Play interactive tourEdit tour

Windows Analysis Report
https://funcilnewshical.com/76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=cost

Overview

General Information

Sample URL:	https://funcilnewshical.com/76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=L
Analysis ID:	1577008
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Detected suspicious crossdomain redirect

Javascript checks online IP of machine

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://funcilnewshical.com/76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=cost

SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social Engineering

Phishing

AI detected landing page (webpage, office document or email)

Source: https://register.douglasgrimes.com/chatv1?name=Lisa&cep=TO5BSuxUvKGpIdGQ46SAk9RRUrv6rTWwqu8RZgmmuL__CLamAVEaypHBzNCzATEYoudY5-Ie74NxWF2fiFuHKc66Li9oRrw4i7BwLquNtZPhBKu8nQrbYxJsHFMUZdJnHTUnhbilk36FOL8MnS-hooU3p7JRt6c0yPydwJSCoE0O2h1miSbDHsY9_dypubbyDNRDNGiajVANSHtkNRuAvm2GThNnfBHjGftFKouXPKkEHIhEqDc0ValaiDe1Ea8Xd3_wpuha16mR9Pso8PQZGj90vAYKGSrsR4m9IiusdExvU5_UyZkQ1eZisETVNEYpRqpLz8m2XsjWZTka2raoBPSsfUwnITDEZVs-pkmW-lTT6oteSU0tERwc9nzNNV71ZMBOniVbaQl5VkwXtuTx0v3bPvypxNtDjI3anJkxs3CdpGHMO70vZwH5xFvLligOBKQGbXqgtie3HMKqccCT_zsHh8_7Tiv6kufAWvneHLgQLyibgnh12ZmXU0WEoVX7Q2L3AaZfopTR3ZSfMQfO-clJshROlg_gM19xPpRPmSnjWdM1QBzrWcfz6gUyUnvvS1hlX2AuFVEJ9a00NpEenQ&lptoken=170e34cc461e69d8755e&batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&phone=phone&step=step&domain=domain&cost=cost

Joe Sandbox AI: Page contains button: 'CLICK HERE TO START' Source: '1.3.pages.csv'

AI detected suspicious Javascript

Source: 0.22.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://funcilnewshical.com/redirect?target=BASE64... The script uses a setTimeout function to immediately redirect the user to an unknown and potentially suspicious domain, which is a high-risk indicator. The obfuscated URL also suggests malicious intent.

Javascript checks online IP of machine

Source: https://agitosvos.com/benefit/dynamic/asset/main.js?v=10.5

HTTP Parser: // build preogress barlet parentel = document.queryselector('.segmentedprogressbar')// count blockslet questionscount = document.queryselectorall('.block[data-step]').lengthfunction saveprogress(id, answer) { let savedcards = json.parse(localstorage.getitem('v9bensavedcardv16')) || []; // get existing savedcards from local storage or initialize an empty array let cardobj = { id: id, answer: answer }; let index = savedcards.findindex(c => c.id === id); // find index of existing card with same id if (index === -1) { // no existing card found with same id, add new card to array savedcards.push(cardobj); } else { // existing card found with same id, update its answer savedcards[index].answer = answer; } localstorage.setitem('v9bensavedcardv16', json.stringify(savedcards)); // save the updated array to local storage}// visitor cityfunction ipinfos(old) { var msg = "<b>welcome back!</b> p...

