16787-43oyCfC7C9qx1UXE5GCBZQ; KRTBCOOKIE_107=1471-uid:lif0y6A21Rfwjb5&KRTB&23421-uid:lif0y6A21Rfwjb5; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-ba980058-5caf-45f8-a0d5-453c01d53d44&KRTB&23340-ba980058-5caf-45f8-a0d5-453c01d53d44&KRTB&23498-ba980058-5caf-45f8-a0d5-453c01d53d44; PugT=1702977765
2023-12-19 09:22:47 UTC	318	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:31:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:47 UTC	1	IN	Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
954	192.168.2.16	50988	172.105.220.23	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	726	OUT	GET /pubmatic HTTP/1.1 Host: gocm.c.appier.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _auid=kD5c8C9HCfKvLTiX3mCBZQ
2023-12-19 09:22:47 UTC	609	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 153 Connection: close Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version Cache-Control: no-store Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=kD5c8C9HCfKvLTiX3mCBZQ P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: _auid=kD5c8C9HCfKvLTiX3mCBZQ; Path=/; Domain=c.appier.net; Expires=Thu, 19 Dec 2024 09:22:47 GMT; HttpOnly; Secure; SameSite=None
2023-12-19 09:22:47 UTC	153	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 79 4d 44 49 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 6b 44 35 63 38 43 39 48 43 66 4b 76 4c 54 69 58 33 6d 43 42 5a 51 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=kD5c8C9HCfKvLTiX3mCBZQ">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
955	192.168.2.16	51000	18.209.128.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	897	OUT	GET /pbmtc.gif?puid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=06541c94-4d82-4719-9759-25cada24ab50; ss=ivL7tDqEWCR5i12WLITZN5D%2BbkPt0%2Fagb2iNYxknszBP%2Bkl9gGnkbwCHJ4S6GXaFuoXow3D5zUdBTdOrL%2B1zbg%3D%3D
2023-12-19 09:22:47 UTC	448	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:47 GMT Content-Type: image/gif Content-Length: 42 Connection: close Server: Kestrel Set-Cookie: UID=06541c94-4d82-4719-9759-25cada24ab50; expires=Thu, 19 Dec 2024 09:22:47 GMT; path=/; secure; samesite=none Set-Cookie: ss=TGu%2FOad%2FXYkOKl9lQpldYSFHR7s9%2BA8ZAEflC%2FW5AgL6Odx5jcXxMYcP8GVMOHZuumx2TBHMtbeWya1HsSizRg%3D%3D; expires=Thu, 19 Dec 2024 09:22:47 GMT; path=/; secure; samesite=none
2023-12-19 09:22:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
956	192.168.2.16	50997	195.5.165.20	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	708	OUT	GET /cookiesync?gdpr=0&gdpr_consent= HTTP/1.1 Host: core.iprom.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:47 UTC	234	IN	HTTP/1.1 200 OK Vary: Accept-Encoding X-adserver-worker: avatar-9dae7238a1d0@version_1.579 Connection: close X-server-arch: v2 Content-Type: image/gif Content-Length: 43 X-core-time: 0ms Date: Tue, 19 Dec 2023 09:22:47 GMT
2023-12-19 09:22:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
957	192.168.2.16	51002	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	3553	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUfcf5109a1a63427ca17f2e650a5ade17 HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_904=16787-43oyCfC7C9qx1UXE5GCBZQ; KRTBCOOKIE_107=1471-uid:lif0y6A21Rfwjb5&KRTB&23421-uid:lif0y6A21Rfwjb5; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; PugT=1702977765
2023-12-19 09:22:47 UTC	695	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:47 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; domain=pubmatic.com; SameSite=None; secure; expires=Tue, 02-Jan-2024 09:22:47 GMT; path=/ Set-Cookie: PugT=1702977767; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:47 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
958	192.168.2.16	51003	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	3298	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; SPugT=1702977763; KRTBCOOKIE_1278=23329-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23340-1588db34-d26d-41ca-8110-e71bffc93ce8&KRTB&23498-1588db34-d26d-41ca-8110-e71bffc93ce8; PugT=1702977764
2023-12-19 09:22:47 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:32:46 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
959	192.168.2.16	51001	34.251.97.118	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	653	OUT	GET /match?gdpr=0&gdpr_consent=&p=M1717054901&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: a.audrte.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:47 UTC	1035	IN	HTTP/1.1 302 Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:47 GMT Location: https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=N2RnS1VtcXhLVTVRSktOZHZUbDV5OHU3Zw==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%253D%253D%26gdpr%3D0%26gdpr_consent%3D Server: nginx/1.22.1 Set-Cookie: arcki2=7dgKUmqxKU5QJKNdvTl5y8u7g!20220908!1702977767840!ip#102.129.152.212; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:47 GMT; Domain=audrte.com; Path=/; Secure; HttpOnly; SameSite=none; Secure Set-Cookie: arcki2_pubmatic=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F!20220908!1702977767840; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:47 GMT; Domain=audrte.com; Path=/; Secure; HttpOnly; SameSite=none; Secure Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
960	192.168.2.16	51004	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:47 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:05; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
961	192.168.2.16	51020	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	3441	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_904=16787-43oyCfC7C9qx1UXE5GCBZQ; KRTBCOOKIE_107=1471-uid:lif0y6A21Rfwjb5&KRTB&23421-uid:lif0y6A21Rfwjb5; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; PugT=1702977765; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8
2023-12-19 09:22:47 UTC	663	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:46 GMT; path=/ Set-Cookie: PugT=1702977766; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:46 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
962	192.168.2.16	51019	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	3438	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:UzeiMh5u1Rfwja5&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_904=16787-43oyCfC7C9qx1UXE5GCBZQ; KRTBCOOKIE_107=1471-uid:lif0y6A21Rfwjb5&KRTB&23421-uid:lif0y6A21Rfwjb5; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-ba980058-5caf-45f8-a0d5-453c01d53d44&KRTB&23340-ba980058-5caf-45f8-a0d5-453c01d53d44&KRTB&23498-ba980058-5caf-45f8-a0d5-453c01d53d44; PugT=1702977765
2023-12-19 09:22:47 UTC	614	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:46 GMT; path=/ Set-Cookie: PugT=1702977766; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:46 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
963	192.168.2.16	51022	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	748	OUT	GET /s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=Ch8KBgjSARDiFgoGCKIBEOIWCgUIChDiFgoGCIsBEOIW; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:47 UTC	617	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:47 GMT Content-Length: 0 Connection: close Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 Set-Cookie: _li_ss=CioKBQgKEOIWCgYIogEQ4hYKCQj_____BxDsFgoGCIsBEOIWCgYI0gEQ4hY; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:47 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:47 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 1 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port
964	192.168.2.16	51023	54.156.158.209	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	766	OUT	GET /?io.narrative.guid.v2=2ad92430-9e50-11ee-9828-02e4221a2b5f&companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: io.narrative.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: io.narrative.guid.v2=297e2810-9e50-11ee-b479-0e71178f036d
2023-12-19 09:22:47 UTC	130	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Date: Tue, 19 Dec 2023 09:22:47 GMT Server: nginx/1.22.1 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
965	192.168.2.16	50999	44.238.140.201	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	230	OUT	POST /webservices/eulaservice.asmx HTTP/1.1 Connection: Keep-Alive Content-Type: text/xml; charset=utf-8 Host: home.mcafee.com User-Agent: SA SOAPAction: http://home.mcafee.com/SaveEulaTrackingDetails Content-Length: 986
2023-12-19 09:22:47 UTC	986	OUT	Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 0a 09 3c 73 3a 42 6f 64 79 3e 0a 09 09 3c 53 61 76 65 45 75 6c 61 54 72 61 63 6b 69 6e 67 44 65 74 61 69 6c 73 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 68 6f 6d 65 2e 6d 63 61 66 65 65 2e 63 6f 6d 2f 22 3e 0a 09 09 09 3c 65 75 6c 61 54 72 61 63 6b 69 6e 67 52 65 71 75 65 73 74 49 6e 66 6f 3e 0a 09 09 09 09 3c 43 6f 6e 74 65 78 74 54 79 70 65 3e 33 3c 2f 43 6f 6e 74 65 78 74 54 79 70 65 3e 0a 09 09 09 09 3c 43 Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SaveEulaTrackingDetails xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://home.mcafee.com/"><eulaTrackingRequestInfo><ContextType>3</ContextType><C
2023-12-19 09:22:48 UTC	2423	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 412 Connection: close Cache-Control: private, max-age=0 Server: McAfee X-Robots-Tag: noindex, nofollow Server-Timing: intid;desc=32d550179d8e260a Set-Cookie: session%5Fdata=%3cSessionData%3e%0d%0a++%3ctempfrlu%3e%3c%2ftempfrlu%3e%0d%0a%3c%2fSessionData%3e; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: SiteID=1; domain=mcafee.com; expires=Mon, 19-Dec-2033 09:22:47 GMT; path=/; secure; HttpOnly Set-Cookie: langid=1; domain=mcafee.com; expires=Fri, 19-Dec-2053 09:22:47 GMT; path=/; secure; HttpOnly Set-Cookie: SessionInfo=AffiliateId=0; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: lBounceURL=; domain=mcafee.com; expires=Mon, 18-Dec-2023 09:22:47 GMT; path=/; secure; HttpOnly Set-Cookie: lUsrCtxPersist=; domain=mcafee.com; expires=Mon, 19-Dec-2033 09:22:48 GMT; path=/; secure; HttpOnly Set-Cookie: lUsrCtxSession=%3cUserContext%3e%3cAffID%3e0%3c%2fAffID%3e%3cAffBuildID%3e0%3c%2fAffBuildID%3e%3c%2fUserContext%3e; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: Locale=EN-US; domain=mcafee.com; expires=Mon, 19-Dec-2033 09:22:48 GMT; path=/; secure; HttpOnly Set-Cookie: HPrst=gu=97e99f39-9e45-4659-affe-3397c6686e40&loc=EN-US; domain=mcafee.com; expires=Mon, 19-Dec-2033 09:22:48 GMT; path=/; secure; HttpOnly Set-Cookie: AffID=0-0; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: Currency=56; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: HRntm=iodtf=iq5nNK-ISQc78yUmSkAv9A2&atf=&rf=&hcof=iq5nNK-ISQc78yUmSkAv9A2&emailid=&usrrefid=&optin=&optinvalues=&aff=0-0&cur=56&pple=iq5nNK-ISQc78yUmSkAv9A2&inur=iq5nNK-ISQc78yUmSkAv9A2&ituof=iq5nNK-ISQc78yUmSkAv9A2&ieu=iq5nNK-ISQc78yUmSkAv9A2&isr=iq5nNK-ISQc78yUmSkAv9A2&sbo=iq5nNK-ISQc78yUmSkAv9A2&om_icr=iq5nNK-ISQc78yUmSkAv9A2&om_upsa=iq5nNK-ISQc78yUmSkAv9A2&ttprdt=iq5nNK-ISQc78yUmSkAv9A2&flgn=iq5nNK-ISQc78yUmSkAv9A2&pbinfo=iq5nNK-ISQc78yUmSkAv9A2&rnwtrk=&clicksrctrk=&rqwtrk=&rqwtrkhs=&vpp=iq5nNK-ISQc78yUmSkAv9A2&mip=iq5nNK-ISQc78yUmSkAv9A2; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: Acpc=; domain=mcafee.com; expires=Mon, 19-Dec-2033 09:22:48 GMT; path=/; secure; HttpOnly Set-Cookie: Acsc=; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: Aksc=; domain=mcafee.com; path=/; secure; HttpOnly SN: EC2AMAZ-IHPODTK X-Frame-Options: ALLOW-FROM https://home.mcafee.com
2023-12-19 09:22:48 UTC	412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 53 61 76 65 45 75 6c 61 54 72 61 63 6b 69 6e 67 44 65 74 61 69 6c 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><SaveEulaTrackingDetailsResponse xmln

Session ID	Source IP	Source Port	Destination IP	Destination Port
966	192.168.2.16	51027	54.156.158.209	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	766	OUT	GET /?io.narrative.guid.v2=2bafae10-9e50-11ee-a180-0a02e9f38595&companyId=673&id=pubmatic_id:5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: io.narrative.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: io.narrative.guid.v2=297e2810-9e50-11ee-b479-0e71178f036d
2023-12-19 09:22:48 UTC	130	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Date: Tue, 19 Dec 2023 09:22:47 GMT Server: nginx/1.22.1 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
967	192.168.2.16	51026	50.57.31.206	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	730	OUT	GET /pubmatic/1/info2?sType=sync&sExtCookieId=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F&sInitiator=external&gdpr=0&gdpr_consent= HTTP/1.1 Host: uipglob.semasio.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: SEUNCY=807AB52AB40D16D9
2023-12-19 09:22:48 UTC	580	IN	HTTP/1.1 200 OK Content-Type: image/gif UIP-Response-Status: Ok Frontend-ID: 8 Set-Cookie: SEUNCY=807AB52AB40D16D9; Expires=Wed, 18 Dec 2024 09:22:47 GMT; Path=/; Domain=.semasio.net; SameSite=None; HttpOnly; Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2011 12:00:00 GMT P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT" Pragma: no-cache Date: Tue, 19 Dec 2023 09:22:47 GMT Content-Length: 42 Routing-Server-ID: -1 Access-Control-Allow-Origin: * Connection: close
2023-12-19 09:22:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
968	192.168.2.16	51028	162.248.18.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	3407	OUT	GET /AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP/1.1 Host: image8.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; PugT=1702942302
2023-12-19 09:22:48 UTC	1170	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Location: https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: SyncRTB3=1704153600%3A166_96_48_231_81_250_220_54_104_7_243_238_21_233_5_3_99_8_55_240_176_13_56_46_234_264_22_249_214_165_178_71%7C1703548800%3A2_223_15%7C1704240000%3A35%7C1705536000%3A224%7C1703808000%3A63; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Set-Cookie: ipc=0^^2^0; domain=pubmatic.com; path=/; max-age=3; SameSite=None; secure; Set-Cookie: pi=0:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=6; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Length: 224 Connection: close
2023-12-19 09:22:48 UTC	224	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 74 63 68 2e 61 64 73 62 79 2e 62 69 64 74 68 65 61 74 72 65 2e 63 6f 6d 2f 70 75 62 6d 61 74 69 63 6d 61 74 63 68 3f 72 65 64 69 72 3d 68 74 74 70 73 3a 2f 2f 73 69 6d 61 67 65 32 2e 70 75 62 6d 61 74 69 63 2e 63 6f 6d 2f 41 64 53 65 72 76 65 72 2f 50 75 67 3f 76 63 6f 64 65 3d 62 7a 30 79 4a 6e 52 35 63 47 55 39 4d 53 5a 6a 62 32 52 6c 50 54 4d 77 4e 6a 49 6d 64 47 77 39 4d 54 49 35 4e 6a 41 77 26 61 6d 70 3b 70 69 67 67 79 62 61 63 6b 43 6f 6f 6b 69 65 3d 75 69 64 3a 24 55 49 44 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
969	192.168.2.16	51031	52.7.115.91	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	925	OUT	GET /cookie-sync?gdpr=0&gdpr=0&userid=5184721251378344538&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=4 HTTP/1.1 Host: match.prod.bidr.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: bitoIsSecure=ok; checkForPermission=ok; bito=AACk507LAsIAABM7-sg6gA
2023-12-19 09:22:48 UTC	468	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:48 GMT location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AACk507LAsIAABM7-sg6gA&gdpr=0&gdpr_consent= Server: gunicorn set-cookie: bito=AACk507LAsIAABM7-sg6gA; Domain=bidr.io; expires=Fri, 17 Jan 2025 04:22:48 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=2592000; includeSubDomains Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
970	192.168.2.16	51029	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	3460	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_904=16787-43oyCfC7C9qx1UXE5GCBZQ; KRTBCOOKIE_107=1471-uid:lif0y6A21Rfwjb5&KRTB&23421-uid:lif0y6A21Rfwjb5; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-ba980058-5caf-45f8-a0d5-453c01d53d44&KRTB&23340-ba980058-5caf-45f8-a0d5-453c01d53d44&KRTB&23498-ba980058-5caf-45f8-a0d5-453c01d53d44; PugT=1702977765
2023-12-19 09:22:48 UTC	604	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:32:46 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:32:46 GMT; path=/ Set-Cookie: PugT=1702942366; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:32:46 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
971	192.168.2.16	51030	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	3342	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=GH_JvDj8VjdvrBlOavHmp2aBmNQ&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; PugT=1702941566; SPugT=1702977763
2023-12-19 09:22:48 UTC	709	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:31:49 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:31:49 GMT; path=/ Set-Cookie: PugT=1702942309; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:31:49 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
972	192.168.2.16	51036	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	2129	OUT	GET /merge?pid=26&3pid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&gdpr=&gdpr_consent=&us_privacy= HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; _ljtrtb_87=5aea8bca-e090-4802-94d3-585fd3816e26; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_26=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; ljtrtb=eJyNUcuO2zAM%2FBefS0BPiurNUexAWafZvJpNLgvLslwgwLZpFu1mi%2F57pR567o0YzgyH5K9KU%2FWx0nMnNUkL7bwlUK4hqI12wLRjqmnqemba6kPFMXPRWpZEimA5G0ENKQFpw3MVes4swzEFQE0cWdSgtZZZqWxWHpZs8Sp38bI9UcaEyRiXSlmdJJjRKlACBQRMGqLRQo2YQoymcDOVWSI1J8mxFYrPOTkyvOGEDHlD1mUasczrNk6d3aMHvoSm24uM26JHRInKoNDaKLKS8ZLC8P%2Ffn%2BQ%2F%2BxMC97A81oeCq4yfT%2B3E7%2BH8cI27l%2Bl6uPn7675efC59nft17S6ama6%2B%2Bey3MnCbcKpLuHKH7RPIIfGgegGIQYBSSQBJlJDIDiJwOZLSwJguhn8fcbx39q7fXetOP78%2F7t4W88mu%2BtDRnnWj9N8u8n090Y83eSsfKNnbzZdnPzt88tKvZ7sl22y214ftV%2B93q%2FXxKbKWP%2FvuCC%2FlLmWEMCPGZBB6HntgNCKIKCyoNLAwmICBTPX7D%2Bh0kGg%3D; _ljtrtb_80=LQC4ZCY6-1I-JWAU
2023-12-19 09:22:48 UTC	3791	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:48 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_26=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_87=5aea8bca-e090-4802-94d3-585fd3816e26; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkk1v2zAMhv9LziOgD4qidrMdO3DqrEvSLE0uhWVJGRCgW5Ziazrsv0%2FqeYfdCPLh9%2Ft7Znj2cWbmjTasHXTzjgGblqGypgFhGoFtW1W17WYfZooyK7WKo0cGkj4BxjGBG8kBJo9JsJjYT5mVhSXnRFIpgJMiAk4pARsrs%2BVHKZygmDyQYUkiGDDG6JyJLmfulmLxorfhvDlw6WzfOyM6kzTY6BBQkQJPyUCwRmGk5EOwhc2o03WDVFeyygtwS7Xu2taR0HOhqrbFjLHI3LBu8NgcCGQPy321y35X8olIE1pSxlhkp4UsU1j5%2F7di%2Fe%2FyjNl%2FPHQnefPHu0vYPp8uu2t%2Fe3moFl9K3OR4VTVnI%2BxQXftcb2XheqJTVYYrd9g8gp6S9DgqIPIKEJMC1qQhsZuUlzoyGhDClILvj9jfBnczb03XHH79%2BLx9XcxPbjX6gR%2FEEHX%2F%2Fazf7k%2F881VfywfK7N3661Nf7z71ur%2Bvt0uxXm8ud5tvfb9d3e8fg%2BjkUz%2Fs4bncpbRQNlJIlmCUYQTBkUAFVXQxCT9ZT57Ld7hsYMY4ZpmMELMIAFkocBg0GDYp6CyHmKX25y%2FTWqbf; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_26=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:48 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
973	192.168.2.16	51032	34.117.239.71	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	1041	OUT	GET /match?bidder_id=10&external_user_id=132eab48-61bf-4eaf-9a69-4fb4f080c8bc&ts=1702977765&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1 Host: events-ssc.33across.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 33x_ps=u%3D212294706585447%3As1%3D1702977747632%3Ats%3D1702977747632
2023-12-19 09:22:48 UTC	257	IN	HTTP/1.1 200 OK content-type: image/png cache-control: no-cache, no-store, max-age=0, must-revalidate Content-Length: 68 Date: Tue, 19 Dec 2023 09:22:48 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:48 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
974	192.168.2.16	51037	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	2118	OUT	GET /merge?3pid=OPUfcf5109a1a63427ca17f2e650a5ade17&gdpr=0&gdpr_consent=&pid=103 HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; _ljtrtb_87=5aea8bca-e090-4802-94d3-585fd3816e26; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_26=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; ljtrtb=eJyNUcuO2zAM%2FBefS0BPiurNUexAWafZvJpNLgvLslwgwLZpFu1mi%2F57pR567o0YzgyH5K9KU%2FWx0nMnNUkL7bwlUK4hqI12wLRjqmnqemba6kPFMXPRWpZEimA5G0ENKQFpw3MVes4swzEFQE0cWdSgtZZZqWxWHpZs8Sp38bI9UcaEyRiXSlmdJJjRKlACBQRMGqLRQo2YQoymcDOVWSI1J8mxFYrPOTkyvOGEDHlD1mUasczrNk6d3aMHvoSm24uM26JHRInKoNDaKLKS8ZLC8P%2Ffn%2BQ%2F%2BxMC97A81oeCq4yfT%2B3E7%2BH8cI27l%2Bl6uPn7675efC59nft17S6ama6%2B%2Bey3MnCbcKpLuHKH7RPIIfGgegGIQYBSSQBJlJDIDiJwOZLSwJguhn8fcbx39q7fXetOP78%2F7t4W88mu%2BtDRnnWj9N8u8n090Y83eSsfKNnbzZdnPzt88tKvZ7sl22y214ftV%2B93q%2FXxKbKWP%2FvuCC%2FlLmWEMCPGZBB6HntgNCKIKCyoNLAwmICBTPX7D%2Bh0kGg%3D; _ljtrtb_80=LQC4ZCY6-1I-JWAU
2023-12-19 09:22:48 UTC	3791	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:48 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_26=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_87=5aea8bca-e090-4802-94d3-585fd3816e26; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNkk1v2zAMhv9LziOgD4qidrMdO3DqrEvSLE0uhWVJGRCgW5Ziazrsv0%2FqeYfdCPLh9%2Ft7Znj2cWbmjTasHXTzjgGblqGypgFhGoFtW1W17WYfZooyK7WKo0cGkj4BxjGBG8kBJo9JsJjYT5mVhSXnRFIpgJMiAk4pARsrs%2BVHKZygmDyQYUkiGDDG6JyJLmfulmLxorfhvDlw6WzfOyM6kzTY6BBQkQJPyUCwRmGk5EOwhc2o03WDVFeyygtwS7Xu2taR0HOhqrbFjLHI3LBu8NgcCGQPy321y35X8olIE1pSxlhkp4UsU1j5%2F7di%2Fe%2FyjNl%2FPHQnefPHu0vYPp8uu2t%2Fe3moFl9K3OR4VTVnI%2BxQXftcb2XheqJTVYYrd9g8gp6S9DgqIPIKEJMC1qQhsZuUlzoyGhDClILvj9jfBnczb03XHH79%2BLx9XcxPbjX6gR%2FEEHX%2F%2Fazf7k%2F881VfywfK7N3661Nf7z71ur%2Bvt0uxXm8ud5tvfb9d3e8fg%2BjkUz%2Fs4bncpbRQNlJIlmCUYQTBkUAFVXQxCT9ZT57Ld7hsYMY4ZpmMELMIAFkocBg0GDYp6CyHmKX25y%2FTWqbf; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_103=OPUfcf5109a1a63427ca17f2e650a5ade17; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:48 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
975	192.168.2.16	51024	34.251.97.118	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	846	OUT	GET /ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: a.audrte.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: arcki2=7dgq4c7QFIzTHuTAOIJ4wmO8w!20220908!1702977766779!ip#102.129.152.212; arcki2_pubmatic=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F!20220908!1702977766779
2023-12-19 09:22:48 UTC	672	IN	HTTP/1.1 302 Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:48 GMT Location: https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent= Server: nginx/1.22.1 Set-Cookie: arcki2_ddp2=7dgq4c7QFIzTHuTAOIJ4wmO8w!20220908!1702977768252; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:48 GMT; Domain=audrte.com; Path=/; Secure; HttpOnly; SameSite=none; Secure Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
976	192.168.2.16	51013	44.238.140.201	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	230	OUT	POST /webservices/eulaservice.asmx HTTP/1.1 Connection: Keep-Alive Content-Type: text/xml; charset=utf-8 Host: home.mcafee.com User-Agent: SA SOAPAction: http://home.mcafee.com/SaveEulaTrackingDetails Content-Length: 994
2023-12-19 09:22:47 UTC	994	OUT	Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 0a 09 3c 73 3a 42 6f 64 79 3e 0a 09 09 3c 53 61 76 65 45 75 6c 61 54 72 61 63 6b 69 6e 67 44 65 74 61 69 6c 73 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 68 6f 6d 65 2e 6d 63 61 66 65 65 2e 63 6f 6d 2f 22 3e 0a 09 09 09 3c 65 75 6c 61 54 72 61 63 6b 69 6e 67 52 65 71 75 65 73 74 49 6e 66 6f 3e 0a 09 09 09 09 3c 43 6f 6e 74 65 78 74 54 79 70 65 3e 33 3c 2f 43 6f 6e 74 65 78 74 54 79 70 65 3e 0a 09 09 09 09 3c 43 Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SaveEulaTrackingDetails xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://home.mcafee.com/"><eulaTrackingRequestInfo><ContextType>3</ContextType><C
2023-12-19 09:22:48 UTC	2423	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 412 Connection: close Cache-Control: private, max-age=0 Server: McAfee X-Robots-Tag: noindex, nofollow Server-Timing: intid;desc=9f9ee320f99e18a5 Set-Cookie: session%5Fdata=%3cSessionData%3e%0d%0a++%3ctempfrlu%3e%3c%2ftempfrlu%3e%0d%0a%3c%2fSessionData%3e; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: SiteID=1; domain=mcafee.com; expires=Mon, 19-Dec-2033 09:22:47 GMT; path=/; secure; HttpOnly Set-Cookie: langid=1; domain=mcafee.com; expires=Fri, 19-Dec-2053 09:22:47 GMT; path=/; secure; HttpOnly Set-Cookie: SessionInfo=AffiliateId=0; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: lBounceURL=; domain=mcafee.com; expires=Mon, 18-Dec-2023 09:22:47 GMT; path=/; secure; HttpOnly Set-Cookie: lUsrCtxPersist=; domain=mcafee.com; expires=Mon, 19-Dec-2033 09:22:48 GMT; path=/; secure; HttpOnly Set-Cookie: lUsrCtxSession=%3cUserContext%3e%3cAffID%3e0%3c%2fAffID%3e%3cAffBuildID%3e0%3c%2fAffBuildID%3e%3c%2fUserContext%3e; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: Locale=EN-US; domain=mcafee.com; expires=Mon, 19-Dec-2033 09:22:48 GMT; path=/; secure; HttpOnly Set-Cookie: HPrst=gu=67ad5b28-34fc-4a30-b528-b3032c3e32e8&loc=EN-US; domain=mcafee.com; expires=Mon, 19-Dec-2033 09:22:48 GMT; path=/; secure; HttpOnly Set-Cookie: AffID=0-0; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: Currency=56; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: HRntm=iodtf=iq5nNK-ISQc78yUmSkAv9A2&atf=&rf=&hcof=iq5nNK-ISQc78yUmSkAv9A2&emailid=&usrrefid=&optin=&optinvalues=&aff=0-0&cur=56&pple=iq5nNK-ISQc78yUmSkAv9A2&inur=iq5nNK-ISQc78yUmSkAv9A2&ituof=iq5nNK-ISQc78yUmSkAv9A2&ieu=iq5nNK-ISQc78yUmSkAv9A2&isr=iq5nNK-ISQc78yUmSkAv9A2&sbo=iq5nNK-ISQc78yUmSkAv9A2&om_icr=iq5nNK-ISQc78yUmSkAv9A2&om_upsa=iq5nNK-ISQc78yUmSkAv9A2&ttprdt=iq5nNK-ISQc78yUmSkAv9A2&flgn=iq5nNK-ISQc78yUmSkAv9A2&pbinfo=iq5nNK-ISQc78yUmSkAv9A2&rnwtrk=&clicksrctrk=&rqwtrk=&rqwtrkhs=&vpp=iq5nNK-ISQc78yUmSkAv9A2&mip=iq5nNK-ISQc78yUmSkAv9A2; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: Acpc=; domain=mcafee.com; expires=Mon, 19-Dec-2033 09:22:48 GMT; path=/; secure; HttpOnly Set-Cookie: Acsc=; domain=mcafee.com; path=/; secure; HttpOnly Set-Cookie: Aksc=; domain=mcafee.com; path=/; secure; HttpOnly SN: EC2AMAZ-4BR6NSM X-Frame-Options: ALLOW-FROM https://home.mcafee.com
2023-12-19 09:22:48 UTC	412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 53 61 76 65 45 75 6c 61 54 72 61 63 6b 69 6e 67 44 65 74 61 69 6c 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><SaveEulaTrackingDetailsResponse xmln

Session ID	Source IP	Source Port	Destination IP	Destination Port
977	192.168.2.16	51039	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	3584	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:230C3A6911DC4BB0ABF9299139F39B54&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_904=16787-43oyCfC7C9qx1UXE5GCBZQ; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; PugT=1702977766
2023-12-19 09:22:48 UTC	318	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:29:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	1	IN	Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
978	192.168.2.16	51041	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	3559	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:UzeiMh5u1Rfwja5&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_904=16787-43oyCfC7C9qx1UXE5GCBZQ; KRTBCOOKIE_107=1471-uid:lif0y6A21Rfwjb5&KRTB&23421-uid:lif0y6A21Rfwjb5; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; PugT=1702977765
2023-12-19 09:22:48 UTC	614	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:46 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:46 GMT; path=/ Set-Cookie: PugT=1702977766; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:46 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
979	192.168.2.16	51035	8.2.110.134	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	716	OUT	GET /e08dd6156d5e964da4fe396e97a25abc.gif?puid=132eab48-61bf-4eaf-9a69-4fb4f080c8bc HTTP/1.1 Host: cs.krushmedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: krm_usr=ae67145e-4e6a-59f0-a89d-071ebeee2681; krm_r=572
2023-12-19 09:22:48 UTC	563	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Length: 0 Connection: close Set-Cookie: krm_usr=ae67145e-4e6a-59f0-a89d-071ebeee2681; path=/; domain=.krushmedia.com; expires=Tue, 02 Jan 2024 09:22:48 GMT;SameSite=None;Secure Set-Cookie: krm_r=572\|339; path=/; domain=.krushmedia.com; expires=Tue, 02 Jan 2024 09:22:48 GMT;SameSite=None;Secure Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Location: https://sync.springserve.com/usersync?aid=1917&uuid=ae67145e-4e6a-59f0-a89d-071ebeee2681

Session ID	Source IP	Source Port	Destination IP	Destination Port
980	192.168.2.16	51033	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	1006	OUT	GET /csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: sync.targeting.unrulymedia.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D
2023-12-19 09:22:48 UTC	628	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:48 GMT content-type: text/html transfer-encoding: chunked set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:48 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
981	192.168.2.16	51034	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:47 UTC	929	OUT	GET /csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%26us_privacy%3D1--- HTTP/1.1 Host: sync.targeting.unrulymedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D
2023-12-19 09:22:48 UTC	644	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:48 GMT content-type: text/html transfer-encoding: chunked set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:48 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&us_privacy=1--- etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
982	192.168.2.16	51040	69.194.240.13	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	849	OUT	GET /csync/RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D97%263pid%3DRX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%26us_privacy%3D1--- HTTP/1.1 Host: sync.targeting.unrulymedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D
2023-12-19 09:22:48 UTC	578	IN	HTTP/1.1 302 Found date: Tue, 19 Dec 2023 09:22:48 GMT content-type: text/html transfer-encoding: chunked set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005%22%7D; path=/; expires=Wed, 18 Dec 2024 09:22:48 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why" location: https://ce.lijit.com/merge?pid=97&3pid=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&us_privacy=1--- etag: RX3cf1b4a266b244f28363f89c2b13e845005 connection: close
2023-12-19 09:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
983	192.168.2.16	51043	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	3540	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=kD5c8C9HCfKvLTiX3mCBZQ HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; PugT=1702977767