HTML page is missing a favicon

Source: https://register.douglasgrimes.com/chatv1?name=Lisa&cep=TO5BSuxUvKGpIdGQ46SAk9RRUrv6rTWwqu8RZgmmuL__CLamAVEaypHBzNCzATEYoudY5-Ie74NxWF2fiFuHKc66Li9oRrw4i7BwLquNtZPhBKu8nQrbYxJsHFMUZdJnHTUnhbilk36FOL8MnS-hooU3p7JRt6c0yPydwJSCoE0O2h1miSbDHsY9_dypubbyDNRDNGiajVANSHtkNRuAvm2GThNnfBHjGftFKouXPKkEHIhEqDc0ValaiDe1Ea8Xd3_wpuha16mR9Pso8PQZGj90vAYKGSrsR4m9IiusdExvU5_UyZkQ1eZisETVNEYpRqpLz8m2XsjWZTka2raoBPSsfUwnITDEZVs-pkmW-lTT6oteSU0tERwc9nzNNV71ZMBOniVbaQl5VkwXtuTx0v3bPvypxNtDjI3anJkxs3CdpGHMO70vZwH5xFvLligOBKQGbXqgtie3HMKqccCT_zsHh8_7Tiv6kufAWvneHLgQLyibgnh12ZmXU0WEoVX7Q2L3AaZfopTR3ZSfMQfO-clJshROlg_gM19xPpRPmSnjWdM1QBzrWcfz6gUyUnvvS1hlX2AuFVEJ9a00NpEenQ&lptoken=170e34cc461e69d8755e&batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&phone=phone&step=step&domain=domain&cost=cost	HTTP Parser: No favicon
Source: https://register.douglasgrimes.com/chatv1?name=Lisa&cep=TO5BSuxUvKGpIdGQ46SAk9RRUrv6rTWwqu8RZgmmuL__CLamAVEaypHBzNCzATEYoudY5-Ie74NxWF2fiFuHKc66Li9oRrw4i7BwLquNtZPhBKu8nQrbYxJsHFMUZdJnHTUnhbilk36FOL8MnS-hooU3p7JRt6c0yPydwJSCoE0O2h1miSbDHsY9_dypubbyDNRDNGiajVANSHtkNRuAvm2GThNnfBHjGftFKouXPKkEHIhEqDc0ValaiDe1Ea8Xd3_wpuha16mR9Pso8PQZGj90vAYKGSrsR4m9IiusdExvU5_UyZkQ1eZisETVNEYpRqpLz8m2XsjWZTka2raoBPSsfUwnITDEZVs-pkmW-lTT6oteSU0tERwc9nzNNV71ZMBOniVbaQl5VkwXtuTx0v3bPvypxNtDjI3anJkxs3CdpGHMO70vZwH5xFvLligOBKQGbXqgtie3HMKqccCT_zsHh8_7Tiv6kufAWvneHLgQLyibgnh12ZmXU0WEoVX7Q2L3AaZfopTR3ZSfMQfO-clJshROlg_gM19xPpRPmSnjWdM1QBzrWcfz6gUyUnvvS1hlX2AuFVEJ9a00NpEenQ&lptoken=170e34cc461e69d8755e&batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&phone=phone&step=step&domain=domain&cost=cost	HTTP Parser: No favicon
Source: https://register.douglasgrimes.com/chatv1?name=Lisa&cep=TO5BSuxUvKGpIdGQ46SAk9RRUrv6rTWwqu8RZgmmuL__CLamAVEaypHBzNCzATEYoudY5-Ie74NxWF2fiFuHKc66Li9oRrw4i7BwLquNtZPhBKu8nQrbYxJsHFMUZdJnHTUnhbilk36FOL8MnS-hooU3p7JRt6c0yPydwJSCoE0O2h1miSbDHsY9_dypubbyDNRDNGiajVANSHtkNRuAvm2GThNnfBHjGftFKouXPKkEHIhEqDc0ValaiDe1Ea8Xd3_wpuha16mR9Pso8PQZGj90vAYKGSrsR4m9IiusdExvU5_UyZkQ1eZisETVNEYpRqpLz8m2XsjWZTka2raoBPSsfUwnITDEZVs-pkmW-lTT6oteSU0tERwc9nzNNV71ZMBOniVbaQl5VkwXtuTx0v3bPvypxNtDjI3anJkxs3CdpGHMO70vZwH5xFvLligOBKQGbXqgtie3HMKqccCT_zsHh8_7Tiv6kufAWvneHLgQLyibgnh12ZmXU0WEoVX7Q2L3AaZfopTR3ZSfMQfO-clJshROlg_gM19xPpRPmSnjWdM1QBzrWcfz6gUyUnvvS1hlX2AuFVEJ9a00NpEenQ&lptoken=170e34cc461e69d8755e&batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&phone=phone&step=step&domain=domain&cost=cost	HTTP Parser: No favicon
Source: https://register.douglasgrimes.com/chatv1?name=Lisa&cep=TO5BSuxUvKGpIdGQ46SAk9RRUrv6rTWwqu8RZgmmuL__CLamAVEaypHBzNCzATEYoudY5-Ie74NxWF2fiFuHKc66Li9oRrw4i7BwLquNtZPhBKu8nQrbYxJsHFMUZdJnHTUnhbilk36FOL8MnS-hooU3p7JRt6c0yPydwJSCoE0O2h1miSbDHsY9_dypubbyDNRDNGiajVANSHtkNRuAvm2GThNnfBHjGftFKouXPKkEHIhEqDc0ValaiDe1Ea8Xd3_wpuha16mR9Pso8PQZGj90vAYKGSrsR4m9IiusdExvU5_UyZkQ1eZisETVNEYpRqpLz8m2XsjWZTka2raoBPSsfUwnITDEZVs-pkmW-lTT6oteSU0tERwc9nzNNV71ZMBOniVbaQl5VkwXtuTx0v3bPvypxNtDjI3anJkxs3CdpGHMO70vZwH5xFvLligOBKQGbXqgtie3HMKqccCT_zsHh8_7Tiv6kufAWvneHLgQLyibgnh12ZmXU0WEoVX7Q2L3AaZfopTR3ZSfMQfO-clJshROlg_gM19xPpRPmSnjWdM1QBzrWcfz6gUyUnvvS1hlX2AuFVEJ9a00NpEenQ&lptoken=170e34cc461e69d8755e&batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&phone=phone&step=step&domain=domain&cost=cost	HTTP Parser: No favicon
Source: https://agitosvos.com/benefit/dynamic/?list_id=&externalid=4563e19f4bdf413a936bfe353ea2134c&affid=722&ph=&bread=60443be6-9ccb-428b-9a8b-409908a28a35&utm_content=&fbclid=&utm_source=&cep=rrZ4ukuuOwMxyj8Yg8GJTpmsf4Ytz_IWNnXpDO_c-Ag-F-I0RriYvluXnd4pFPtV0Rmic0LxP4JqoGWHvtPhQAKVJ_eJ7x590Yx4figoY1v9QJ135in-3clm3DCJbgTjnaWctD39aKR14mxDHdIRmffYCkbxO5Lp5xYvG8YiPp6C69SxsE0WLGuSfH86nWF8LWHvjWL_2sht7oRSiVFqKzb025vzQ0hoZQiEik3lzeYTMoAE31KMlMA9iWBSHOPYdsrKv4zIKGVkiFeaYSgRCw_I3NRYsGtnA_-85gUTC2LAPaXYg_eXYGVZ8QVcebeiB7NwB4ElVZvCorhI_Aj4ccVuQdntu8f-FpNXtUceuh7wQ_Dq6pNb0SxbV68nCstHJTMvm6SxDfX5soN3D6qimabdFk2t5Noj1ov7xzX6HwoQBg0hX3EpyUe-PgJnAn9HtuEbMoTmjaN820V1LuISA5kraMIe4isofXBTuDADeeDYfMqSnd9AUN4OkPSOqcCipiVKADj-rQ0LR5mm0h5d8y1mNCB8LnwguHd-7W_dssEAG3VLHfz-6MxXx0EChhUzjupzJq5kZkcbw14DMwFl1fD3P-KowbG8ga8xlkwk2Hi-EwDC6drE0JoudmZqW-xM6oQ36EY68GLhz4yf9L26yWEQFWiZCCiGvNUtatLIgzuJd_NSLkPDKqv2GUS4FhLpWOLkjpb6_jTISE89n7y60c2QlNI7kcM45j8e4fkKoF6iZ8U4aqiJG8WtprFRdLfvXanaaiN_3PTiFdGUv23Rbwc75WZx7FsQPxpfo746U7u9YowPHX5DLGhOvznKEgt53dR2u-...	HTTP Parser: No favicon

Networking

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: www.rkd02ks.com to https://eftrk.agitosvos.com/25qrcxx/9hjl91c/?source_id=722&sub2=b456f27db3664d02b399adb46e0bcc03

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49890 -> 3.164.85.40:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49900 -> 104.21.51.241:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49908 -> 34.107.218.251:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49921 -> 34.107.218.251:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49882 -> 3.164.85.40:443