2023-12-19 09:22:48 UTC	587	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:48 GMT; path=/ Set-Cookie: PugT=1702977768; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:48 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
984	192.168.2.16	51050	18.239.225.91	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	1210	OUT	GET /pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=968907273661960568&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3Da4612a01-e9ec-45c4-bd44-397ee7f54411%253A1702977757.5650773%26pid%3D500040%26it%3D1%26iv%3Da4612a01-e9ec-45c4-bd44-397ee7f54411%253A1702977757.5650773%26_%3D1702977760.1927698 HTTP/1.1 Host: live.rezync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: zync-uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411:1702977757.5650773; sd-session-id=.eJwNylEOgyAMANC79FsWKqW1XMYw7BKyyRZxPzPefX6-5B0wf2xbc7O2Q9q3rw1QXvVSh3RAr7_VnpBAeVIvowRmVPaRJzgH6NZ7fbe5LlfJxDhmj87UiqNYyN0XIhdUzOQRiRATih9VRKLcIkcvEuD8A5LaJVc.ZYFg5Q.WLtUFq4p_JT-CsoamxKMWDWMZx8
2023-12-19 09:22:48 UTC	1069	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 651 Connection: close Date: Tue, 19 Dec 2023 09:22:48 GMT Location: https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977757.5650773&pid=500040&it=1&iv=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977757.5650773&_=1702977760.1927698 Set-Cookie: zync-uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411:1702977757.5650773; Domain=rezync.com; Expires=Sun, 12 Jan 2025 09:22:48 GMT; Path=/; SameSite=None; Secure Set-Cookie: sd-session-id=.eJwNylEOgyAMANC79FsWKqW1XMYw7BKyyRZxPzPefX6-5B0wf2xbc7O2Q9q3rw1QXvVSh3RAr7_VnpBAeVIvowRmVPaRJzgH6NZ7fbe5LlfJxDhmj87UiqNYyN0XIhdUzOQRiRATih9VRKLcIkcvEuD8A5LaJVc.ZYFg6A.vgLq36l7W_x5gLuVIqG6kKRwe2o; Expires=Sun, 12 Jan 2025 09:22:48 GMT; HttpOnly; Path=/; SameSite=None; Secure Vary: Cookie Server: lighttpd/1.4.69 X-Cache: Miss from cloudfront Via: 1.1 cbe4325ad36a5e433aca98cb0212142c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P8 X-Amz-Cf-Id: asBTpAwfN5Ni5LmThXQwxoDr_itLc_h_LzgUASEI6z8T-wZ3_XXMWA==
2023-12-19 09:22:48 UTC	651	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 73 68 6f 75 6c 64 20 62 65 20 72 65 64 69 72 65 63 74 65 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 74 6f 20 74 68 65 20 74 61 72 67 65 74 20 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 2e 6c 69 61 64 6d 2e 63 6f 6d 2f 73 2f 35 36 34 30 39 3f 62 69 64 64 65 72 5f 69 64 3d 32 30 30 34 34 32 26 61 6d 70 3b 62 69 64 64 65 72 5f 75 75 69 64 3d 61 34 36 31 32 61 30 31 2d 65 39 65 63 2d 34 35 63 34 2d 62 64 34 34 2d 33 39 37 65 65 37 66 35 34 34 31 31 25 33 41 Data Ascii: <!doctype html><html lang=en><title>Redirecting...</title><h1>Redirecting...</h1><p>You should be redirected automatically to the target URL: <a href="https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A

Session ID	Source IP	Source Port	Destination IP	Destination Port
985	192.168.2.16	51044	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:48 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:06; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
986	192.168.2.16	51047	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	3562	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; PugT=1702940541
2023-12-19 09:22:48 UTC	663	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:19:31 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:19:31 GMT; path=/ Set-Cookie: PugT=1702941571; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:19:31 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
987	192.168.2.16	51049	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	876	OUT	GET /s/56409?bidder_id=200442&bidder_uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977757.5650773&pid=500040&it=1&iv=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977757.5650773&_=1702977757.5676894 HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=Ch8KBgjSARDiFgoGCKIBEOIWCgUIChDiFgoGCIsBEOIW; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:48 UTC	632	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Length: 0 Connection: close Location: https://pippio.com/api/sync?it=1&pid=500040&_=1702977757.5676894&iv=a4612a01-e9ec-45c4-bd44-397ee7f54411:1702977757.5650773 Set-Cookie: _li_ss=Ch8KBgjSARDiFgoGCKIBEOIWCgUIChDiFgoGCIsBEOIW; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:48 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:48 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port
988	192.168.2.16	51053	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	3581	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:7a2e6581-60d7-4800-933d-354f6ed2801e&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_904=16787-43oyCfC7C9qx1UXE5GCBZQ; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; PugT=1702977766
2023-12-19 09:22:48 UTC	604	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 18-Mar-2024 09:22:48 GMT; path=/ Set-Cookie: PugT=1702977768; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:48 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
989	192.168.2.16	51054	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	748	OUT	GET /s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=Ch8KBgjSARDiFgoGCKIBEOIWCgUIChDiFgoGCIsBEOIW; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:48 UTC	617	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Length: 0 Connection: close Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 Set-Cookie: _li_ss=CioKBQgKEOIWCgYIogEQ4hYKCQj_____BxDsFgoGCIsBEOIWCgYI0gEQ4hY; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:48 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:48 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 1 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port
990	192.168.2.16	51055	172.64.151.101	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	782	OUT	GET /rum?cm_dsp_id=64&external_user_id=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&gdpr=0&gdpr_consent= HTTP/1.1 Host: r.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:48 UTC	972	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e954d2cc17432-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:48 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:48 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5Yb%2B9HOQGr%2FO4mqvi5pJNcxoxSQkC0XtBTb7lBHDBsoN1tS4jjJC3vkXm0Y8HN2tPM5FRMqQYJPwGKRwMPCECkekc3ZVbpcqStxmgyw0VvR5%2FFlfsOQUEHQC%2BgFx41nB%2B03T"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:48 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
991	192.168.2.16	51058	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	1836	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=6d575774-a2c7-43b3-8920-b16815799026&gdpr=0&gdpr_consent= HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; PugT=1702977750; chkChromeAb67Sec=3; DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; SyncRTB3=1704153600%3A250_178_13_231_22_54_21_166_220_3_71_55_48_104%7C1703808000%3A63%7C1703548800%3A15_223; ipc=159706^https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D^2^0; pi=159706:3; SPugT=1702942220
2023-12-19 09:22:48 UTC	788	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:47 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_279=22890-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23011-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23355-6d575774-a2c7-43b3-8920-b16815799026; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:47 GMT; path=/ Set-Cookie: PugT=1702977767; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:47 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
992	192.168.2.16	51057	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	1846	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33645_10DEE0DD2_1DEE3DE&r=https://pmp.mxptint.net/sn.ashx?ak=1 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; PugT=1702977750; chkChromeAb67Sec=3; DPSync3=1702944000%3A255%7C1704153600%3A259_263_262_260_201_261%7C1703030400%3A248%7C1703894400%3A257%7C1704067200%3A256_258%7C1703548800%3A265; SyncRTB3=1704153600%3A250_178_13_231_22_54_21_166_220_3_71_55_48_104%7C1703808000%3A63%7C1703548800%3A15_223; ipc=159706^https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D^2^0; SPugT=1702942220; KTPCACOOKIE=YES
2023-12-19 09:22:48 UTC	655	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:47 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_52=22772-R33645_10DEE0DD2_1DEE3DE&KRTB&23092-R33645_10DEE0DD2_1DEE3DE; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:47 GMT; path=/ Set-Cookie: PugT=1702977767; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:47 GMT; path=/ Location: https://pmp.mxptint.net/sn.ashx?ak=1 P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
993	192.168.2.16	51059	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	3571	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AACk507LAsIAABM7-sg6gA&gdpr=0&gdpr_consent= HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; SyncRTB3=1704153600%3A166_96_48_231_81_250_220_54_104_7_243_238_21_233_5_3_99_8_55_240_176_13_56_46_234_264_22_249_214_165_178_71%7C1703548800%3A2_223_15%7C1704240000%3A35%7C1705536000%3A224%7C1703808000%3A63; ipc=0^^2^0; pi=0:3; chkChromeAb67Sec=6; PugT=1702942309
2023-12-19 09:22:48 UTC	672	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:19:14 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_699=22727-AACk507LAsIAABM7-sg6gA; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:19:14 GMT; path=/ Set-Cookie: PugT=1702941554; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:19:14 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
994	192.168.2.16	51060	18.209.128.131	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	798	OUT	GET /pixel?type=sync&source=rubicon&inventory_source=0 HTTP/1.1 Host: beacon.lynx.cognitivlabs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=06541c94-4d82-4719-9759-25cada24ab50; ss=TGu%2FOad%2FXYkOKl9lQpldYSFHR7s9%2BA8ZAEflC%2FW5AgL6Odx5jcXxMYcP8GVMOHZuumx2TBHMtbeWya1HsSizRg%3D%3D
2023-12-19 09:22:48 UTC	529	IN	HTTP/1.1 302 Found Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Length: 0 Connection: close Server: Kestrel Location: https://pixel.rubiconproject.com/token?pid=49038&puid=06541c94-4d82-4719-9759-25cada24ab50 Set-Cookie: UID=06541c94-4d82-4719-9759-25cada24ab50; expires=Thu, 19 Dec 2024 09:22:48 GMT; path=/; secure; samesite=none Set-Cookie: ss=zVEdCgE%2Fo%2FoMdJBUXCIiY8fU78GzluCaxLl5%2FBRE%2FO4rwVH2eXHlaz9oxAyi1xLi7iqNv3%2FnIbAC7mmw1khrzQ%3D%3D; expires=Thu, 19 Dec 2024 09:22:48 GMT; path=/; secure; samesite=none

Session ID	Source IP	Source Port	Destination IP	Destination Port
995	192.168.2.16	51062	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	2533	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7402232151745586090&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^2^0; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; PugT=1702977755; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; DPSync3=1703548800%3A253_265_252%7C1704153600%3A245_262_201_259_260_261_263%7C1703894400%3A257%7C1703030400%3A248_255%7C1704067200%3A258_256; SyncRTB3=1704153600%3A46_249_21_220_5_165_8_13_71_231_166_55_104_233_22_54_48_240_176_250_178_3%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab
2023-12-19 09:22:48 UTC	721	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:47 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_22=14911-7402232151745586090&KRTB&23150-7402232151745586090&KRTB&23527-7402232151745586090; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:47 GMT; path=/ Set-Cookie: PugT=1702977767; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:47 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=1--- P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
996	192.168.2.16	51063	69.175.41.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	2225	OUT	GET /merge?pid=97&3pid=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&us_privacy=1--- HTTP/1.1 Host: ce.lijit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; _ljtrtb_92=6663647625574893018; _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; _ljtrtb_83=LQC4ZCY6-1I-JWAU; _ljtrtb_85=AACk507LAsIAABM7-sg6gA; _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; _ljtrtb_49=UJ0Gt3SdkRY8; _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; _ljtrtb_87=5aea8bca-e090-4802-94d3-585fd3816e26; _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; _ljtrtb_26=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; _ljtrtb_80=LQC4ZCY6-1I-JWAU; ljtrtb=eJyNkk1v2zAMhv9LziOgD4qidrMdO3DqrEvSLE0uhWVJGRCgW5Ziazrsv0%2FqeYfdCPLh9%2Ft7Znj2cWbmjTasHXTzjgGblqGypgFhGoFtW1W17WYfZooyK7WKo0cGkj4BxjGBG8kBJo9JsJjYT5mVhSXnRFIpgJMiAk4pARsrs%2BVHKZygmDyQYUkiGDDG6JyJLmfulmLxorfhvDlw6WzfOyM6kzTY6BBQkQJPyUCwRmGk5EOwhc2o03WDVFeyygtwS7Xu2taR0HOhqrbFjLHI3LBu8NgcCGQPy321y35X8olIE1pSxlhkp4UsU1j5%2F7di%2Fe%2FyjNl%2FPHQnefPHu0vYPp8uu2t%2Fe3moFl9K3OR4VTVnI%2BxQXftcb2XheqJTVYYrd9g8gp6S9DgqIPIKEJMC1qQhsZuUlzoyGhDClILvj9jfBnczb03XHH79%2BLx9XcxPbjX6gR%2FEEHX%2F%2Fazf7k%2F881VfywfK7N3661Nf7z71ur%2Bvt0uxXm8ud5tvfb9d3e8fg%2BjkUz%2Fs4bncpbRQNlJIlmCUYQTBkUAFVXQxCT9ZT57Ld7hsYMY4ZpmMELMIAFkocBg0GDYp6CyHmKX25y%2FTWqbf; _ljtrtb_103=OPUfcf5109a1a63427ca17f2e650a5ade17
2023-12-19 09:22:48 UTC	3968	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 19 Dec 2023 09:22:48 GMT Expires: Fri, 20 Mar 2009 00:00:00 GMT Set-Cookie: _ljtrtb_80=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_92=6663647625574893018; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_58=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_26=132eab48-61bf-4eaf-9a69-4fb4f080c8bc; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_27=134495f3-7e94-4262-b6f5-d7524e6fbdd7; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_16=6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_49=UJ0Gt3SdkRY8; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_71=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_83=LQC4ZCY6-1I-JWAU; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_84=ZYFg1ybZKqdSngqUsIytTAGV; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_85=AACk507LAsIAABM7-sg6gA; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_2=93BC46BA1AC048E6B3FEE9603D02AEE4; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_86=6WyL9y5zCFCYwrPSxGDg9MabL8T0Le3Ipk3zOg8vx3s; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_76=27e6df76-a1da-08e6-2d29-4fc0bc7b6b87; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_43=FQh_IBUNI3IOBSJ0QQRqKRoIISMOWXd0F1_ILW-n; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_87=5aea8bca-e090-4802-94d3-585fd3816e26; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: _ljtrtb_103=OPUfcf5109a1a63427ca17f2e650a5ade17; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;Secure;SameSite=None Set-Cookie: ljtrtb=eJyNUstuGzEM%2FBefS0APkpJ6213vGps4dWzHdexLIK0kFwiQNnXQxin675Fy7qE3gRoOh8P5MyM7%2BzyjeafJagfDfLCAXW%2BhMdSBoE5g3zdNa4bZp5nigpVaJR%2FQAsuQAZPP4Dw7wBwwCysmG6aClRXLzomscgQnRQKccgZLRpZX8FI4wSkHYLKSRSQgIl060ZXO3ZVYvOhtfNwcbJ1sPiYjOsoaTHIIqFhB4EwQDSlMnEOMpmIL1Om2Q24b2ZQFbM%2BtHvresdBzoZq%2BxypQ6AJc3e7ylKmI8dKzRmUmL01WiUl48jHJSmlFgS7XHR67A4Mc4Wrf7Erd1VnMrBkNKyKD1mkhq2Ij%2F99Xq%2F9Nb7HUj4fhJC%2FheP0ct0%2Bn5915vLzcNYuv9Z%2FKf9N0jyTMsjmPhe%2FGwPnEp6aKq55t7kFPWQb0CpiDAsSswGrWkK2bVJA6WSQQgirhx9H2l6W70Fs3dIffP2%2B3r4v5yd34sLR3Ypn0%2BONRv61O9terPtdrVe3D%2BtvD2O6%2BjHpctdsrsV5vnq8338dxe7Pa30cxyIdxuYen6ksdoUzimA2Dl9GDsIlBRVUzNIkwmcDBftheNyCffImUh1QCA2iFAodRA1nKUZfopBLLv%2B%2Bd%2FrI4; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: _ljtrtb_97=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljtrtbexp=eJyrVjJSsjI0NzAxtDA3NrHQUbIwQeUbGqApMDID840NjAwswXxzCN%2FUwsjUxKIWAJhXEE8%3D; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Set-Cookie: ljt_reader=H2KyTBZHDmz9_ZgQSoi2z_V6; Path=/; Domain=.lijit.com; Expires=Wed, 18-Dec-2024 09:22:48 GMT; Max-Age=31536000;Secure;SameSite=None Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Content-Type: image/gif Content-Length: 43 X-Sovrn-Pod: ad_ap2ord1
2023-12-19 09:22:48 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
997	192.168.2.16	51045	54.149.12.26	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	217	OUT	PUT /mosaic/2.0/product-web/wa/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json X-API-Key: Rs5OAGab1B91bDm6iAFfma19H9Oj8Nmd6JGBQ135 Content-Length: 6985 Host: analytics.apis.mcafee.com
2023-12-19 09:22:48 UTC	6985	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 65 76 65 6e 74 22 3a 7b 22 65 76 65 6e 74 74 79 70 65 22 3a 22 47 65 6e 61 70 70 5f 57 41 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 31 37 30 32 39 37 34 31 36 36 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 69 64 22 3a 22 37 62 33 65 64 31 61 38 2d 37 39 30 37 2d 34 33 36 61 2d 61 63 36 63 2d 36 34 30 62 66 64 35 64 62 38 30 63 22 2c 22 65 76 65 6e 74 5f 64 61 74 61 22 3a 7b 22 65 6c 22 3a 22 4c 61 75 6e 63 68 65 64 22 2c 22 52 65 63 6f 76 65 72 79 5f 41 74 74 65 6d 70 74 5f 4c 61 73 74 5f 45 72 72 6f 72 5f 43 48 22 3a 22 4e 6f 45 72 72 6f 72 22 2c 22 43 61 63 68 65 64 46 6f 72 4d 6f 72 65 54 68 61 6e 36 30 4d 69 6e 75 74 65 73 47 54 49 52 65 71 75 65 73 74 73 5f 45 58 4e 22 3a 22 28 44 69 76 69 73 69 6f 6e 20 62 79 20 30 29 Data Ascii: {"Data":{"event":{"eventtype":"Genapp_WA","timestamp":"1702974166","applicationid":"7b3ed1a8-7907-436a-ac6c-640bfd5db80c","event_data":{"el":"Launched","Recovery_Attempt_Last_Error_CH":"NoError","CachedForMoreThan60MinutesGTIRequests_EXN":"(Division by 0)
2023-12-19 09:22:49 UTC	304	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 133 Connection: close x-amzn-RequestId: d2862a59-214c-8e05-8f7d-49712620c39c x-amz-id-2: DgC63lEUdAJUhC0ERhIPgiOboCBmWVsq0dUAFVuNw2kRxIArDykgGDbaVJPNEYXyhJR3Z2To4fhB3lDaaaGhVmyFaO1jgxSm
2023-12-19 09:22:49 UTC	133	IN	Data Raw: 7b 22 45 6e 63 72 79 70 74 69 6f 6e 54 79 70 65 22 3a 22 4b 4d 53 22 2c 22 53 65 71 75 65 6e 63 65 4e 75 6d 62 65 72 22 3a 22 34 39 36 34 37 32 34 38 31 36 36 30 34 34 35 30 31 30 34 35 39 31 32 30 36 38 31 39 30 37 37 36 31 38 39 35 30 39 30 35 38 39 34 39 37 33 38 36 38 37 31 30 36 38 33 34 22 2c 22 53 68 61 72 64 49 64 22 3a 22 73 68 61 72 64 49 64 2d 30 30 30 30 30 30 30 30 30 32 34 31 22 7d Data Ascii: {"EncryptionType":"KMS","SequenceNumber":"49647248166044501045912068190776189509058949738687106834","ShardId":"shardId-000000000241"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
998	192.168.2.16	51065	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	3572	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; SyncRTB3=1704153600%3A166_96_48_231_81_250_220_54_104_7_243_238_21_233_5_3_99_8_55_240_176_13_56_46_234_264_22_249_214_165_178_71%7C1703548800%3A2_223_15%7C1704240000%3A35%7C1705536000%3A224%7C1703808000%3A63; ipc=0^^2^0; pi=0:3; chkChromeAb67Sec=6; PugT=1702977766
2023-12-19 09:22:48 UTC	748	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:19:14 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:19:14 GMT; path=/ Set-Cookie: PugT=1702941554; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:19:14 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
999	192.168.2.16	51068	3.223.167.169	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	696	OUT	GET /s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 HTTP/1.1 Host: i6.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:48 UTC	226	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Type: image/gif Content-Length: 43 Connection: close Request-Time: 0 Cache-Control: no-store Strict-Transport-Security: max-age=31536000; includeSubDomains
2023-12-19 09:22:48 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1000	192.168.2.16	51073	192.178.50.46	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	914	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dfheoggkfdfchfphceeifdbepaooicaho%26v%3D0.0.0.0%26installedby%3Dexternal%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: fheoggkfdfchfphceeifdbepaooicaho,nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:49 UTC	731	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-W0oPvSuNo-zQ9hnw0gGQVA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Dec 2023 09:22:49 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6196 X-Daystart: 4969 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:49 UTC	521	IN	Data Raw: 35 33 32 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 39 36 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 39 36 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 66 68 65 6f 67 67 6b 66 64 66 63 68 66 70 68 63 65 65 69 66 64 62 65 70 61 6f 6f 69 63 61 68 6f 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20 Data Ascii: 532<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6196" elapsed_seconds="4969"/><app appid="fheoggkfdfchfphceeifdbepaooicaho" cohort="1::" cohortname=""
2023-12-19 09:22:49 UTC	816	IN	Data Raw: 54 57 43 2d 48 56 7a 2d 6f 2f 46 48 45 4f 47 47 4b 46 44 46 43 48 46 50 48 43 45 45 49 46 44 42 45 50 41 4f 4f 49 43 41 48 4f 5f 38 5f 31 5f 30 5f 34 34 34 35 2e 63 72 78 22 20 66 70 3d 22 31 2e 37 65 66 31 65 36 37 61 62 65 38 38 31 37 61 30 31 36 66 37 66 35 32 32 64 35 62 36 32 34 61 30 39 32 33 65 35 37 66 61 61 62 30 65 33 39 65 33 33 34 38 33 37 66 32 39 62 30 62 31 63 63 32 62 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 37 65 66 31 65 36 37 61 62 65 38 38 31 37 61 30 31 36 66 37 66 35 32 32 64 35 62 36 32 34 61 30 39 32 33 65 35 37 66 61 61 62 30 65 33 39 65 33 33 34 38 33 37 66 32 39 62 30 62 31 63 63 32 62 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 33 37 33 32 36 33 34 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 Data Ascii: TWC-HVz-o/FHEOGGKFDFCHFPHCEEIFDBEPAOOICAHO_8_1_0_4445.crx" fp="1.7ef1e67abe8817a016f7f522d5b624a0923e57faab0e39e334837f29b0b1cc2b" hash_sha256="7ef1e67abe8817a016f7f522d5b624a0923e57faab0e39e334837f29b0b1cc2b" protected="0" size="3732634" status="ok" vers
2023-12-19 09:22:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1001	192.168.2.16	51074	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	891	OUT	GET /s/56409?bidder_id=200442&bidder_uuid=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977757.5650773&pid=500040&it=1&iv=a4612a01-e9ec-45c4-bd44-397ee7f54411%3A1702977757.5650773&_=1702977760.1927698 HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=CioKBQgKEOIWCgYIogEQ4hYKCQj_____BxDsFgoGCIsBEOIWCgYI0gEQ4hY; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:49 UTC	647	IN	HTTP/1.1 303 See Other Date: Tue, 19 Dec 2023 09:22:49 GMT Content-Length: 0 Connection: close Location: https://pippio.com/api/sync?it=1&pid=500040&_=1702977760.1927698&iv=a4612a01-e9ec-45c4-bd44-397ee7f54411:1702977757.5650773 Set-Cookie: _li_ss=CioKBQgKEOIWCgYIogEQ4hYKCQj_____BxDsFgoGCIsBEOIWCgYI0gEQ4hY; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:49 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:49 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 1 Strict-Transport-Security: max-age=31536000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port
1002	192.168.2.16	51061	54.149.12.26	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 419 Host: analytics.apis.mcafee.com
2023-12-19 09:22:48 UTC	419	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a 22 57 49 4e 22 2c 22 4f 53 5f 50 6c 61 74 66 6f 72 6d 22 3a 22 36 34 22 2c 22 4f 53 5f 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 31 2e 31 38 38 39 22 2c 22 50 72 6f 64 75 63 74 5f 56 65 72 73 69 6f 6e 22 3a 22 34 2e 31 2e 31 2e 38 35 31 22 2c 22 55 55 49 44 22 3a 22 7b 43 32 36 43 45 32 39 30 2d 42 35 39 37 2d 34 46 44 37 2d 42 34 41 35 2d 37 44 32 39 32 39 30 42 44 39 35 41 7d 22 2c 22 65 61 22 3a 22 43 6f 6d 70 6c 65 74 65 64 22 2c 22 65 63 22 3a 22 49 6e 73 74 61 6c 6c 65 72 22 2c 22 65 6c 22 3a 22 30 22 2c 22 72 32 22 3a 22 22 2c 22 72 33 22 Data Ascii: {"Data":{"Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":"WIN","OS_Platform":"64","OS_Version":"10.0.19041.1889","Product_Version":"4.1.1.851","UUID":"{C26CE290-B597-4FD7-B4A5-7D29290BD95A}","ea":"Completed","ec":"Installer","el":"0","r2":"","r3"
2023-12-19 09:22:49 UTC	304	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:49 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 133 Connection: close x-amz-id-2: viau6/JbYfD6XOzSDMy+ee+wZBBdNKN9mbjZD7G/hlWIwHuIgX+gvch45tT91H7JbBDH7Jo/VK/F7Sg96hOh3fyhkmyW0eJ0 x-amzn-RequestId: c05de874-c2de-c971-9da6-8b5dbda1d221
2023-12-19 09:22:49 UTC	133	IN	Data Raw: 7b 22 45 6e 63 72 79 70 74 69 6f 6e 54 79 70 65 22 3a 22 4b 4d 53 22 2c 22 53 65 71 75 65 6e 63 65 4e 75 6d 62 65 72 22 3a 22 34 39 36 34 37 31 36 35 36 32 39 37 38 32 32 38 31 30 34 33 33 35 35 33 30 37 39 39 36 36 38 37 35 38 34 31 32 38 34 33 35 33 32 39 32 35 32 32 37 31 38 34 39 35 32 32 22 2c 22 53 68 61 72 64 49 64 22 3a 22 73 68 61 72 64 49 64 2d 30 30 30 30 30 30 30 30 30 30 30 33 22 7d Data Ascii: {"EncryptionType":"KMS","SequenceNumber":"49647165629782281043355307996687584128435329252271849522","ShardId":"shardId-000000000003"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
1003	192.168.2.16	51070	64.227.64.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	803	OUT	GET /pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP/1.1 Host: match.adsby.bidtheatre.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __kuid=2233062b-d38a-4eaf-9e54-df74f8af0f43.472191766
2023-12-19 09:22:49 UTC	517	IN	HTTP/1.1 302 302 Date: Tue, 19 Dec 2023 09:22:49 GMT Server: Apache P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT" Set-Cookie: __kuid=2233062b-d38a-4eaf-9e54-df74f8af0f43.472191769; Max-Age=604800; Domain=.adsby.bidtheatre.com; SameSite=None; Secure Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:2233062b-d38a-4eaf-9e54-df74f8af0f43&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1004	192.168.2.16	51075	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	2732	OUT	GET /AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:1da3594a-a787-4bca-932d-676ba73d6ace&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; chkChromeAb67Sec=4; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; pi=156813:4; DPSync3=1703030400%3A248_255%7C1703894400%3A257%7C1704153600%3A261_201_245_263_259_262_260%7C1704067200%3A256_258%7C1703548800%3A253_252_265; SyncRTB3=1704240000%3A35%7C1703808000%3A63%7C1704153600%3A96_99_250_71_178_7_238_13_3_249_165_21_48_81_22_56_55_233_214_243_220_104_264_231_176_240_8_5_46_234_54_166%7C1703548800%3A2_223_15_38%7C1708128000%3A69%7C1705536000%3A224; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; PugT=1702941561
2023-12-19 09:22:49 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:32:48 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1005	192.168.2.16	51081	54.82.32.1	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	763	OUT	GET /s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 HTTP/1.1 Host: i.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _li_ss=CioKBQgKEOIWCgYIogEQ4hYKCQj_____BxDsFgoGCIsBEOIWCgYI0gEQ4hY; lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:49 UTC	556	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:49 GMT Content-Type: image/gif Content-Length: 43 Connection: close Set-Cookie: _li_ss=CioKBQgKEOIWCgYIogEQ4hYKCQj_____BxDsFgoGCIsBEOIWCgYI0gEQ4hY; Max-Age=2592000; Expires=Thu, 18 Jan 2024 09:22:49 GMT; SameSite=None; Path=/s; Secure Set-Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0; Max-Age=63072000; Expires=Thu, 18 Dec 2025 09:22:49 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure Request-Time: 0 Cache-Control: no-store Strict-Transport-Security: max-age=31536000; includeSubDomains
2023-12-19 09:22:49 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1006	192.168.2.16	51077	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	2961	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=6074270596568283332 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; SPugT=1702977754; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; DPSync3=1703548800%3A265_252_253%7C1703894400%3A257%7C1704153600%3A245_260_261_263_228_226_236_235_262_201_259%7C1704067200%3A256_258%7C1703030400%3A255_248; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; pi=159706:3; SyncRTB3=1704153600%3A13_240_46_166_54_48_3_56_165_55_104_176_250_220_5_233_22_178_21_8_249_71_231%7C1703548800%3A15_2_223%7C1703808000%3A63%7C1704240000%3A35; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0; PugT=1702977759
2023-12-19 09:22:49 UTC	731	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:49 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:49 GMT; path=/ Set-Cookie: PugT=1702977769; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:49 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1007	192.168.2.16	51072	34.251.97.118	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	846	OUT	GET /ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: a.audrte.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: arcki2=7dgKUmqxKU5QJKNdvTl5y8u7g!20220908!1702977767840!ip#102.129.152.212; arcki2_pubmatic=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F!20220908!1702977767840
2023-12-19 09:22:49 UTC	672	IN	HTTP/1.1 302 Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:49 GMT Location: https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent= Server: nginx/1.22.1 Set-Cookie: arcki2_ddp2=7dgKUmqxKU5QJKNdvTl5y8u7g!20220908!1702977769296; Max-Age=1296000; Expires=Wed, 03 Jan 2024 09:22:49 GMT; Domain=audrte.com; Path=/; Secure; HttpOnly; SameSite=none; Secure Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1008	192.168.2.16	51078	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:49 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:07; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1009	192.168.2.16	51082	107.178.254.65	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:48 UTC	764	OUT	GET /api/sync?it=1&pid=500040&_=1702977757.5676894&iv=a4612a01-e9ec-45c4-bd44-397ee7f54411:1702977757.5650773 HTTP/1.1 Host: pippio.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: did=jOOdTch8J-O5AN50; didts=1702977764; nnls=; pxrc=COTBhawGEgYIgr0rEAA=
2023-12-19 09:22:49 UTC	461	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: pxrc=COTBhawGEgYIgr0rEAA=; Path=/; Domain=pippio.com; Expires=Sat, 17 Feb 2024 09:22:49 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:49 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1010	192.168.2.16	51064	52.11.223.203	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	635	OUT	GET /usersync?aid=1917&uuid=ae67145e-4e6a-59f0-a89d-071ebeee2681 HTTP/1.1 Host: sync.springserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ce.lijit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:49 UTC	251	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:49 GMT Content-Type: image/gif Content-Length: 43 Connection: close Server: nginx Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2023-12-19 09:22:49 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1011	192.168.2.16	51084	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	3190	OUT	GET /AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:2233062b-d38a-4eaf-9e54-df74f8af0f43&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; PugT=1702942361; SPugT=1702977762; pi=159706:3