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=cost HTTP/1.1Host: funcilnewshical.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /76e41238-e8a4-483e-8f1d-ad83b34d4805/2?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=cost HTTP/1.1Host: funcilnewshical.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chatv1?name=Lisa&cep=TO5BSuxUvKGpIdGQ46SAk9RRUrv6rTWwqu8RZgmmuL__CLamAVEaypHBzNCzATEYoudY5-Ie74NxWF2fiFuHKc66Li9oRrw4i7BwLquNtZPhBKu8nQrbYxJsHFMUZdJnHTUnhbilk36FOL8MnS-hooU3p7JRt6c0yPydwJSCoE0O2h1miSbDHsY9_dypubbyDNRDNGiajVANSHtkNRuAvm2GThNnfBHjGftFKouXPKkEHIhEqDc0ValaiDe1Ea8Xd3_wpuha16mR9Pso8PQZGj90vAYKGSrsR4m9IiusdExvU5_UyZkQ1eZisETVNEYpRqpLz8m2XsjWZTka2raoBPSsfUwnITDEZVs-pkmW-lTT6oteSU0tERwc9nzNNV71ZMBOniVbaQl5VkwXtuTx0v3bPvypxNtDjI3anJkxs3CdpGHMO70vZwH5xFvLligOBKQGbXqgtie3HMKqccCT_zsHh8_7Tiv6kufAWvneHLgQLyibgnh12ZmXU0WEoVX7Q2L3AaZfopTR3ZSfMQfO-clJshROlg_gM19xPpRPmSnjWdM1QBzrWcfz6gUyUnvvS1hlX2AuFVEJ9a00NpEenQ&lptoken=170e34cc461e69d8755e&batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&phone=phone&step=step&domain=domain&cost=cost HTTP/1.1Host: register.douglasgrimes.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fd042dd0ca190feed860eca6a031fd1c96e6c3a1b%2Flawyer-with-weighing-scales.jpg?auto=compress%2Cformat&fit=crop&h=1.0&w=1600 HTTP/1.1Host: convertri.imgix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn.min.css?v=2024-01-23-10-02-44 HTTP/1.1Host: cdn.convertri.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-1.12.2.min.js?v=2024-01-23-10-02-44 HTTP/1.1Host: cdn.convertri.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fd042dd0ca190feed860eca6a031fd1c96e6c3a1b%2Flawyer-with-weighing-scales.jpg?auto=compress%2Cformat&fit=crop&h=1.0&w=1600 HTTP/1.1Host: convertri.imgix.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fe4d964af7c4f4d0f0abaab47ca6ce1325a128016%2FScreenshot%202024-01-24%20223914.png?auto=compress,format&fit=scale&w=536&h=107 HTTP/1.1Host: convertri.imgix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fa3e029d9d46c7f5ee5ec1d3ed89d6a40fbb8822b%2FDoublas-Grimes-Logo-2.png?auto=compress,format&fit=scale&w=169&h=79 HTTP/1.1Host: convertri.imgix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fe4d964af7c4f4d0f0abaab47ca6ce1325a128016%2FScreenshot%202024-01-24%20223914.png?auto=compress,format&fit=scale&w=482&h=294 HTTP/1.1Host: convertri.imgix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fa3e029d9d46c7f5ee5ec1d3ed89d6a40fbb8822b%2FDoublas-Grimes-Logo-2.png?auto=compress,format&fit=scale&w=184&h=82 HTTP/1.1Host: convertri.imgix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fb6cc722af8a09951d8888cbd09e8b46849259dd0%2Fdouglassignature.gif HTTP/1.1Host: cdn.convertri.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-1.12.2.min.js?v=2024-01-23-10-02-44 HTTP/1.1Host: cdn.convertri.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i?stm=1734465182237&e=pv&url=https%3A%2F%2Fregister.douglasgrimes.com%2Fchatv1%3Fname%3DLisa%26cep%3DTO5BSuxUvKGpIdGQ46SAk9RRUrv6rTWwqu8RZgmmuL__CLamAVEaypHBzNCzATEYoudY5-Ie74NxWF2fiFuHKc66Li9oRrw4i7BwLquNtZPhBKu8nQrbYxJsHFMUZdJnHTUnhbilk36FOL8MnS-hooU3p7JRt6c0yPydwJSCoE0O2h1miSbDHsY9_dypubbyDNRDNGiajVANSHtkNRuAvm2GThNnfBHjGftFKouXPKkEHIhEqDc0ValaiDe1Ea8Xd3_wpuha16mR9Pso8PQZGj90vAYKGSrsR4m9IiusdExvU5_UyZkQ1eZisETVNEYpRqpLz8m2XsjWZTka2raoBPSsfUwnITDEZVs-pkmW-lTT6oteSU0tERwc9nzNNV71ZMBOniVbaQl5VkwXtuTx0v3bPvypxNtDjI3anJkxs3CdpGHMO70vZwH5xFvLligOBKQGbXqgtie3HMKqccCT_zsHh8_7Tiv6kufAWvneHLgQLyibgnh12ZmXU0WEoVX7Q2L3AaZfopTR3ZSfMQfO-clJshROlg_gM19xPpRPmSnjWdM1QBzrWcfz6gUyUnvvS1hlX2AuFVEJ9a00NpEenQ%26lptoken%3D170e34cc461e69d8755e%26batchid%3DDouglasgrimes-Testsetup%26carrier%3Dcarrier%26textid%3Dtextid%26brand%