2023-12-19 09:22:49 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:19:15 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1012	192.168.2.16	51091	3.223.167.169	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	696	OUT	GET /s/35759?bidder_id=44489&bidder_uuid=134495f3-7e94-4262-b6f5-d7524e6fbdd7 HTTP/1.1 Host: i6.liadm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: lidid=a0aee609-2968-45de-a5d3-b77df9a421f0
2023-12-19 09:22:49 UTC	226	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:49 GMT Content-Type: image/gif Content-Length: 43 Connection: close Request-Time: 0 Cache-Control: no-store Strict-Transport-Security: max-age=31536000; includeSubDomains
2023-12-19 09:22:49 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1013	192.168.2.16	51089	162.248.18.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	3802	OUT	GET /AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP/1.1 Host: image8.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; SyncRTB3=1704153600%3A166_96_48_231_81_250_220_54_104_7_243_238_21_233_5_3_99_8_55_240_176_13_56_46_234_264_22_249_214_165_178_71%7C1703548800%3A2_223_15%7C1704240000%3A35%7C1705536000%3A224%7C1703808000%3A63; ipc=0^^2^0; pi=0:3; chkChromeAb67Sec=6; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; KRTBCOOKIE_52=22772-R33645_10DEE0DD2_1DEE3DE&KRTB&23092-R33645_10DEE0DD2_1DEE3DE; KRTBCOOKIE_279=22890-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23011-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23355-6d575774-a2c7-43b3-8920-b16815799026; KRTBCOOKIE_699=22727-AACk507LAsIAABM7-sg6gA; KRTBCOOKIE_22=14911-7402232151745586090&KRTB&23150-7402232151745586090&KRTB&23527-7402232151745586090; PugT=1702977767
2023-12-19 09:22:49 UTC	653	IN	HTTP/1.1 204 No Content Cache-Control: private,max-age=86400 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: ipc=; domain=pubmatic.com; path=/; max-age=0; SameSite=None; secure; Set-Cookie: pi=0:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=7; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1014	192.168.2.16	51085	38.98.69.175	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	726	OUT	GET /sn.ashx?ak=1 HTTP/1.1 Host: pmp.mxptint.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mxpim=R35CAB_10DEE0DDE_1DCF549.1.0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000658160DA
2023-12-19 09:22:49 UTC	242	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Date: Tue, 19 Dec 2023 09:22:48 GMT Connection: close Content-Length: 43 Strict-Transport-Security: max-age=-385982569; includeSubDomains
2023-12-19 09:22:49 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1015	192.168.2.16	51086	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	3477	OUT	GET /AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:264187a7-eca5-4baa-b291-3de237129b1c&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; PugT=1702942302
2023-12-19 09:22:49 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:49 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1016	192.168.2.16	51087	162.248.18.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	3787	OUT	GET /AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image8.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; SyncRTB3=1704153600%3A166_96_48_231_81_250_220_54_104_7_243_238_21_233_5_3_99_8_55_240_176_13_56_46_234_264_22_249_214_165_178_71%7C1703548800%3A2_223_15%7C1704240000%3A35%7C1705536000%3A224%7C1703808000%3A63; ipc=0^^2^0; pi=0:3; chkChromeAb67Sec=6; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; KRTBCOOKIE_52=22772-R33645_10DEE0DD2_1DEE3DE&KRTB&23092-R33645_10DEE0DD2_1DEE3DE; KRTBCOOKIE_279=22890-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23011-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23355-6d575774-a2c7-43b3-8920-b16815799026; KRTBCOOKIE_699=22727-AACk507LAsIAABM7-sg6gA; KRTBCOOKIE_22=14911-7402232151745586090&KRTB&23150-7402232151745586090&KRTB&23527-7402232151745586090; PugT=1702977767
2023-12-19 09:22:49 UTC	653	IN	HTTP/1.1 204 No Content Cache-Control: private,max-age=86400 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: ipc=; domain=pubmatic.com; path=/; max-age=0; SameSite=None; secure; Set-Cookie: pi=0:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=7; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1017	192.168.2.16	51088	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	3491	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&us_privacy=1--- HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; SyncRTB3=1704153600%3A166_96_48_231_81_250_220_54_104_7_243_238_21_233_5_3_99_8_55_240_176_13_56_46_234_264_22_249_214_165_178_71%7C1703548800%3A2_223_15%7C1704240000%3A35%7C1705536000%3A224%7C1703808000%3A63; ipc=0^^2^0; pi=0:3; chkChromeAb67Sec=6; PugT=1702942309
2023-12-19 09:22:49 UTC	745	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 18 Dec 2023 23:29:30 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 17-Mar-2024 23:29:30 GMT; path=/ Set-Cookie: PugT=1702942170; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:29:30 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=1--- P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1018	192.168.2.16	51090	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	3079	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7402232151745586090&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_153=1923-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&19420-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&22979-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE&KRTB&23462-wS9KosEqFvLaI0r2wy5f8pMqS6vaexaqwy9tSEqE; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; KRTBCOOKIE_1278=23329-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23340-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e&KRTB&23498-3e30a808-9cba-4af2-8a9a-587cb9a4ef9e; ipc=159706^https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%23PMUID^1^0; pi=0:4; DPSync3=1704067200%3A256_258%7C1703548800%3A265_253_252%7C1703894400%3A257%7C1704153600%3A262_263_236_235_228_201_260_226_245_259_261%7C1703030400%3A255_248; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; SPugT=1702942060; KRTBCOOKIE_18=22947-968907273661960568; PugT=1702940532
2023-12-19 09:22:49 UTC	721	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:49 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KRTBCOOKIE_22=14911-7402232151745586090&KRTB&23150-7402232151745586090&KRTB&23527-7402232151745586090; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:49 GMT; path=/ Set-Cookie: PugT=1702977769; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:49 GMT; path=/ Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=1--- P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1019	192.168.2.16	51093	107.178.254.65	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	764	OUT	GET /api/sync?it=1&pid=500040&_=1702977760.1927698&iv=a4612a01-e9ec-45c4-bd44-397ee7f54411:1702977757.5650773 HTTP/1.1 Host: pippio.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ssum-sec.casalemedia.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: did=jOOdTch8J-O5AN50; didts=1702977764; nnls=; pxrc=COTBhawGEgYIgr0rEAA=
2023-12-19 09:22:49 UTC	461	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: pxrc=COTBhawGEgYIgr0rEAA=; Path=/; Domain=pippio.com; Expires=Sat, 17 Feb 2024 09:22:49 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:49 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1020	192.168.2.16	51096	104.18.36.155	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	520	OUT	GET /rum?cm_dsp_id=65&external_user_id=AAAGUkmHgWjzvQM1zJFyAAAAAAA&expiration=1703064158&is_secure=true&us_privacy=1--- HTTP/1.1 Host: dsum.casalemedia.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMPS=2798; CMID=ZYFg02kDskXAcMABkyNPagAA; CMPRO=2798
2023-12-19 09:22:49 UTC	972	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 09:22:49 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 837e9554c8ff2593-MIA CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=ZYFg02kDskXAcMABkyNPagAA; Path=/; Domain=casalemedia.com; Expires=Wed, 18 Dec 2024 09:22:49 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=2798; Path=/; Domain=casalemedia.com; Expires=Mon, 18 Mar 2024 09:22:49 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WG4mUhe9j11CkFJOfz6PBIrPZp6nmUDTMsTyIFaep1S0nNMcrdsxB2N%2FO6edVDMpf9wAY0svBJWpK5seA4xw6uMCrF8T2CS6hM4hOTXK9Q3d7bTNT0yCwXK38LYqY%2Fef%2F08T6IB5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-19 09:22:49 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1021	192.168.2.16	51094	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	3231	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=6074270596568283332 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; PugT=1702941566; SPugT=1702977763
2023-12-19 09:22:49 UTC	646	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:48 GMT; path=/ Set-Cookie: PugT=1702977768; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:48 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1022	192.168.2.16	51095	162.248.18.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	3796	OUT	GET /AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP/1.1 Host: image8.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; SyncRTB3=1704153600%3A166_96_48_231_81_250_220_54_104_7_243_238_21_233_5_3_99_8_55_240_176_13_56_46_234_264_22_249_214_165_178_71%7C1703548800%3A2_223_15%7C1704240000%3A35%7C1705536000%3A224%7C1703808000%3A63; ipc=0^^2^0; pi=0:3; chkChromeAb67Sec=6; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; KRTBCOOKIE_52=22772-R33645_10DEE0DD2_1DEE3DE&KRTB&23092-R33645_10DEE0DD2_1DEE3DE; KRTBCOOKIE_279=22890-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23011-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23355-6d575774-a2c7-43b3-8920-b16815799026; KRTBCOOKIE_699=22727-AACk507LAsIAABM7-sg6gA; KRTBCOOKIE_22=14911-7402232151745586090&KRTB&23150-7402232151745586090&KRTB&23527-7402232151745586090; PugT=1702977769
2023-12-19 09:22:49 UTC	653	IN	HTTP/1.1 204 No Content Cache-Control: private,max-age=86400 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: ipc=; domain=pubmatic.com; path=/; max-age=0; SameSite=None; secure; Set-Cookie: pi=0:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=7; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1023	192.168.2.16	51097	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:49 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:07; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1024	192.168.2.16	51098	142.250.189.129	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	553	OUT	GET /crx/blobs/AeKPYwwEzYTl0vFkak-Nivy76IhRWJ6Epwfm2-9737o2Ax0IqMG9gYCi9i8z7-6qzqMYps7BEGbdumj59NI_I5desPPmraNRFEpQrkAr3hqDtY5mySkLogDGUprlngEXn3EeC7UEwlT-LpTWC-HVz-o/FHEOGGKFDFCHFPHCEEIFDBEPAOOICAHO_8_1_0_4445.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:50 UTC	586	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPrXlBT2bljnSnG7YEScf06rBkrmrBDuA20vdyxPOYyyjxCpa16Mgpdit2BpRddOFlNjC44PFVxvfxwekWZVlfsOAw Accept-Ranges: bytes Content-Length: 3732634 X-Goog-Hash: crc32c=LmujLQ== Server: UploadServer Date: Tue, 19 Dec 2023 03:28:36 GMT Expires: Wed, 18 Dec 2024 03:28:36 GMT Cache-Control: public, max-age=31536000 Age: 21253 Last-Modified: Wed, 29 Nov 2023 16:50:44 GMT ETag: 55f00011_9e1e084a_db0f1a58_276f81ad_63721867 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:50 UTC	666	IN	Data Raw: 43 72 32 34 03 00 00 00 1a 04 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 8f fb bf 5c 37 63 94 3c b0 ee 01 c4 b5 a6 9a b1 9f 46 74 6f 16 38 a0 32 27 35 dd f0 71 6b 0e dc f6 25 cb b2 ed ea fb 32 d5 af 1e 03 43 03 46 f0 a7 39 db 23 96 1d 65 e5 78 51 f0 84 b0 0e 12 ac 0e 5b dc c9 d6 4c 7c 00 d5 b8 1b 88 33 3e 2f da eb aa f7 1a 75 c2 ae 3a 54 de 37 8f 10 d2 28 e6 84 79 4d 15 b4 f3 bd 3f 56 d3 3c 3f 18 ab fc 2e 05 c0 1e 08 31 b6 61 d0 fd 9f 4f 3f 64 0d 17 93 bc ad 41 c7 48 be 00 27 a8 4d 70 42 92 05 54 a6 6d b8 de 56 6e 20 49 70 ee 10 3e 6b d2 7c 31 bd 1b 6e a4 3c 46 62 9f 08 66 93 f9 2a 51 31 a8 db b5 9d b9 0f 73 e8 a0 09 32 01 e9 7b 2a 8a 36 a0 cf 17 b0 50 70 9d a2 f9 a4 6f 62 4d Data Ascii: Cr240"0H0\7c<Fto82'5qk%2CF9#exQ[L\|3>/u:T7(yM?V<?.1aO?dAH'MpBTmVn Ip>k\|1n<FbfQ1s2{*6PpobM
2023-12-19 09:22:50 UTC	1252	IN	Data Raw: 00 8c 03 29 40 b3 0d ea b0 e7 54 bb 7f c6 0b c1 bf 07 d4 72 a5 4e 5f 6b e6 26 fc c1 15 43 61 ad 28 62 01 ca 3a eb 66 6d 25 10 f6 07 83 2c 86 c8 e8 82 01 6d 5a fa 41 0e 2d d5 5d 1c e9 af 52 34 8c 0d 2d 53 02 03 01 00 01 12 80 01 83 ef 8d 88 a3 3a 16 da 21 fe 78 94 64 cf e7 19 8f 44 9a 8f eb 5b 26 7d 1e ff 1d f2 19 07 bf 12 bb a5 6d 8c fa 02 7c ee 64 6d e4 10 c1 a3 ec e5 9c 0c e8 e2 f9 56 ac 0e 7c 79 79 dc c2 77 87 08 8d 15 38 6c 70 da fc e1 c5 b3 d5 be 81 09 51 b3 cf 26 7b d5 fe 9a d3 14 2d 29 0f 82 f8 3a ea 41 54 a1 93 48 2f 22 9a 21 7b 76 c2 b3 d6 68 f6 06 0f 12 52 6b 49 6f b1 25 9f 01 25 53 4a ed cf 32 1a a7 01 0a 5b 30 59 30 13 06 07 2a 86 48 ce 3d 02 01 06 08 2a 86 48 ce 3d 03 01 07 03 42 00 04 b4 02 f9 a9 1c ae e1 0c 84 f8 dc 9b 17 72 98 a5 e0 32 d5 Data Ascii: )@TrN_k&Ca(b:fm%,mZA-]R4-S:!xdD[&}m\|dmV\|yyw8lpQ&{-):ATH/"!{vhRkIo%%SJ2[0Y0H=H=Br2
2023-12-19 09:22:50 UTC	1252	IN	Data Raw: d5 c5 6a 8d 26 1b dd b6 24 b3 9a 93 4d ad 4f 75 ad 69 37 9e 04 9f 69 9a 93 17 59 bb a6 d3 3f 92 a4 8f 2a de 2d 90 28 b4 a3 a9 dd 65 2f af 32 92 05 af 1b 92 8a f9 f5 f7 09 a4 23 7d 90 76 c5 c6 94 66 85 dd 41 52 f5 c7 e5 2e f9 a8 3f 6d fd 43 0f e8 4b 1f 26 9f 6b fb 14 35 1d 7d 8c 4e 6f 93 f3 79 17 41 dd 76 9b a4 55 b9 9c fa 3d f6 33 64 3a 9e 27 59 4e 07 4d a5 b5 6e e8 c5 32 a1 c7 2f d2 bc 7b ef e8 16 a3 3f a7 bd 5e e9 dd 09 cd f5 db 8e 9e 3f b7 aa 77 9b d6 9c ab 55 4e 1f a5 25 ac 2a 5d a3 71 f3 e2 64 d9 8e f6 f9 33 b3 25 b9 d5 26 83 77 a6 72 7d b6 d9 42 ab ba 3a 29 4d 3d 3a f9 9f c8 cd 94 64 3c 04 75 a0 05 ff ce e1 1b 94 6f a3 bd 5a e2 47 dc 8b 83 b6 ba a3 e4 6b 12 28 17 b4 f8 10 df 2d ad 0c 36 f6 d6 4d 18 4b 47 7f 07 d3 54 15 c1 4d 4c b7 ca 6a 7d 75 b1 d7 Data Ascii: j&$MOui7iY?-(e/2#}vfAR.?mCK&k5}NoyAvU=3d:'YNMn2/{?^?wUN%]qd3%&wr}B:)M=:d<uoZGk(-6MKGTMLj}u
2023-12-19 09:22:50 UTC	1252	IN	Data Raw: d6 fc bb cb 32 79 f3 47 45 53 b0 c5 ff d1 14 9c 8b 3e a3 20 29 f3 9a 96 0a 3f d1 c5 df 8a 5c a5 1f 44 d6 d3 60 48 c2 ce cf fd a3 2f 3f 3e 34 61 f5 6e 45 d2 e1 72 d0 65 e9 db 51 f2 98 4e aa 68 6c b4 12 aa c5 36 48 3a fa d3 f5 8f 45 b6 75 8a 11 6d 8f 8b dc a4 f8 cd 25 9f be 0c 73 2c 6b 87 fd 96 6d b3 16 3e a4 ab 1f 68 ed 92 55 d6 f2 bb b8 cf ec 3e 8d 48 c0 55 f9 76 f3 0f bf 0d 09 80 15 4e a1 35 85 e4 12 0b ce 46 a0 7a 78 a1 a7 31 13 e1 ec f3 01 82 af 05 ae 05 53 59 85 2d 6c e5 ea d5 9e 0f 2c 1b 62 d4 99 52 6d ec 79 93 59 dc 25 86 ad 05 4c ef 74 9c cd 5d c6 69 ac c7 07 fd 62 31 53 38 8f da e3 d5 c3 53 ad a1 e5 54 ac 64 89 8e dc 6b 9b 4e 0f c2 5b 30 95 65 99 69 17 5c d1 d2 55 32 54 5a b8 a4 a5 bb ab f5 3f 56 68 1b c7 fa 99 bc 6e f7 0c 4e 57 d0 ca 96 2e e0 1f Data Ascii: 2yGES> )?\D`H/?>4anEreQNhl6H:Eum%s,km>hU>HUvN5Fzx1SY-l,bRmyY%Lt]ib1S8STdkN[0ei\U2TZ?VhnNW.
2023-12-19 09:22:50 UTC	1252	IN	Data Raw: 91 14 78 05 37 b9 1d bc 88 fc e1 02 ce 18 45 e9 69 c7 0d 5d fd 19 33 40 c2 dc b0 4f 6d 91 68 0e ab 8a 0f c6 cd a9 e9 5a 5c ac ce 91 47 5f 59 d7 8a 35 11 53 60 aa ed f2 d0 ad 80 0d df 2b 59 ac af c2 bd 4d 0f 2c 70 69 b6 6a 9f 9d 3b c5 28 f4 92 07 4b 50 64 67 bb c0 75 e4 96 de 35 0a 9f 10 6d 76 9c 55 5c d4 7b ba 18 e7 97 c8 75 8c 4e b2 29 06 33 f0 38 5b d1 8d 4e fb 29 f9 87 a5 79 f9 af ff 42 5f 3c 36 64 06 3d 2b d4 ee 58 42 6a ff fa 2f d3 55 da be 55 5c 40 d4 0f 12 39 6a 6b a3 0f 7c b8 20 bf 32 99 5b 55 97 fe 17 a6 3e 53 55 b6 a7 a5 2b b3 b0 eb ee 1d 2b 65 ed 9b f4 34 7d 96 e5 4d 91 ad 34 cf b2 49 a1 5a ca 71 58 d3 21 78 f3 47 04 22 07 bf 5e 91 05 6f cd 1e 5a 52 92 c9 fd 57 19 29 b1 34 e7 24 03 68 20 34 b1 4d 49 77 3e 7f ac 52 40 02 d5 e2 cd ea df 08 7b f9 Data Ascii: x7Ei]3@OmhZ\G_Y5S`+YM,pij;(KPdgu5mvU\{uN)38[N)yB_<6d=+XBj/UU\@9jk\| 2[U>SU++e4}M4IZqX!xG"^oZRW)4$h 4MIw>R@{
2023-12-19 09:22:50 UTC	1252	IN	Data Raw: 19 ef f4 b6 40 0c 88 50 1f 27 5a d1 a5 39 bd 23 cf ef 70 47 4e 74 76 0f d0 2c 39 40 36 f0 17 3a 64 5c e0 19 94 38 32 64 5d a3 04 4e 4a 92 d0 b4 8c 59 e1 7b 87 65 08 d9 22 25 fc e1 70 93 d4 d9 d5 25 7e d3 b5 ea 5c f0 ec d5 5e d7 2b 6b 77 15 a2 d5 a6 a4 18 2e b1 bb 4a dc 82 1c e1 bd f9 90 78 f7 db ac 6b b4 93 c0 9a 87 dc 5c 70 e3 e2 12 e0 58 b8 0a 3c 0b 0d be 40 02 d4 46 0b 0b d5 c2 f2 48 39 12 5b b1 a8 a5 31 b1 2b 59 8c 46 ff 79 df 02 67 01 ec 90 41 60 75 5b f7 31 46 3d 90 2e 3b dd 8c e6 1e 9b b1 d0 67 74 0f 97 a2 98 44 a3 7b 66 05 5f 0a fd 9d e6 75 5e f1 48 75 ab b2 61 78 1a 6e 50 f7 ae 87 96 d8 10 60 8f 2b b3 28 b2 45 af 91 03 25 07 0b c8 bb 40 fb 56 c6 6f d1 cc d1 e7 48 89 69 eb 2e 6f 3b ba 91 20 70 dc 49 a0 4d 14 a2 17 c4 48 b3 1d d8 06 20 37 ba 12 6b Data Ascii: @P'Z9#pGNtv,9@6:d\82d]NJY{e"%p%~\^+kw.Jxk\pX<@FH9[1+YFygA`u[1F=.;gtD{f_u^HuaxnP`+(E%@VoHi.o; pIMH 7k
2023-12-19 09:22:50 UTC	1252	IN	Data Raw: d8 06 40 74 04 91 76 80 a2 70 2d 2e f1 1f fb 08 3c a0 1a 71 5a 49 50 0e a2 85 26 a5 ad 2e dd df 62 27 21 f7 71 6b 6c 0a 8c db b6 83 eb 58 fc fb cc 43 40 f7 ec 42 80 b9 c9 a7 45 de c0 37 ae 3a f6 53 f2 3f 5c d4 9d ec 56 c8 5a ba 8d db 98 63 bf 7a f1 76 87 dd 1e b1 3d c7 74 c9 68 e2 b0 a4 d3 58 fa 89 81 01 d1 47 4c 25 dc 11 82 8e c3 f7 2f 43 17 04 b6 8b c3 87 dc 22 50 80 30 3a 35 39 88 c3 f5 c0 f5 e0 23 73 87 d0 dc e7 76 0d b5 35 97 88 10 40 97 48 ef 76 de b4 c9 76 0d 5e 5d b1 48 66 5b b1 a3 85 55 69 e7 1a 23 69 28 e2 c4 6b ee 2c 52 c4 80 1b 79 79 9d 74 13 65 3e 4c 87 22 43 81 74 0f 5a 9f 72 08 79 ab 58 7d 61 dd 7c eb 01 a7 21 64 ad b7 49 06 d8 b5 6f 96 b5 20 9a 9e 90 88 6b 55 88 bf 83 4f a4 cf 6b 1a f9 50 6d 07 db 51 c8 d3 75 6e 60 3b c7 ba 81 3e 07 1d a1 Data Ascii: @tvp-.<qZIP&.b'!qklXC@BE7:S?\VZczv=thXGL%/C"P0:59#sv5@Hvv^]Hf[Ui#i(k,Ryyte>L"CtZryX}a\|!dIo kUOkPmQun`;>
2023-12-19 09:22:50 UTC	1252	IN	Data Raw: ad cd a9 6e bc ad 5f f6 80 6d 38 42 04 08 5e 0e d2 36 a1 31 e1 e6 3e a0 6a 06 80 79 7b d3 92 12 86 ab c0 08 56 2b 0a fb b7 70 78 0b 25 74 ac 03 1e bf 4f 7b e4 cf ce 46 10 0b 07 56 21 5c f4 b4 27 a6 73 f2 96 49 85 f4 37 ad 4a e7 79 64 97 89 73 8d f4 9a 9b 8d 93 70 63 9b a2 3b fb 59 c6 8c 2f 92 b6 2a 89 1a 1c ad 80 bb 7b df f9 fc 7b cb 8a a8 53 07 a3 a2 bb 88 2f e9 b5 8b 66 4c cd c8 e6 3e 9e 20 9e d6 ab 1f 60 bb 03 67 4a b6 a1 d9 b0 55 bb 26 6b 8b 11 60 92 7d 54 6b f9 29 0c a1 90 42 64 9f 62 9d 20 45 d6 67 b6 ec e4 42 b4 b7 24 fa 2d 28 c1 94 8c 61 f9 e8 5a ec 4a ff 6e 6a ec b1 f0 fa 34 ee 25 18 cf aa a3 6b 18 da d6 8f 24 3e f0 09 76 3b be 46 6a 2f 68 f8 72 2f ef b5 97 1c 5b b6 6b 5f b3 f0 50 08 ff 08 f3 8d 93 7f af 8f 92 5f c9 58 b8 cf 93 84 1c 16 85 34 12 Data Ascii: n_m8B^61>jy{V+px%tO{FV!\'sI7Jydspc;Y/*{{S/fL> `gJU&k`}Tk)Bdb EgB$-(aZJnj4%k$>v;Fj/hr/[k_P_X4
2023-12-19 09:22:50 UTC	1252	IN	Data Raw: 38 c6 de c7 26 80 32 1a 85 0a 13 17 2e 7c 2f e5 2b a4 b3 7d 6d 1e 3d eb 9b b4 e1 3d 20 64 e4 c1 2e b8 e0 6c 0c 20 60 47 1e e8 bc e0 82 b2 3d a9 fa 7f da 3c ab c0 ef ea 73 b5 a0 e6 3d ff f8 d9 fb d4 81 09 8d ce bd b4 a9 09 2a a3 87 02 88 33 2c ed 53 06 38 dc ae f3 01 c1 ca 3d 08 5d a6 a0 e6 c9 37 f5 f9 51 62 29 ec 55 97 33 09 35 6e 45 a6 5d cc 15 a7 64 b9 6c a0 5d fc d4 f9 a3 16 1c 3f 6f c7 76 a1 ed 1d 00 cd 6f 81 1c b8 09 c2 30 41 5e be e5 aa dc 1d 18 67 15 61 46 f9 08 95 a5 b8 c6 39 20 ce c8 b5 61 dc bc 19 5c 8f 9e 3d c9 05 3a 6e 09 ae 16 50 2e a9 90 a5 70 a4 72 af a6 c4 94 53 87 b6 a0 f8 76 13 0c df e5 0c 82 6f 12 26 bc 8f 5e dd ab 81 eb ba 5b a2 b8 c4 b6 2b ce ae 2e 6a e7 c0 a0 07 56 57 97 15 27 83 91 a2 22 12 f3 8c 74 db 29 41 72 73 1f de eb 40 5f dc Data Ascii: 8&2.\|/+}m== d.l `G=<s=*3,S8=]7Qb)U35nE]dl]?ovo0A^gaF9 a\=:nP.prSvo&^[+.jVW'"t)Ars@_
2023-12-19 09:22:50 UTC	1252	IN	Data Raw: 23 b0 47 c9 53 4e 1f 0f 78 81 a9 cb 91 47 69 5b a9 35 73 08 ba e4 0c 33 29 f5 90 27 c3 52 51 01 3e b6 f4 26 21 c3 0c ca 5e 02 1e 40 c7 f5 10 be e0 64 c8 e5 9d 5b b7 98 10 bf f6 c2 36 d6 f3 50 49 5b 16 e6 6c 17 1f 9f 65 b3 25 1d 09 f4 f6 df 0a b4 2d 78 f0 42 1e 9c ea 03 d9 4f 96 37 98 33 b0 dd 2b 31 03 cd b1 74 d7 47 d9 27 62 0e e2 2d 7d 74 4b e0 8a 72 d3 59 56 a7 4b 5b bb c1 6f 37 88 be b3 da 74 1b 0e 06 df 86 89 ac 57 a9 16 01 2f fa 6b 17 03 4a b3 6d 96 3a 30 c5 40 e9 9a 32 38 df 33 66 ea c3 88 41 e2 49 6e 9a 52 03 46 08 0b 72 a3 eb 3c e4 10 c5 05 7e f5 e7 74 98 cd 18 94 4c 49 0d b2 df 72 4b b8 35 43 c1 1b 2f 4b 55 ed 75 9f a5 b4 70 c4 24 72 ed 84 91 c5 b0 5c 40 33 48 98 ef 59 7f 87 ab 48 62 f1 db 9e a6 d8 d0 8a d6 c8 29 6b b5 ad 11 42 53 d3 a5 19 d4 63 Data Ascii: #GSNxGi[5s3)'RQ>&!^@d[6PI[le%-xBO73+1tG'b-}tKrYVK[o7tW/kJm:0@283fAInRFr<~tLIrK5C/KUup$r\@3HYHb)kBSc

Session ID	Source IP	Source Port	Destination IP	Destination Port
1025	192.168.2.16	51100	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:49 UTC	3477	OUT	GET /AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:2233062b-d38a-4eaf-9e54-df74f8af0f43&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; PugT=1702942302
2023-12-19 09:22:50 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:30:48 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1026	192.168.2.16	51102	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:50 UTC	3267	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7402232151745586090&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_1278=23329-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23340-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f&KRTB&23498-ee0677cf-aba2-4ee9-bdad-dca5c68ce18f; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; KRTBCOOKIE_904=16787-trdyDQMND--pvQOH4GCBZQ; PugT=1702941566; SPugT=1702977763
2023-12-19 09:22:50 UTC	644	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1 Connection: close Set-Cookie: KRTBCOOKIE_22=14911-7402232151745586090&KRTB&23150-7402232151745586090&KRTB&23527-7402232151745586090; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:48 GMT; path=/ Set-Cookie: PugT=1702977768; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:48 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:50 UTC	1	IN	Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1027	192.168.2.16	51101	34.251.97.118	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:50 UTC	908	OUT	GET /ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: a.audrte.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: arcki2=7dgKUmqxKU5QJKNdvTl5y8u7g!20220908!1702977767840!ip#102.129.152.212; arcki2_pubmatic=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F!20220908!1702977767840; arcki2_ddp2=7dgq4c7QFIzTHuTAOIJ4wmO8w!20220908!1702977768252
2023-12-19 09:22:50 UTC	474	IN	HTTP/1.1 302 Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:50 GMT Location: https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent= Server: nginx/1.22.1 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1028	192.168.2.16	51103	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:50 UTC	3456	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=6074270596568283332 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; PugT=1702942302
2023-12-19 09:22:50 UTC	646	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:49 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:49 GMT; path=/ Set-Cookie: PugT=1702977769; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:49 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1029	192.168.2.16	51104	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:50 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:50 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:08; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1030	192.168.2.16	51105	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:50 UTC	3492	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7402232151745586090&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; PugT=1702942302
2023-12-19 09:22:50 UTC	644	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1 Connection: close Set-Cookie: KRTBCOOKIE_22=14911-7402232151745586090&KRTB&23150-7402232151745586090&KRTB&23527-7402232151745586090; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:50 GMT; path=/ Set-Cookie: PugT=1702977770; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:50 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:50 UTC	1	IN	Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1031	192.168.2.16	51106	34.117.223.223	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:50 UTC	244	OUT	POST /v4/receive/json/25 HTTP/1.1 Host: analytics.avcdn.net User-Agent: libcurl/8.2.1-DEV Schannel zlib/1.2.11 c-ares/1.19.0 nghttp2/1.48.0 Accept: / Accept-Encoding: deflate, gzip Content-Type: application/json Content-Length: 3180
2023-12-19 09:22:50 UTC	3180	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 0a 09 22 65 76 65 6e 74 22 20 3a 20 0a 09 7b 0a 09 09 22 72 65 71 75 65 73 74 5f 69 64 22 20 3a 20 22 33 37 34 37 38 63 36 36 2d 33 36 32 63 2d 34 62 33 62 2d 62 33 31 38 2d 63 62 38 63 37 37 32 65 37 66 31 62 22 2c 0a 09 09 22 73 75 62 74 79 70 65 22 20 3a 20 31 2c 0a 09 09 22 74 69 6d 65 22 20 3a 20 31 37 30 32 39 37 37 37 36 39 30 37 37 2c 0a 09 09 22 74 79 70 65 22 20 3a 20 32 35 0a 09 7d 2c 0a 09 22 69 64 65 6e 74 69 74 79 22 20 3a 20 0a 09 7b 0a 09 09 22 65 6e 64 70 6f 69 6e 74 5f 69 64 22 20 3a 20 22 65 36 66 31 36 38 38 33 2d 32 66 33 61 2d 34 61 63 30 2d 61 62 31 37 2d 33 66 34 37 64 64 37 33 38 33 61 63 22 2c 0a 09 09 22 66 69 6e 67 65 72 70 72 69 6e 74 22 20 3a 20 22 41 45 46 30 42 31 33 38 44 38 45 36 36 39 Data Ascii: {"record":[{"event" : {"request_id" : "37478c66-362c-4b3b-b318-cb8c772e7f1b","subtype" : 1,"time" : 1702977769077,"type" : 25},"identity" : {"endpoint_id" : "e6f16883-2f3a-4ac0-ab17-3f47dd7383ac","fingerprint" : "AEF0B138D8E669
2023-12-19 09:22:51 UTC	216	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:50 GMT Content-Type: application/json Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:51 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port
1032	192.168.2.16	51107	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:50 UTC	3456	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=6074270596568283332 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; PugT=1702942302
2023-12-19 09:22:51 UTC	646	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:51 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:51 GMT; path=/ Set-Cookie: PugT=1702977771; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:51 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1033	192.168.2.16	51110	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:51 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:51 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:09; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1034	192.168.2.16	51108	34.251.97.118	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:51 UTC	908	OUT	GET /ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: a.audrte.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: arcki2=7dgKUmqxKU5QJKNdvTl5y8u7g!20220908!1702977767840!ip#102.129.152.212; arcki2_pubmatic=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F!20220908!1702977767840; arcki2_ddp2=7dgq4c7QFIzTHuTAOIJ4wmO8w!20220908!1702977768252
2023-12-19 09:22:51 UTC	474	IN	HTTP/1.1 302 Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Origin: * Date: Tue, 19 Dec 2023 09:22:51 GMT Location: https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent= Server: nginx/1.22.1 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1035	192.168.2.16	51111	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:51 UTC	3492	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7402232151745586090&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; PugT=1702942302
2023-12-19 09:22:51 UTC	644	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Dec 2023 23:31:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1 Connection: close Set-Cookie: KRTBCOOKIE_22=14911-7402232151745586090&KRTB&23150-7402232151745586090&KRTB&23527-7402232151745586090; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:31:53 GMT; path=/ Set-Cookie: PugT=1702942313; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 17-Jan-2024 23:31:53 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:51 UTC	1	IN	Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1036	192.168.2.16	51112	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:51 UTC	3456	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=6074270596568283332 HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; PugT=1702977766
2023-12-19 09:22:51 UTC	646	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:51 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 42 Connection: close Set-Cookie: KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:51 GMT; path=/ Set-Cookie: PugT=1702977771; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:51 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1037	192.168.2.16	51113	34.117.223.223	443	4080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:51 UTC	244	OUT	POST /v4/receive/json/25 HTTP/1.1 Host: analytics.avcdn.net User-Agent: libcurl/8.2.1-DEV Schannel zlib/1.2.11 c-ares/1.19.0 nghttp2/1.48.0 Accept: / Accept-Encoding: deflate, gzip Content-Type: application/json Content-Length: 3750