3Dregister.douglasgrimes.com%26source%3Dsource%26messageId%3DmessageId%26phone%3Dphone%26step%3Dstep%26domain%3Ddomain%26cost%3Dcost&page=douglasgrimes.com&tv=js-2.7.0&tna=cvt-cookies-enabled&aid=cvt&p=web&tz=America%2FNew_York&lang=en-US&cs=UTF-8&f_pdf=1&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=0&f_java=0&f_gears=0&f_ag=0&res=1280x1024&cd=24&cookie=1&eid=b0b00a58-5b09-4927-84fb-fdf0fb7ae4d7&dtm=1734465182235&vp=1280x907&ds=1263x1275&vid=1&sid=ca759c2d-1ef0-45d8-b953-0e94cdd39313&duid=c5dc3102-bdbf-4adf-9a7f-bd297004685c&fp=3913022309 HTTP/1.1Host: snowplow.convertri.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fa3e029d9d46c7f5ee5ec1d3ed89d6a40fbb8822b%2FDoublas-Grimes-Logo-2.png?auto=compress,format&fit=scale&w=169&h=79 HTTP/1.1Host: convertri.imgix.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fa3e029d9d46c7f5ee5ec1d3ed89d6a40fbb8822b%2FDoublas-Grimes-Logo-2.png?auto=compress,format&fit=scale&w=184&h=82 HTTP/1.1Host: convertri.imgix.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fe4d964af7c4f4d0f0abaab47ca6ce1325a128016%2FScreenshot%202024-01-24%20223914.png?auto=compress,format&fit=scale&w=482&h=294 HTTP/1.1Host: convertri.imgix.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fe4d964af7c4f4d0f0abaab47ca6ce1325a128016%2FScreenshot%202024-01-24%20223914.png?auto=compress,format&fit=scale&w=536&h=107 HTTP/1.1Host: convertri.imgix.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fb6cc722af8a09951d8888cbd09e8b46849259dd0%2Fdouglassignature.gif HTTP/1.1Host: cdn.convertri.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i?stm=1734465182237&e=pv&url=https%3A%2F%2Fregister.douglasgrimes.com%2Fchatv1%3Fname%3DLisa%26cep%3DTO5BSuxUvKGpIdGQ46SAk9RRUrv6rTWwqu8RZgmmuL__CLamAVEaypHBzNCzATEYoudY5-Ie74NxWF2fiFuHKc66Li9oRrw4i7BwLquNtZPhBKu8nQrbYxJsHFMUZdJnHTUnhbilk36FOL8MnS-hooU3p7JRt6c0yPydwJSCoE0O2h1miSbDHsY9_dypubbyDNRDNGiajVANSHtkNRuAvm2GThNnfBHjGftFKouXPKkEHIhEqDc0ValaiDe1Ea8Xd3_wpuha16mR9Pso8PQZGj90vAYKGSrsR4m9IiusdExvU5_UyZkQ1eZisETVNEYpRqpLz8m2XsjWZTka2raoBPSsfUwnITDEZVs-pkmW-lTT6oteSU0tERwc9nzNNV71ZMBOniVbaQl5VkwXtuTx0v3bPvypxNtDjI3anJkxs3CdpGHMO70vZwH5xFvLligOBKQGbXqgtie3HMKqccCT_zsHh8_7Tiv6kufAWvneHLgQLyibgnh12ZmXU0WEoVX7Q2L3AaZfopTR3ZSfMQfO-clJshROlg_gM19xPpRPmSnjWdM1QBzrWcfz6gUyUnvvS1hlX2AuFVEJ9a00NpEenQ%26lptoken%3D170e34cc461e69d8755e%26batchid%3DDouglasgrimes-Testsetup%26carrier%3Dcarrier%26textid%3Dtextid%26brand%3Dregister.douglasgrimes.com%26source%3Dsource%26messageId%3DmessageId%26phone%3Dphone%26step%3Dstep%26domain%3Ddomain%26cost%3Dcost&page=douglasgrimes.com&tv=js-2.7.0&tna=cvt-cookies-enabled&aid=cvt&p=web&tz=America%2FNew_York&lang=en-US&cs=UTF-8&f_pdf=1&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=0&f_java=0&f_gears=0&f_ag=0&res=1280x1024&cd=24&cookie=1&eid=b0b00a58-5b09-4927-84fb-fdf0fb7ae4d7&dtm=1734465182235&vp=1280x907&ds=1263x1275&vid=1&sid=ca759c2d-1ef0-45d8-b953-0e94cdd39313&duid=c5dc3102-bdbf-4adf-9a7f-bd297004685c&fp=3913022309 HTTP/1.1Host: snowplow.convertri.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: register.douglasgrimes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/chatv1?name=Lisa&cep=TO5BSuxUvKGpIdGQ46SAk9RRUrv6rTWwqu8RZgmmuL__CLamAVEaypHBzNCzATEYoudY5-Ie74NxWF2fiFuHKc66Li9oRrw4i7BwLquNtZPhBKu8nQrbYxJsHFMUZdJnHTUnhbilk36FOL8MnS-hooU3p7JRt6c0yPydwJSCoE0O2h1miSbDHsY9_dypubbyDNRDNGiajVANSHtkNRuAvm2GThNnfBHjGftFKouXPKkEHIhEqDc0ValaiDe1Ea8Xd3_wpuha16mR9Pso8PQZGj90vAYKGSrsR4m9IiusdExvU5_UyZkQ1eZisETVNEYpRqpLz8m2XsjWZTka2raoBPSsfUwnITDEZVs-pkmW-lTT6oteSU0tERwc9nzNNV71ZMBOniVbaQl5VkwXtuTx0v3bPvypxNtDjI3anJkxs3CdpGHMO70vZwH5xFvLligOBKQGbXqgtie3HMKqccCT_zsHh8_7Tiv6kufAWvneHLgQLyibgnh12ZmXU0WEoVX7Q2L3AaZfopTR3ZSfMQfO-clJshROlg_gM19xPpRPmSnjWdM1QBzrWcfz6gUyUnvvS1hlX2AuFVEJ9a00NpEenQ&lptoken=170e34cc461e69d8755e&batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&phone=phone&step=step&domain=domain&cost=costAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _sp_ses.46b6=*; _sp_id.46b6=c5dc3102-bdbf-4adf-9a7f-bd297004685c.1734465182.1.1734465182.1734465182.ca759c2d-1ef0-45d8-b953-0e94cdd39313