2023-12-19 09:22:51 UTC	3750	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 0a 09 22 65 76 65 6e 74 22 20 3a 20 0a 09 7b 0a 09 09 22 72 65 71 75 65 73 74 5f 69 64 22 20 3a 20 22 32 32 34 33 65 66 61 32 2d 63 63 66 66 2d 34 36 63 34 2d 39 39 32 30 2d 32 37 65 37 31 36 65 62 34 62 63 63 22 2c 0a 09 09 22 73 75 62 74 79 70 65 22 20 3a 20 31 2c 0a 09 09 22 74 69 6d 65 22 20 3a 20 31 37 30 32 39 37 37 37 36 39 39 34 35 2c 0a 09 09 22 74 79 70 65 22 20 3a 20 32 35 0a 09 7d 2c 0a 09 22 69 64 65 6e 74 69 74 79 22 20 3a 20 0a 09 7b 0a 09 09 22 65 6e 64 70 6f 69 6e 74 5f 69 64 22 20 3a 20 22 65 36 66 31 36 38 38 33 2d 32 66 33 61 2d 34 61 63 30 2d 61 62 31 37 2d 33 66 34 37 64 64 37 33 38 33 61 63 22 2c 0a 09 09 22 66 69 6e 67 65 72 70 72 69 6e 74 22 20 3a 20 22 41 45 46 30 42 31 33 38 44 38 45 36 36 39 Data Ascii: {"record":[{"event" : {"request_id" : "2243efa2-ccff-46c4-9920-27e716eb4bcc","subtype" : 1,"time" : 1702977769945,"type" : 25},"identity" : {"endpoint_id" : "e6f16883-2f3a-4ac0-ab17-3f47dd7383ac","fingerprint" : "AEF0B138D8E669
2023-12-19 09:22:51 UTC	216	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:51 GMT Content-Type: application/json Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 09:22:51 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port
1038	192.168.2.16	51115	34.160.176.28	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:51 UTC	168	OUT	POST / HTTP/1.1 Host: shepherd.avcdn.net User-Agent: Avast Antivirus Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Content-Length: 272
2023-12-19 09:22:51 UTC	272	OUT	Data Raw: 3f 70 5f 62 6c 64 3d 6d 6d 6d 5f 69 72 73 5f 70 70 69 5f 39 30 32 5f 34 35 31 5f 6f 26 70 5f 63 68 72 3d 30 26 70 5f 63 68 73 3d 35 26 70 5f 63 70 75 61 3d 78 36 34 26 70 5f 67 63 63 63 3d 30 26 70 5f 69 63 61 72 3d 31 26 70 5f 6c 6e 67 3d 65 6e 26 70 5f 6d 69 64 65 78 3d 37 32 36 44 36 39 33 38 46 35 39 36 45 42 33 31 30 39 35 34 39 31 46 38 30 43 45 35 34 31 44 35 31 46 42 46 44 37 45 43 38 41 36 43 36 33 33 35 30 38 37 34 44 45 41 31 30 34 35 39 45 42 41 43 26 70 5f 6f 73 74 3d 30 26 70 5f 6f 73 76 3d 31 30 2e 30 26 70 5f 70 72 6f 3d 37 30 26 70 5f 70 72 6f 64 3d 61 76 67 2d 61 76 26 70 5f 72 61 6d 3d 38 31 39 31 26 70 5f 73 62 69 3d 30 26 70 5f 76 62 64 3d 38 37 30 30 26 70 5f 76 65 70 3d 32 33 26 70 5f 76 65 73 3d 31 32 26 70 5f 76 72 65 3d 31 33 35 Data Ascii: ?p_bld=mmm_irs_ppi_902_451_o&p_chr=0&p_chs=5&p_cpua=x64&p_gccc=0&p_icar=1&p_lng=en&p_midex=726D6938F596EB31095491F80CE541D51FBFD7EC8A6C63350874DEA10459EBAC&p_ost=0&p_osv=10.0&p_pro=70&p_prod=avg-av&p_ram=8191&p_sbi=0&p_vbd=8700&p_vep=23&p_ves=12&p_vre=135
2023-12-19 09:22:52 UTC	2083	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:52 GMT Content-Type: text/plain Content-Length: 19914 AB-Tests: 921ba9e1-e8ab-4473-8916-6d120da28b76:A,AV-29530-free:a,oa-7466-v2:a Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Config-Id, Config-Name, Config-Version, Segments, AB-Tests, TTL, TTL-Spread Config-Id: 9 Config-Name: AVG-Windows-AV-Consumer_websocket-testing_email-signatures_asb-and-chrome-since-21.2_version-23.2-and-higher-not-in-fr-de_avg-free_ppi_21.10-and-newer_ipm_4932_opm_pus_fullscale_previous-version_version-18.6-and-higher_avg-free-and-release_production_sontiq_quic-on_smartscan-free-win10-antivirus_versions--22.1-and-higher_ipm-bau-v23.1-and-higher_version-20.5-and-higher_useopenidwebauth_streaming-updates-globalflags_devicewatcheron_avg_free_23_10_plus_version-20.9-and-higher_pups-in-avg---rollout_winre-bts_smartscanfreetrial_aosstorelink_enableddwm_enablehns3_performator_avg-forrelease-and-beta-23.12_fs-and-idp-integration_cef-91_cefsettings-on_opm_burger_tracking_limitation_productversion-higher-23.2-and-country-not-in-fr-de_multidetection_ipm_6515_6516_vps_sites_test_b-81e0b9943471e10e087fea7cd770a63aa44ad64547606fe6f0f5875321929271 Config-Version: 1961 Segments: websocket testing,email signatures,asb and chrome since 21.2,version 23.2 and higher not in fr de,avg free,ppi,21.10 and newer,ipm_4932_opm_pus_fullscale,previous version,version 18.6 and higher,avg free and release,production,sontiq,quic on,smartscan free win10 antivirus,versions 22.1 and higher,ipm bau v23.1 and higher,version 20.5 and higher,useopenidwebauth,streaming updates globalflags,devicewatcheron,avg_free_23_10_plus,version 20.9 and higher,pups in avg - rollout,winre bts,smartscanfreetrial,aosstorelink,enableddwm,enablehns3,performator,avg forrelease and beta 23.12,fs and idp integration,cef 91,cefsettings on,opm_burger_tracking_limitation,productversion higher 23.2 and country not in fr de,multidetection,ipm_6515_6516_vps_sites_test_b TTL: 60 TTL-Spread: 43200 Via: 1.1 google Alt-Svc: clear Connection: close
2023-12-19 09:22:52 UTC	1252	IN	Data Raw: 5b 52 65 6d 6f 74 65 41 63 63 65 73 73 53 68 69 65 6c 64 2e 53 65 74 74 69 6e 67 5d 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 44 61 79 3d 36 30 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 48 6f 75 72 3d 34 30 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 4d 69 6e 75 74 65 3d 33 30 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 54 65 6e 53 65 63 6f 6e 64 73 3d 31 32 0d 0a 5b 57 65 62 53 68 69 65 6c 64 2e 57 65 62 53 6f 63 6b 65 74 5d 0d 0a 45 6e 61 62 6c 65 64 3d 31 0d 0a 5b 53 65 74 74 69 6e 67 73 2e 55 73 65 72 49 6e 74 65 72 66 61 63 65 5d 0d 0a 53 68 65 6c 6c 45 78 74 65 6e 73 69 6f 6e 46 69 6c 65 4e 61 6d 65 3d 30 0d 0a Data Ascii: [RemoteAccessShield.Setting]BruteForceMaxAttemptsPerDay=60BruteForceMaxAttemptsPerHour=40BruteForceMaxAttemptsPerMinute=30BruteForceMaxAttemptsPerTenSeconds=12[WebShield.WebSocket]Enabled=1[Settings.UserInterface]ShellExtensionFileName=0
2023-12-19 09:22:52 UTC	1252	IN	Data Raw: 2c 31 39 36 0d 0a 5b 44 57 4d 5d 0d 0a 73 65 72 76 65 72 3d 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 70 72 6f 74 65 63 74 69 6f 6e 2e 61 76 67 2e 63 6f 6d 0d 0a 5b 45 78 74 65 6e 73 69 6f 6e 73 5d 0d 0a 46 46 41 4f 53 3d 77 72 63 40 61 76 61 73 74 2e 63 6f 6d 0d 0a 46 46 41 53 47 3d 61 76 67 40 73 61 66 65 67 75 61 72 64 0d 0a 46 46 41 53 50 3d 38 38 36 41 36 34 38 36 2d 33 37 42 33 2d 34 42 43 44 2d 38 39 31 42 2d 46 44 30 45 33 32 35 45 37 62 31 41 0d 0a 46 46 41 53 54 3d 61 76 67 40 73 65 63 75 72 69 74 79 0d 0a 46 46 50 41 4d 3d 6a 69 64 31 2d 72 31 74 44 75 4e 69 4e 62 34 53 45 77 77 40 6a 65 74 70 61 63 6b 0d 0a 46 46 57 54 55 3d 61 76 67 40 74 6f 6f 6c 62 61 72 0d 0a 46 46 57 54 55 33 3d 61 76 67 40 77 74 75 33 0d 0a 47 43 41 4f 53 3d 67 6f Data Ascii: ,196[DWM]server=https://identityprotection.avg.com[Extensions]FFAOS=wrc@avast.comFFASG=avg@safeguardFFASP=886A6486-37B3-4BCD-891B-FD0E325E7b1AFFAST=avg@securityFFPAM=jid1-r1tDuNiNb4SEww@jetpackFFWTU=avg@toolbarFFWTU3=avg@wtu3GCAOS=go
2023-12-19 09:22:52 UTC	312	IN	Data Raw: 6e 63 65 5f 45 6e 61 62 6c 65 64 3d 30 0d 0a 47 61 6d 65 52 75 6c 65 5f 4e 6f 41 76 61 73 74 49 6e 74 65 72 72 75 70 74 69 6f 6e 73 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 50 61 75 73 65 41 6c 6c 55 70 64 61 74 65 54 61 73 6b 73 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 50 61 75 73 65 41 76 42 61 63 6b 67 72 6f 75 6e 64 54 61 73 6b 73 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 50 61 75 73 65 53 79 73 74 65 6d 42 61 63 6b 67 72 6f 75 6e 64 54 61 73 6b 73 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 50 61 75 73 65 57 69 6e 64 6f 77 73 55 70 64 61 74 65 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 53 65 74 43 70 75 4c 69 6d 69 74 5f 45 6e 61 62 6c 65 64 3d 30 Data Ascii: nce_Enabled=0GameRule_NoAvastInterruptions_Enabled=1GameRule_PauseAllUpdateTasks_Enabled=1GameRule_PauseAvBackgroundTasks_Enabled=1GameRule_PauseSystemBackgroundTasks_Enabled=1GameRule_PauseWindowsUpdate_Enabled=1GameRule_SetCpuLimit_Enabled=0
2023-12-19 09:22:52 UTC	1252	IN	Data Raw: 48 69 67 68 50 72 69 6f 72 69 74 79 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 53 65 74 50 72 6f 63 65 73 73 41 66 66 69 6e 69 74 79 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 53 75 73 70 65 6e 64 4e 6f 6e 67 61 6d 69 6e 67 55 73 65 72 50 72 6f 63 65 73 73 65 73 5f 45 6e 61 62 6c 65 64 3d 30 0d 0a 5b 49 63 61 72 75 73 5d 0d 0a 41 6c 6c 6f 77 43 75 73 74 6f 6d 50 61 74 68 4d 69 67 72 61 74 69 6f 6e 3d 30 0d 0a 63 75 73 74 5f 69 6e 69 3d 31 0d 0a 4d 69 67 72 61 74 69 6f 6e 3d 30 0d 0a 4d 69 6e 69 6d 61 6c 55 70 74 69 6d 65 46 6f 72 4d 69 67 72 61 74 69 6f 6e 3d 36 30 30 0d 0a 50 61 72 61 6d 73 3d 2f 73 69 6c 65 6e 74 0d 0a 53 66 78 56 65 72 73 69 6f 6e 43 68 65 63 6b 3d 74 72 75 65 0d 0a 55 52 4c 3d 68 74 74 70 73 3a Data Ascii: HighPriority_Enabled=1GameRule_SetProcessAffinity_Enabled=1GameRule_SuspendNongamingUserProcesses_Enabled=0[Icarus]AllowCustomPathMigration=0cust_ini=1Migration=0MinimalUptimeForMigration=600Params=/silentSfxVersionCheck=trueURL=https:
2023-12-19 09:22:52 UTC	1252	IN	Data Raw: 74 22 7d 2c 7b 22 70 6f 72 74 22 3a 34 34 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 73 22 7d 2c 7b 22 70 6f 72 74 22 3a 34 34 35 2c 22 74 79 70 65 22 3a 22 74 63 70 5f 63 6f 6e 6e 65 63 74 22 7d 2c 7b 22 70 6f 72 74 22 3a 35 35 34 2c 22 74 79 70 65 22 3a 22 74 63 70 5f 63 6f 6e 6e 65 63 74 22 7d 2c 7b 22 70 6f 72 74 22 3a 33 33 38 39 2c 22 74 79 70 65 22 3a 22 72 64 70 22 7d 2c 7b 22 70 6f 72 74 22 3a 34 35 36 37 2c 22 74 79 70 65 22 3a 22 68 74 74 70 22 7d 2c 7b 22 70 6f 72 74 22 3a 37 35 34 37 2c 22 74 79 70 65 22 3a 22 68 74 74 70 22 7d 2c 7b 22 70 6f 72 74 22 3a 38 30 38 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 22 7d 2c 7b 22 70 6f 72 74 22 3a 38 34 34 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 73 22 7d 2c 7b 22 70 6f 72 74 22 3a 31 39 34 31 32 2c 22 Data Ascii: t"},{"port":443,"type":"https"},{"port":445,"type":"tcp_connect"},{"port":554,"type":"tcp_connect"},{"port":3389,"type":"rdp"},{"port":4567,"type":"http"},{"port":7547,"type":"http"},{"port":8080,"type":"http"},{"port":8443,"type":"https"},{"port":19412,"
2023-12-19 09:22:52 UTC	1252	IN	Data Raw: 70 5f 62 69 64 2c 70 5f 61 64 64 2c 62 63 5f 63 63 64 2c 62 63 5f 6d 61 63 2c 62 63 5f 73 70 64 2c 62 63 5f 6c 65 78 2c 62 63 5f 72 65 73 2c 62 63 5f 61 73 64 2c 62 63 5f 73 6c 70 2c 62 63 5f 73 6c 74 2c 62 63 5f 73 6c 61 2c 62 63 5f 61 76 74 2c 62 63 5f 74 6e 64 2c 62 63 5f 75 6e 70 2c 62 63 5f 73 74 61 2c 62 63 5f 74 73 64 2c 62 63 5f 74 72 65 2c 62 63 5f 74 79 70 2c 70 5f 63 6c 76 2c 70 5f 63 63 73 73 2c 70 5f 62 63 68 70 61 6d 2c 70 5f 62 63 68 73 70 2c 70 5f 63 75 61 63 61 67 65 2c 70 5f 63 62 6e 2c 70 5f 63 6d 72 75 2c 70 5f 63 69 73 73 2c 70 5f 63 75 66 6c 2c 70 5f 63 72 69 64 2c 70 5f 63 6f 69 6e 2c 70 5f 69 69 64 2c 70 5f 69 64 77 2c 70 5f 74 76 61 2c 70 5f 64 62 74 73 2c 70 5f 64 62 74 75 2c 70 5f 74 72 6c 6c 6f 2c 70 5f 64 6c 65 2c 70 5f 64 73 Data Ascii: p_bid,p_add,bc_ccd,bc_mac,bc_spd,bc_lex,bc_res,bc_asd,bc_slp,bc_slt,bc_sla,bc_avt,bc_tnd,bc_unp,bc_sta,bc_tsd,bc_tre,bc_typ,p_clv,p_ccss,p_bchpam,p_bchsp,p_cuacage,p_cbn,p_cmru,p_ciss,p_cufl,p_crid,p_coin,p_iid,p_idw,p_tva,p_dbts,p_dbtu,p_trllo,p_dle,p_ds
2023-12-19 09:22:52 UTC	340	IN	Data Raw: 2c 70 5f 73 76 70 6e 2c 70 5f 70 69 64 2c 74 61 67 73 2c 74 68 75 6d 62 6e 61 69 6c 2c 70 5f 74 7a 6f 2c 70 5f 74 6e 65 2c 70 5f 74 63 73 2c 70 5f 74 66 73 2c 74 75 5f 65 78 70 69 72 61 74 69 6f 6e 64 61 74 65 2c 74 75 5f 69 6e 73 74 61 6c 6c 64 61 74 65 2c 74 75 5f 73 69 64 2c 70 5f 75 69 73 2c 70 5f 65 6d 6c 2c 70 5f 75 69 64 2c 70 5f 75 73 6e 61 6d 65 2c 70 5f 63 6d 69 2c 70 5f 77 6e 66 2c 70 5f 77 73 63 32 73 5f 61 76 2c 70 5f 77 73 63 32 73 2c 70 5f 77 67 73 2c 70 5f 77 73 63 2c 77 74 75 5f 61 70 70 73 74 61 74 65 2c 7a 65 6e 5f 64 61 79 73 61 66 74 65 72 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 2c 7a 65 6e 5f 64 65 76 69 63 65 63 6f 75 6e 74 61 6e 64 2c 7a 65 6e 5f 64 65 76 69 63 65 63 6f 75 6e 74 6d 61 63 2c 7a 65 6e 5f 64 65 76 69 63 65 63 6f 75 6e 74 Data Ascii: ,p_svpn,p_pid,tags,thumbnail,p_tzo,p_tne,p_tcs,p_tfs,tu_expirationdate,tu_installdate,tu_sid,p_uis,p_eml,p_uid,p_usname,p_cmi,p_wnf,p_wsc2s_av,p_wsc2s,p_wgs,p_wsc,wtu_appstate,zen_daysafterinstallation,zen_devicecountand,zen_devicecountmac,zen_devicecount
2023-12-19 09:22:52 UTC	1252	IN	Data Raw: 2c 7a 65 6e 5f 6f 73 2c 7a 65 6e 5f 70 72 6f 64 75 63 74 63 6f 75 6e 74 2c 7a 65 6e 5f 73 69 64 0d 0a 5b 44 72 69 76 65 72 55 70 64 61 74 65 72 5d 0d 0a 42 61 63 6b 67 72 6f 75 6e 64 53 63 61 6e 45 6e 61 62 6c 65 3d 31 0d 0a 45 6e 61 62 6c 65 64 3d 30 0d 0a 5b 53 6f 6e 74 69 71 5d 0d 0a 45 6e 61 62 6c 65 64 3d 31 0d 0a 5b 49 6e 73 74 75 70 2e 53 75 62 6d 69 74 73 5d 0d 0a 53 65 6e 64 42 75 72 67 65 72 3d 31 0d 0a 5b 57 65 62 53 68 69 65 6c 64 2e 51 75 69 63 5d 0d 0a 42 6c 6f 63 6b 3d 30 0d 0a 45 6e 61 62 6c 65 64 3d 31 0d 0a 53 74 61 74 69 73 74 69 63 73 3d 31 0d 0a 5b 73 65 74 74 69 6e 67 73 2e 73 6d 61 72 74 73 63 61 6e 5d 0d 0a 45 6e 61 62 6c 65 41 75 74 6f 53 74 65 70 43 68 61 6e 67 65 3d 30 0d 0a 5b 45 6d 61 69 6c 53 68 69 65 6c 64 2e 45 6d 61 69 6c Data Ascii: ,zen_os,zen_productcount,zen_sid[DriverUpdater]BackgroundScanEnable=1Enabled=0[Sontiq]Enabled=1[Instup.Submits]SendBurger=1[WebShield.Quic]Block=0Enabled=1Statistics=1[settings.smartscan]EnableAutoStepChange=0[EmailShield.Email
2023-12-19 09:22:52 UTC	1252	IN	Data Raw: 31 39 2c 33 31 2e 31 34 2e 37 33 2e 32 34 0d 0a 5b 73 65 74 74 69 6e 67 73 2e 43 68 65 73 74 5d 0d 0a 4d 61 78 53 69 7a 65 3d 35 31 32 30 0d 0a 5b 57 65 62 53 68 69 65 6c 64 2e 53 53 4c 5d 0d 0a 50 61 73 73 74 68 72 75 45 56 3d 30 0d 0a 5b 49 44 50 5d 0d 0a 61 67 65 6e 74 2e 6e 6f 64 65 44 61 74 61 4d 67 72 2e 75 6e 6b 6e 6f 77 6e 43 68 61 72 54 69 6d 65 4f 75 74 3d 31 37 32 38 30 30 30 0d 0a 66 69 6c 65 70 72 6f 74 65 63 74 69 6f 6e 5f 64 65 66 61 75 6c 74 65 78 74 65 6e 73 69 6f 6e 73 3d 72 73 77 63 61 74 5f 61 72 63 68 69 76 65 3b 37 7a 3b 72 61 72 3b 7a 69 70 3b 72 73 77 63 61 74 5f 6d 75 73 69 63 3b 6d 33 75 3b 6d 34 61 3b 6d 70 33 3b 77 6d 61 3b 6f 67 67 3b 77 61 76 3b 72 73 77 63 61 74 5f 64 61 74 61 62 61 73 65 3b 73 71 6c 69 74 65 3b 73 71 6c 69 Data Ascii: 19,31.14.73.24[settings.Chest]MaxSize=5120[WebShield.SSL]PassthruEV=0[IDP]agent.nodeDataMgr.unknownCharTimeOut=1728000fileprotection_defaultextensions=rswcat_archive;7z;rar;zip;rswcat_music;m3u;m4a;mp3;wma;ogg;wav;rswcat_database;sqlite;sqli

Session ID	Source IP	Source Port	Destination IP	Destination Port
1039	192.168.2.16	51114	51.222.239.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:51 UTC	833	OUT	GET /match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F HTTP/1.1 Host: onetag-sys.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY
2023-12-19 09:22:52 UTC	439	IN	HTTP/1.1 200 OK cache-control: no-transform, no-cache p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' set-cookie: OTP=fN1k37W0YcDcdGBz8qsqebK0hyIUWFTuX1hyLOkXkVY; path=/; expires=Sat, 18 Jan 2025 01:41:10; domain=onetag-sys.com; SameSite=None; Secure; content-length: 0 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1040	192.168.2.16	51116	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:51 UTC	3492	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7402232151745586090&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; chkChromeAb67Sec=5; SyncRTB3=1704153600%3A176_214_165_250_3_99_220_8_178_55_54_48_240_46_21_13_7_243_166_234_264_56_238_231_233_104_22_96_249_5_71%7C1703548800%3A2_15_223%7C1705536000%3A224%7C1704240000%3A35%7C1703808000%3A63; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; pi=159706:3; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; KRTBCOOKIE_904=16787-UJIm7FQxC_S75-Ey5mCBZQ; PugT=1702977766