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cdn.convertri.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cdn.convertri.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _CVTa=f07ed3b4-cc2c-4654-8dbd-65543e2dfa54
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fe4d964af7c4f4d0f0abaab47ca6ce1325a128016%2FScreenshot%202024-01-24%20223914.png?auto=compress,format&fit=scale&w=540&h=158 HTTP/1.1Host: convertri.imgix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Ffdc2eb07be5baffbad0d95d47620da1e928e9f70%2Fdouglassupport.gif HTTP/1.1Host: cdn.convertri.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Fe4d964af7c4f4d0f0abaab47ca6ce1325a128016%2FScreenshot%202024-01-24%20223914.png?auto=compress,format&fit=scale&w=540&h=158 HTTP/1.1Host: convertri.imgix.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /df41ef23-2911-11ed-aeb6-06deec350f13%2Ffdc2eb07be5baffbad0d95d47620da1e928e9f70%2Fdouglassupport.gif HTTP/1.1Host: cdn.convertri.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _CVTa=f07ed3b4-cc2c-4654-8dbd-65543e2dfa54
Source: global traffic	HTTP traffic detected: GET /i?stm=1734465225631&e=se&se_ca=navigation&se_ac=leaving-anchor-click&se_la=https%3A%2F%2Ffuncilnewshical.com%2Fclick%2F&tv=js-2.7.0&tna=cvt-cookies-enabled&aid=cvt&p=web&tz=America%2FNew_York&lang=en-US&cs=UTF-8&f_pdf=1&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=0&f_java=0&f_gears=0&f_ag=0&res=1280x1024&cd=24&cookie=1&eid=6c3a8cd7-b4a7-43b8-9af7-e8080c3419e3&dtm=1734465225629&vp=1280x907&ds=1263x1275&vid=1&sid=ca759c2d-1ef0-45d8-b953-0e94cdd39313&duid=c5dc3102-bdbf-4adf-9a7f-bd297004685c&fp=3913022309&url=https%3A%2F%2Fregister.douglasgrimes.com%2Fchatv1%3Fname%3DLisa%26cep%3DTO5BSuxUvKGpIdGQ46SAk9RRUrv6rTWwqu8RZgmmuL__CLamAVEaypHBzNCzATEYoudY5-Ie74NxWF2fiFuHKc66Li9oRrw4i7BwLquNtZPhBKu8nQrbYxJsHFMUZdJnHTUnhbilk36FOL8MnS-hooU3p7JRt6c0yPydwJSCoE0O2h1miSbDHsY9_dypubbyDNRDNGiajVANSHtkNRuAvm2GThNnfBHjGftFKouXPKkEHIhEqDc0ValaiDe1Ea8Xd3_wpuha16mR9Pso8PQZGj90vAYKGSrsR4m9IiusdExvU5_UyZkQ1eZisETVNEYpRqpLz8m2XsjWZTka2raoBPSsfUwnITDEZVs-pkmW-lTT6oteSU0tERwc9nzNNV71ZMBOniVbaQl5VkwXtuTx0v3bPvypxNtDjI3anJkxs3CdpGHMO70vZwH5xFvLligOBKQGbXqgtie3HMKqccCT_zsHh8_7Tiv6kufAWvneHLgQLyibgnh12ZmXU0WEoVX7Q2L3AaZfopTR3ZSfMQfO-clJshROlg_gM19xPpRPmSnjWdM1QBzrWcfz6gUyUnvvS1hlX2AuFVEJ9a00NpEenQ%26lptoken%3D170e34cc461e69d8755e%26batchid%3DDouglasgrimes-Testsetup%26carrier%3Dcarrier%26textid%3Dtextid%26brand%3Dregister.douglasgrimes.com%26source%3Dsource%26messageId%3DmessageId%26phone%3Dphone%26step%3Dstep%26domain%3Ddomain%26cost%3Dcost HTTP/1.1Host: snowplow.convertri.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /click/ HTTP/1.1Host: funcilnewshical.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://register.douglasgrimes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 76e41238-e8a4-483e-8f1d-ad83b34d4805-v4=7ID5xKAftQayi8LE59tEapm9rcvb0Iu6wfnqrDcc7f0; cep-v4=UaJwZVYTwselhD2rnE4mwJmgP-LvmfJJNfzMBtBudkoXxc0UGhDQdHnczCTZqIZdU4FQdG0FcTC9zq51lAYJWkLmKOoSwRbifw9gFLtP67qQsaIq3ZPbqLU3cIpHcakW0TXoMG8OWzkKyl7prLbNPpS9tuy0lYZBu951Heg2_Wl1xBLVcOk-24VklVsv_AR-6YfqSNXZS9mlkq7ltHme5-nzYjxHR51tdaQYsSvN3jbQ0Ik2YsvRhvzWdG5_59fI6R4fY1Wlt5umeUzwz6WCho_QQnjS0dlzoSox-oESv4AUzIqC8JwLkeSq2P2XaZLiQjcVeLa8hud0Pq3u30qwPc9Byz_xZI_P9BFLJrQkT5liFAwLcY_LLqmbunYBJPXBBv610_VNa9WVo79JmsimF4nFd3pFvCGoP9RqsIA4poVTdIqqwZz0DtB5A2RDUgPj_0xjEntpWnU0QkqsCBgm0Ly7mt7sHeMGgxybGQ2HmX5Y1yAdLpMaX8yq9snTROZUT9hVRgwvlAq_o4TnL5a_l-5bw-aHupfgNATsa_3-J5bYSnGccZBt5jkQzgArF-osdt8xqCCYucxjE5fQkkqsrA
Source: global traffic	HTTP traffic detected: GET /redirect?target=BASE64aHR0cHM6Ly93d3cucmtkMDJrcy5jb20vMjhLTDYvSjM1SlBLLz9zdWIyPWRxOGpmNzhnM2ZlMHBqYzZqcThxbjlhaQ&ts=1734465228262&hash=8mhDiijqCpP1bmSD7GISBVl1s9tqRZYqNDmUmNFXobs&rm=DJ HTTP/1.1Host: funcilnewshical.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cep-v4=UaJwZVYTwselhD2rnE4mwJmgP-LvmfJJNfzMBtBudkoXxc0UGhDQdHnczCTZqIZdU4FQdG0FcTC9zq51lAYJWkLmKOoSwRbifw9gFLtP67qQsaIq3ZPbqLU3cIpHcakW0TXoMG8OWzkKyl7prLbNPpS9tuy0lYZBu951Heg2_Wl1xBLVcOk-24VklVsv_AR-6YfqSNXZS9mlkq7ltHme5-nzYjxHR51tdaQYsSvN3jbQ0Ik2YsvRhvzWdG5_59fI6R4fY1Wlt5umeUzwz6WCho_QQnjS0dlzoSox-oESv4AUzIqC8JwLkeSq2P2XaZLiQjcVeLa8hud0Pq3u30qwPc9Byz_xZI_P9BFLJrQkT5liFAwLcY_LLqmbunYBJPXBBv610_VNa9WVo79JmsimF4nFd3pFvCGoP9RqsIA4poVTdIqqwZz0DtB5A2RDUgPj_0xjEntpWnU0QkqsCBgm0Ly7mt7sHeMGgxybGQ2HmX5Y1yAdLpMaX8yq9snTROZUT9hVRgwvlAq_o4TnL5a_l-5bw-aHupfgNATsa_3-J5bYSnGccZBt5jkQzgArF-osdt8xqCCYucxjE5fQkkqsrA; cc-v4=ggDkqsa99w2vCmAKcSj2zP7iJHViwdMn2HGUyoTOJcfb6OIotmFo7i6oK7KKI6MYAzju9JL%2BWgDIWwzW%2FL8cGLencWCpy%2Ff1ACrLbv3exGckpWix%2Fv2M9tKwvE7eDML6AjMApRRuCgcgC77DljDtNw%3D%3D; 76e41238-e8a4-483e-8f1d-ad83b34d4805-clk-v4=76e41238-e8a4-483e-8f1d-ad83b34d4805; 76e41238-e8a4-483e-8f1d-ad83b34d4805-v4=EJCpg2A5kJJARm8QUIJurmLXpWR4FOUpmAaVKpSgYGA
Source: global traffic	HTTP traffic detected: GET /i?stm=1734465225631&e=se&se_ca=navigation&se_ac=leaving-anchor-click&se_la=https%3A%2F%2Ffuncilnewshical.com%2Fclick%2F&tv=js-2.7.0&tna=cvt-cookies-enabled&aid=cvt&p=web&tz=America%2FNew_York&lang=en-US&cs=UTF-8&f_pdf=1&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=0&f_java=0&f_gears=0&f_ag=0&res=1280x1024&cd=24&cookie=1&eid=6c3a8cd7-b4a7-43b8-9af7-e8080c3419e3&dtm=1734465225629&vp=1280x907&ds=1263x1275&vid=1&sid=ca759c2d-1ef0-45d8-b953-0e94cdd39313&duid=c5dc3102-bdbf-4adf-9a7f-bd297004685c&fp=3913022309&url=https%3A%2F%2Fregister.douglasgrimes.com%2Fchatv1%3Fname%3DLisa%26cep%3DTO5BSuxUvKGpIdGQ46SAk9RRUrv6rTWwqu8RZgmmuL__CLamAVEaypHBzNCzATEYoudY5-Ie74NxWF2fiFuHKc66Li9oRrw4i7BwLquNtZPhBKu8nQrbYxJsHFMUZdJnHTUnhbilk36FOL8MnS-hooU3p7JRt6c0yPydwJSCoE0O2h1miSbDHsY9_dypubbyDNRDNGiajVANSHtkNRuAvm2GThNnfBHjGftFKouXPKkEHIhEqDc0ValaiDe1Ea8Xd3_wpuha16mR9Pso8PQZGj90vAYKGSrsR4m9IiusdExvU5_UyZkQ1eZisETVNEYpRqpLz8m2XsjWZTka2raoBPSsfUwnITDEZVs-pkmW-lTT6oteSU0tERwc9nzNNV71ZMBOniVbaQl5VkwXtuTx0v3bPvypxNtDjI3anJkxs3CdpGHMO70vZwH5xFvLligOBKQGbXqgtie3HMKqccCT_zsHh8_7Tiv6kufAWvneHLgQLyibgnh12ZmXU0WEoVX7Q2L3AaZfopTR3ZSfMQfO-clJshROlg_gM19xPpRPmSnjWdM1QBzrWcfz6gUyUnvvS1hlX2AuFVEJ9a00NpEenQ%26lptoken%3D170e34cc461e69d8755e%26batchid%3DDouglasgrimes-Testsetup%26carrier%3Dcarrier%26textid%3Dtextid%26brand%3Dregister.douglasgrimes.com%26source%3Dsource%26messageId%3DmessageId%26phone%3Dphone%26step%3Dstep%26domain%3Ddomain%26cost%3Dcost HTTP/1.1Host: snowplow.convertri.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _CVTa=f07ed3b4-cc2c-4654-8dbd-65543e2dfa54
Source: global traffic	HTTP traffic detected: GET /28KL6/J35JPK/?sub2=dq8jf78g3fe0pjc6jq8qn9ai HTTP/1.1Host: www.rkd02ks.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /25QRCXX/9HJL91C/?source_id=722&sub2=b456f27db3664d02b399adb46e0bcc03 HTTP/1.1Host: eftrk.agitosvos.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /60443be6-9ccb-428b-9a8b-409908a28a35?affiliate_id=722&source_id=722&rdid=&lander=&utm_content=&fbclid=&utm_source=&externalid=4563e19f4bdf413a936bfe353ea2134c HTTP/1.1Host: trk.agitosvos.