2023-12-19 09:22:52 UTC	644	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 09:22:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1 Connection: close Set-Cookie: KRTBCOOKIE_22=14911-7402232151745586090&KRTB&23150-7402232151745586090&KRTB&23527-7402232151745586090; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:50 GMT; path=/ Set-Cookie: PugT=1702977770; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 18-Jan-2024 09:22:50 GMT; path=/ P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:52 UTC	1	IN	Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1041	192.168.2.16	51118	172.217.3.78	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:52 UTC	393	OUT	GET /webstore/inlineinstall/detail/fheoggkfdfchfphceeifdbepaooicaho HTTP/1.1 Host: chrome.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 09:22:53 UTC	1457	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Dec 2023 09:22:53 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="coop_chromewebstore" Content-Security-Policy: script-src 'report-sample' 'nonce-oUpGWewTi1utgA_yW1-gMA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';worker-src 'self';report-uri /webstore/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/chromewebstore/2 Report-To: {"group":"coop_chromewebstore","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/chromewebstore"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=511=M3JZssw120YZNMDhTpunPy_0-uOkMG5kXBY8-d6rqMy30lXDnm1jNZ5o4VZvSz-tp0kn-6J2g0Y-FHh_mW1zKRvSHr9-BFgB4hP8oLZ1oNvs8_DvjqNXMLinbSSMR8rqwsDaicIVM8s8a_pBStcpbeN5A_HE9WytHEk_jzp5O3U; expires=Wed, 19-Jun-2024 09:22:53 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 09:22:53 UTC	1457	IN	Data Raw: 62 37 65 0d 0a 7b 22 69 63 6f 6e 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 68 33 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 5f 75 54 56 63 55 50 6f 79 4e 74 2d 63 74 4e 31 31 46 78 74 4a 46 74 30 52 35 31 59 50 6d 30 63 66 54 7a 65 48 52 4c 4e 33 64 35 6e 52 6d 65 65 75 48 51 53 31 4f 35 31 45 31 56 46 37 31 33 61 5a 55 6e 52 77 68 62 76 35 55 77 34 59 6e 71 52 38 76 44 57 58 33 45 5f 73 41 3d 77 31 32 38 2d 68 31 32 38 2d 65 33 36 35 2d 72 6a 2d 73 63 30 78 30 30 66 66 66 66 66 66 22 2c 22 6c 6f 63 61 6c 69 7a 65 64 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4d 63 41 66 65 65 c2 ae 20 57 65 62 41 64 76 69 73 6f 72 22 2c 22 6d 61 6e 69 66 65 73 74 22 3a 22 7b 5c 6e 5c 22 75 70 64 61 74 65 5f 75 72 6c 5c 22 3a 20 5c 22 68 Data Ascii: b7e{"icon_url":"https://lh3.googleusercontent.com/_uTVcUPoyNt-ctN11FxtJFt0R51YPm0cfTzeHRLN3d5nRmeeuHQS1O51E1VF713aZUnRwhbv5Uw4YnqR8vDWX3E_sA=w128-h128-e365-rj-sc0x00ffffff","louserzed_description":"McAfee WebAdvisor","manifest":"{\n\"update_url\": \"h
2023-12-19 09:22:53 UTC	1457	IN	Data Raw: 30 74 55 77 49 44 41 51 41 42 5c 22 2c 5c 6e 20 20 5c 22 69 63 6f 6e 73 5c 22 3a 20 7b 5c 6e 20 20 20 20 5c 22 31 32 38 5c 22 3a 20 5c 22 69 6d 61 67 65 73 2f 77 65 62 61 64 76 69 73 6f 72 2e 70 6e 67 5c 22 5c 6e 20 20 7d 2c 5c 6e 20 20 5c 22 61 63 74 69 6f 6e 5c 22 3a 20 7b 5c 6e 20 20 20 20 5c 22 64 65 66 61 75 6c 74 5f 74 69 74 6c 65 5c 22 3a 20 5c 22 5f 5f 4d 53 47 5f 72 65 73 5f 50 52 4f 44 55 43 54 5f 4e 41 4d 45 5f 54 52 41 44 45 4d 41 52 4b 45 44 5f 5f 5c 22 2c 5c 6e 20 20 20 20 5c 22 64 65 66 61 75 6c 74 5f 69 63 6f 6e 5c 22 3a 20 7b 5c 6e 20 20 20 20 20 20 5c 22 31 36 5c 22 3a 20 5c 22 69 6d 61 67 65 73 2f 62 72 6f 77 73 65 72 5f 61 63 74 69 6f 6e 2f 64 69 73 61 62 6c 65 64 5f 31 36 2e 70 6e 67 5c 22 2c 5c 6e 20 20 20 20 20 20 5c 22 33 32 5c 22 Data Ascii: 0tUwIDAQAB\",\n \"icons\": {\n \"128\": \"images/webadvisor.png\"\n },\n \"action\": {\n \"default_title\": \"__MSG_res_PRODUCT_NAME_TRADEMARKED__\",\n \"default_icon\": {\n \"16\": \"images/browser_action/disabled_16.png\",\n \"32\"
2023-12-19 09:22:53 UTC	35	IN	Data Raw: 69 7a 65 64 5f 6e 61 6d 65 22 3a 22 4d 63 41 66 65 65 c2 ae 20 57 65 62 41 64 76 69 73 6f 72 22 7d 0d 0a Data Ascii: ized_name":"McAfee WebAdvisor"}
2023-12-19 09:22:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1042	192.168.2.16	51125	162.248.18.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:53 UTC	3787	OUT	GET /AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP/1.1 Host: image8.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eus.rubiconproject.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; SyncRTB3=1704153600%3A166_96_48_231_81_250_220_54_104_7_243_238_21_233_5_3_99_8_55_240_176_13_56_46_234_264_22_249_214_165_178_71%7C1703548800%3A2_223_15%7C1704240000%3A35%7C1705536000%3A224%7C1703808000%3A63; pi=0:3; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; KRTBCOOKIE_52=22772-R33645_10DEE0DD2_1DEE3DE&KRTB&23092-R33645_10DEE0DD2_1DEE3DE; KRTBCOOKIE_279=22890-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23011-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23355-6d575774-a2c7-43b3-8920-b16815799026; KRTBCOOKIE_699=22727-AACk507LAsIAABM7-sg6gA; KRTBCOOKIE_22=14911-7402232151745586090&KRTB&23150-7402232151745586090&KRTB&23527-7402232151745586090; chkChromeAb67Sec=7; PugT=1702977770
2023-12-19 09:22:53 UTC	659	IN	HTTP/1.1 204 No Content Cache-Control: private,max-age=86400 P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: ipc=0^^0^0; domain=pubmatic.com; path=/; max-age=3; SameSite=None; secure; Set-Cookie: pi=0:3; domain=pubmatic.com; path=/; max-age=86400; SameSite=None; secure; Set-Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; domain=pubmatic.com; path=/; max-age=31536000; SameSite=None; secure; Set-Cookie: chkChromeAb67Sec=8; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; Date: Tue, 19 Dec 2023 09:22:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1043	192.168.2.16	51132	8.28.7.83	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 09:22:53 UTC	3872	OUT	GET /AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:2233062b-d38a-4eaf-9e54-df74f8af0f43&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw HTTP/1.1 Host: simage2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ads.pubmatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KADUSERCOOKIE=5DC35839-FDF8-4CE8-A75C-05C04EEAAB7F; KRTBCOOKIE_377=6810-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22918-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&22926-134495f3-7e94-4262-b6f5-d7524e6fbdd7&KRTB&23031-134495f3-7e94-4262-b6f5-d7524e6fbdd7; KRTBCOOKIE_148=19421-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23486-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23489-uid:93BC46BA1AC048E6B3FEE9603D02AEE4&KRTB&23539-uid:93BC46BA1AC048E6B3FEE9603D02AEE4; KRTBCOOKIE_80=22987-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23025-CAESEC26mZVWsxRGoE5JvegKkkg&KRTB&23386-CAESEC26mZVWsxRGoE5JvegKkkg; KRTBCOOKIE_57=22776-6663647625574893018&KRTB&23339-6663647625574893018; KRTBCOOKIE_32=11175-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22713-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&22715-AAAHTMDn43-HvwMcUnSsAAAAAAA&KRTB&23519-AAAHTMDn43-HvwMcUnSsAAAAAAA; KRTBCOOKIE_466=16530-132eab48-61bf-4eaf-9a69-4fb4f080c8bc; KRTBCOOKIE_860=16335-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23334-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23417-GH_JvDj8VjdvrBlOavHmp2aBmNQ&KRTB&23426-GH_JvDj8VjdvrBlOavHmp2aBmNQ; KRTBCOOKIE_188=3189-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553&KRTB&23418-6990f2fd-910e-4cff-8571-4cba10906efb-658160d5-5553; KRTBCOOKIE_1003=22761-251c4a36-9e50-11ee-a342-3aa302158eab&KRTB&23275-251c4a36-9e50-11ee-a342-3aa302158eab; KRTBCOOKIE_469=8273-866838000893&KRTB&23428-866838000893; KRTBCOOKIE_18=22947-968907273661960568; KRTBCOOKIE_153=1923-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&19420-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&22979-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7&KRTB&23462-unWMt7pw0OWheNHj7nmZvrV10rShJITjuCJRn5H7; KRTBCOOKIE_1323=23480-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23485-OPUfcf5109a1a63427ca17f2e650a5ade17&KRTB&23524-OPUfcf5109a1a63427ca17f2e650a5ade17; DPSync3=1703548800%3A265_253_252%7C1704153600%3A236_226_259_228_201_260_235_263_262_261_245%7C1704067200%3A256_258%7C1703030400%3A248_255%7C1703894400%3A257; KRTBCOOKIE_27=16735-uid:7a2e6581-60d7-4800-933d-354f6ed2801e; SPugT=1702942390; KRTBCOOKIE_391=22924-6074270596568283332&KRTB&23263-6074270596568283332&KRTB&23481-6074270596568283332; KRTBCOOKIE_1278=23329-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23340-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8&KRTB&23498-86ebb63f-48bd-4d06-b5d9-4ee6fd6f94c8; KRTBCOOKIE_594=17105-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005&KRTB&17107-RX-3cf1b4a2-66b2-44f2-8363-f89c2b13e845-005; KRTBCOOKIE_107=1471-uid:UzeiMh5u1Rfwja5&KRTB&23421-uid:UzeiMh5u1Rfwja5; SyncRTB3=1704153600%3A166_96_48_231_81_250_220_54_104_7_243_238_21_233_5_3_99_8_55_240_176_13_56_46_234_264_22_249_214_165_178_71%7C1703548800%3A2_223_15%7C1704240000%3A35%7C1705536000%3A224%7C1703808000%3A63; pi=0:3; KRTBCOOKIE_904=16787-kD5c8C9HCfKvLTiX3mCBZQ; KRTBCOOKIE_52=22772-R33645_10DEE0DD2_1DEE3DE&KRTB&23092-R33645_10DEE0DD2_1DEE3DE; KRTBCOOKIE_279=22890-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23011-6d575774-a2c7-43b3-8920-b16815799026&KRTB&23355-6d575774-a2c7-43b3-8920-b16815799026; KRTBCOOKIE_699=22727-AACk507LAsIAABM7-sg6gA; KRTBCOOKIE_22=14911-7402232151745586090&KRTB&23150-7402232151745586090&KRTB&23527-7402232151745586090; PugT=1702977770; ipc=0^^0^0; chkChromeAb67Sec=8
2023-12-19 09:22:54 UTC	404	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 19 Dec 2023 09:22:53 GMT Transfer-Encoding: chunked Connection: close Location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2023-12-19 09:22:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	6
Start time:	10:21:45
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe"
Imagebase:	0x400000
File size:	1'771'160 bytes
MD5 hash:	2642D4A26B9D25DF3E9A90E79B35617E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	10:21:46
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-86K4V.tmp\caffeine-1.5-installer_qak-fw1.tmp" /SL5="$90070,837439,832512,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe"
Imagebase:	0x400000
File size:	3'209'760 bytes
MD5 hash:	7F584FB8A2E785D4662266D877DBE18C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 7%, Virustotal, Browse
Reputation:	low
Has exited:	true

Target ID:	10
Start time:	10:21:47
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe" /SPAWNWND=$3023E /NOTIFYWND=$90070
Imagebase:	0x400000
File size:	1'771'160 bytes
MD5 hash:	2642D4A26B9D25DF3E9A90E79B35617E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	10:21:48
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-RP58K.tmp\caffeine-1.5-installer_qak-fw1.tmp" /SL5="$90076,837439,832512,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip\caffeine-1.5-installer_qak-fw1.exe" /SPAWNWND=$3023E /NOTIFYWND=$90070
Imagebase:	0x400000
File size:	3'209'760 bytes
MD5 hash:	7F584FB8A2E785D4662266D877DBE18C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 7%, Virustotal, Browse
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	10:22:07
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
Imagebase:	0x850000
File size:	1'162'856 bytes
MD5 hash:	BB7CF61C4E671FF05649BDA83B85FA3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	false

Target ID:	13
Start time:	10:22:08
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrMpG6xzNiPw2zQDcpljgB1AnvPAw0qefblpEoa1wR4HgPPsGEupOsZXmbqoVTnBEo68S6u8u
Imagebase:	0x550000
File size:	234'936 bytes
MD5 hash:	26816AF65F2A3F1C61FB44C682510C97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 1%, Virustotal, Browse
Reputation:	moderate
Has exited:	false

Target ID:	14
Start time:	10:22:10
Start date:	19/12/2023
Path:	C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\asw.5eb092b1255993ad\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTtVrMpG6xzNiPw2zQDcpljgB1AnvPAw0qefblpEoa1wR4HgPPsGEupOsZXmbqoVTnBEo68S6u8u /cookie:mmm_irs_ppi_902_451_o /ga_clientid:6d11ded8-8432-4921-bfa3-224b760cd39e /edat_dir:C:\Windows\Temp\asw.5eb092b1255993ad
Imagebase:	0x4b0000
File size:	1'465'808 bytes
MD5 hash:	1ECAEBD87C30F9F50EDAC37404EAD036
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	15
Start time:	10:22:11
Start date:	19/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gsf-fl.softonic.com/d49/077/a3289ae3596f269011fba85f3163074285/file?Expires=1702357011&Signature=40fec4ff0b920c54bdad2c59f008fa0ee38b0a46&url=https://caffeine.softonic.com.br&Filename=file
Imagebase:	0x7ff71e7f0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	16
Start time:	10:22:12
Start date:	19/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2016,i,3031805693453605639,1785818148905796408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff71e7f0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	19
Start time:	10:22:16
Start date:	19/12/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 2788
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	21
Start time:	10:22:22
Start date:	19/12/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 2788
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	22
Start time:	10:22:23
Start date:	19/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=auction_worklet.mojom.AuctionWorkletService --lang=en-US --service-sandbox-type=service_with_jit --mojo-platform-channel-handle=7164 --field-trial-handle=2016,i,3031805693453605639,1785818148905796408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff71e7f0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	23
Start time:	10:22:23
Start date:	19/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=auction_worklet.mojom.AuctionWorkletService --lang=en-US --service-sandbox-type=service_with_jit --mojo-platform-channel-handle=7184 --field-trial-handle=2016,i,3031805693453605639,1785818148905796408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff71e7f0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	24
Start time:	10:22:32
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\installer.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\is-VQCEG.tmp\component0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Imagebase:
File size:	28'927'992 bytes
MD5 hash:	CCAC594E57F446FA24A364A6F37C0EE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false