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /60443be6-9ccb-428b-9a8b-409908a28a35/2?affiliate_id=722&source_id=722&rdid=&lander=&utm_content=&fbclid=&utm_source=&externalid=4563e19f4bdf413a936bfe353ea2134c HTTP/1.1Host: trk.agitosvos.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /benefit/dynamic/?list_id=&externalid=4563e19f4bdf413a936bfe353ea2134c&affid=722&ph=&bread=60443be6-9ccb-428b-9a8b-409908a28a35&utm_content=&fbclid=&utm_source=&cep=rrZ4ukuuOwMxyj8Yg8GJTpmsf4Ytz_IWNnXpDO_c-Ag-F-I0RriYvluXnd4pFPtV0Rmic0LxP4JqoGWHvtPhQAKVJ_eJ7x590Yx4figoY1v9QJ135in-3clm3DCJbgTjnaWctD39aKR14mxDHdIRmffYCkbxO5Lp5xYvG8YiPp6C69SxsE0WLGuSfH86nWF8LWHvjWL_2sht7oRSiVFqKzb025vzQ0hoZQiEik3lzeYTMoAE31KMlMA9iWBSHOPYdsrKv4zIKGVkiFeaYSgRCw_I3NRYsGtnA_-85gUTC2LAPaXYg_eXYGVZ8QVcebeiB7NwB4ElVZvCorhI_Aj4ccVuQdntu8f-FpNXtUceuh7wQ_Dq6pNb0SxbV68nCstHJTMvm6SxDfX5soN3D6qimabdFk2t5Noj1ov7xzX6HwoQBg0hX3EpyUe-PgJnAn9HtuEbMoTmjaN820V1LuISA5kraMIe4isofXBTuDADeeDYfMqSnd9AUN4OkPSOqcCipiVKADj-rQ0LR5mm0h5d8y1mNCB8LnwguHd-7W_dssEAG3VLHfz-6MxXx0EChhUzjupzJq5kZkcbw14DMwFl1fD3P-KowbG8ga8xlkwk2Hi-EwDC6drE0JoudmZqW-xM6oQ36EY68GLhz4yf9L26yWEQFWiZCCiGvNUtatLIgzuJd_NSLkPDKqv2GUS4FhLpWOLkjpb6_jTISE89n7y60c2QlNI7kcM45j8e4fkKoF6iZ8U4aqiJG8WtprFRdLfvXanaaiN_3PTiFdGUv23Rbwc75WZx7FsQPxpfo746U7u9YowPHX5DLGhOvznKEgt53dR2u-gXB_IrS6r8dqlrvXb0dRmAXhga0YaJ0IYgsXM6qRQNPVqHjnhU1SOqeUzEcBAIhTW9IeBYsDUPTAEtAAk-9VGSz2oZP_jLzKsddNq3chR2dR8X5xMAbvl5Xq9cy0iZF1bLTKVNRFij_UDBjh2frDHVMh2dBQ4RvnQC8PTHbRyMBYt0ct2azOfwW2ggkmYD_lNqHBWt4Vf-q1tGx0YQEi6jZMPs6UEL4_KKXurd0UwWshNmguRRgqjemxyHbsZlrnYQmep8NPyHjIsfuV85nET_cQeMCCi9IFh8C-YNenH2XwHnr8s0q2bHwP8smZu99W437rln5GwiRAv6cbHAb2oBIVABebfRHz31tfTYDLCU-tDMtn0EMijRzRFkZuwGcuve-D4RNHVoy9PYuOqgV8AQYIdhdNojJpaGCIZGYFu3-kcafJ1E3OcUbI7Enxi6xIdBFlStD9jVC78P3TXbpgiLzkpTf1r_t7mdNyNVgwGrZDxtirLRrLw6X4VD6z3AdUuSVuw9XQZkOVhnLzSNDG-thgTAMC-dPdAv4gylTlUVDjlRrA2wFq0y7AvZx4fhTa-UZ1QSlXU3o2srPaF3rgERQdmOjTEJKZahUb4ORaeg7_JjyzC9Av4yWWqj3vNwGy3iJMB5smHrVn-0OgjE6mGPM5hsUPgu2rJr_zFd7siQPWvzIiQ0iGB0FdSAVfFeWXQP3lsitee6zfxji4-0dmldU2FR2t85uBF2Kxzn8emYc68JA8IdmIE2rVKdTEjx7iw8EN46VcdnK7kA_HP_jWAl6vMh5HmMg7N6SYpekNEdWEwbQQ0BgAZhbY194kDyPZgiFT9E-PLOqwN65Pc6l1jA1gb6lsxj2jhwHGQ&lptoken=17913450469e704b3874&affiliate_id=722&source_id=722&rdid=&lander= HTTP/1.1Host: agitosvos.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/sdk/everflow.js HTTP/1.1Host: eftrk.agitosvos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agitosvos.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uniqueClick_9HJL91C=307e39e3-e7dc-4868-859f-620c7c745344:1734465233; transaction_id=4563e19f4bdf413a936bfe353ea2134c
Source: global traffic	HTTP traffic detected: GET /j.php?a=799078&u=https%3A%2F%2Fagitosvos.com%2Fbenefit%2Fdynamic%2F%3Flist_id%3D%26externalid%3D4563e19f4bdf413a936bfe353ea2134c%26affid%3D722%26ph%3D%26bread%3D60443be6-9ccb-428b-9a8b-409908a28a35%26utm_content%3D%26fbclid%3D%26utm_source%3D%26cep%3DrrZ4ukuuOwMxyj8Yg8GJTpmsf4Ytz_IWNnXpDO_c-Ag-F-I0RriYvluXnd4pFPtV0Rmic0LxP4JqoGWHvtPhQAKVJ_eJ7x590Yx4figoY1v9QJ135in-3clm3DCJbgTjnaWctD39aKR14mxDHdIRmffYCkbxO5Lp5xYvG8YiPp6C69SxsE0WLGuSfH86nWF8LWHvjWL_2sht7oRSiVFqKzb025vzQ0hoZQiEik3lzeYTMoAE31KMlMA9iWBSHOPYdsrKv4zIKGVkiFeaYSgRCw_I3NRYsGtnA_-85gUTC2LAPaXYg_eXYGVZ8QVcebeiB7NwB4ElVZvCorhI_Aj4ccVuQdntu8f-FpNXtUceuh7wQ_Dq6pNb0SxbV68nCstHJTMvm6SxDfX5soN3D6qimabdFk2t5Noj1ov7xzX6HwoQBg0hX3EpyUe-PgJnAn9HtuEbMoTmjaN820V1LuISA5kraMIe4isofXBTuDADeeDYfMqSnd9AUN4OkPSOqcCipiVKADj-rQ0LR5mm0h5d8y1mNCB8LnwguHd-7W_dssEAG3VLHfz-6MxXx0EChhUzjupzJq5kZkcbw14DMwFl1fD3P-KowbG8ga8xlkwk2Hi-EwDC6drE0JoudmZqW-xM6oQ36EY68GLhz4yf9L26yWEQFWiZCCiGvNUtatLIgzuJd_NSLkPDKqv2GUS4FhLpWOLkjpb6_jTISE89n7y60c2QlNI7kcM45j8e4fkKoF6iZ8U4aqiJG8WtprFRdLfvXanaaiN_3PTiFdGUv23Rbwc75WZx7FsQPxpfo746U7u9YowPHX5DLGhOvznKEgt53dR2u-gXB_IrS6r8dqlrvXb0dRmAXhga0YaJ0IYgsXM6qRQNPVqHjnhU1SOqeUzEcBAIhTW9IeBYsDUPTAEtAAk-9VGSz2oZP_jLzKsddNq3chR2dR8X5xMAbvl5Xq9cy0iZF1bLTKVNRFij_UDBjh2frDHVMh2dBQ4RvnQC8PTHbRyMBYt0ct2azOfwW2ggkmYD_lNqHBWt4Vf-q1tGx0YQEi6jZMPs6UEL4_KKXurd0UwWshNmguRRgqjemxyHbsZlrnYQmep8NPyHjIsfuV85nET_cQeMCCi9IFh8C-YNenH2XwHnr8s0q2bHwP8smZu99W437rln5GwiRAv6cbHAb2oBIVABebfRHz31tfTYDLCU-tDMtn0EMijRzRFkZuwGcuve-D4RNHVoy9PYuOqgV8AQYIdhdNojJpaGCIZGYFu3-kcafJ1E3OcUbI7Enxi6xIdBFlStD9jVC78P3TXbpgiLzkpTf1r_t7mdNyNVgwGrZDxtirLRrLw6X4VD6z3AdUuSVuw9XQZkOVhnLzSNDG-thgTAMC-dPdAv4gylTlUVDjlRrA2wFq0y7AvZx4fhTa-UZ1QSlXU3o2srPaF3rgERQdmOjTEJKZahUb4ORaeg7_JjyzC9Av4yWWqj3vNwGy3iJMB5smHrVn-0OgjE6mGPM5hsUPgu2rJr_zFd7siQPWvzIiQ0iGB0FdSAVfFeWXQP3lsitee6zfxji4-0dmldU2FR2t85uBF2Kxzn8emYc68JA8IdmIE2rVKdTEjx7iw8EN46VcdnK7kA_HP_jWAl6vMh5HmMg7N6SYpekNEdWEwbQQ0BgAZhbY194kDyPZgiFT9E-PLOqwN65Pc6l1jA1gb6lsxj2jhwHGQ%26lptoken%3D17913450469e704b3874%26affiliate_id%3D722%26source_id%3D722%26rdid%3D%26lander%3D&vn=2 HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agitosvos.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /benefit/dynamic/asset/main.css?v=4.5 HTTP/1.1Host: agitosvos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://agitosvos.com/benefit/dynamic/?list_id=&externalid=4563e19f4bdf413a936bfe353ea2134c&affid=722&ph=&bread=60443be6-9ccb-428b-9a8b-409908a28a35&utm_content=&fbclid=&utm_source=&cep=rrZ4ukuuOwMxyj8Yg8GJTpmsf4Ytz_IWNnXpDO_c-Ag-F-I0RriYvluXnd4pFPtV0Rmic0LxP4JqoGWHvtPhQAKVJ_eJ7x590Yx4figoY1v9QJ135in-3clm3DCJbgTjnaWctD39aKR14mxDHdIRmffYCkbxO5Lp5xYvG8YiPp6C69SxsE0WLGuSfH86nWF8LWHvjWL_2sht7oRSiVFqKzb025vzQ0hoZQiEik3lzeYTMoAE31KMlMA9iWBSHOPYdsrKv4zIKGVkiFeaYSgRCw_I3NRYsGtnA_-85gUTC2LAPaXYg_eXYGVZ8QVcebeiB7NwB4ElVZvCorhI_Aj4ccVuQdntu8f-FpNXtUceuh7wQ_Dq6pNb0SxbV68nCstHJTMvm6SxDfX5soN3D6qimabdFk2t5Noj1ov7xzX6HwoQBg0hX3EpyUe-PgJnAn9HtuEbMoTmjaN820V1LuISA5kraMIe4isofXBTuDADeeDYfMqSnd9AUN4OkPSOqcCipiVKADj-rQ0LR5mm0h5d8y1mNCB8LnwguHd-7W_dssEAG3VLHfz-6MxXx0EChhUzjupzJq5kZkcbw14DMwFl1fD3P-KowbG8ga8xlkwk2Hi-EwDC6drE0JoudmZqW-xM6oQ36EY68GLhz4yf9L26yWEQFWiZCCiGvNUtatLIgzuJd_NSLkPDKqv2GUS4FhLpWOLkjpb6_jTISE89n7y60c2QlNI7kcM45j8e4fkKoF6iZ8U4aqiJG8WtprFRdLfvXanaaiN_3PTiFdGUv23Rbwc75WZx7FsQPxpfo746U7u9YowPHX5DLGhOvznKEgt53dR2u-gXB_IrS6r8dqlrvXb0dRmAXhga0YaJ0IYgsXM6qRQNPVqHjnhU1SOqeUzEcBAIhTW9IeBYsDUPTAEtAAk-9VGSz2oZP_jLzKsddNq3chR2dR8X5xMAbvl5Xq9cy0iZF1bLTKVNRFij_UDBjh2frDHVMh2dBQ4RvnQC8PTHbRyMBYt0ct2azOfwW2ggkmYD_lNqHBWt4Vf-q1tGx0YQEi6jZMPs6UEL4_KKXurd0UwWshNmguRRgqjemxyHbsZlrnYQmep8NPyHjIsfuV85nET_cQeMCCi9IFh8C-YNenH2XwHnr8s0q2bHwP8smZu99W437rln5GwiRAv6cbHAb2oBIVABebfRHz31tfTYDLCU-tDMtn0EMijRzRFkZuwGcuve-D4RNHVoy9PYuOqgV8AQYIdhdNojJpaGCIZGYFu3-kcafJ1E3OcUbI7Enxi6xIdBFlStD9jVC78P3TXbpgiLzkpTf1r_t7mdNyNVgwGrZDxtirLRrLw6X4VD6z3AdUuSVuw9XQZkOVhnLzSNDG-thgTAMC-dPdAv4gylTlUVDjlRrA2wFq0y7AvZx4fhTa-UZ1QSlXU3o2srPaF3rgERQdmOjTEJKZahUb4ORaeg7_JjyzC9Av4yWWqj3vNwGy3iJMB5smHrVn-0OgjE6mGPM5hsUPgu2rJr_zFd7siQPWvzIiQ0iGB0FdSAVfFeWXQP3lsitee6zfxji4-0dmldU2FR2t85uBF2Kxzn8emYc68JA8IdmIE2rVKdTEjx7iw8EN46VcdnK7kA_HP_jWAl6vMh5HmMg7N6SYpekNEdWEwbQQ0BgAZhbY194kDyPZgiFT9E-PLOqwN65Pc6l1jA1gb6lsxj2jhwHGQ&lptoken=17913450469e704b3874&affiliate_id=722&source_id=722&rdid=&lander=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /benefit/dynamic/asset/jquery.min.js HTTP/1.1Host: agitosvos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agitosvos.com/benefit/dynamic/?list_id=&externalid=4563e19f4bdf413a936bfe353ea2134c&affid=722&ph=&bread=60443be6-9ccb-428b-9a8b-409908a28a35&utm_content=&fbclid=&utm_source=&cep=rrZ4ukuuOwMxyj8Yg8GJTpmsf4Ytz_IWNnXpDO_c-Ag-F-I0RriYvluXnd4pFPtV0Rmic0LxP4JqoGWHvtPhQAKVJ_eJ7x590Yx4figoY1v9QJ135in-3clm3DCJbgTjnaWctD39aKR14mxDHdIRmffYCkbxO5Lp5xYvG8YiPp6C69SxsE0WLGuSfH86nWF8LWHvjWL_2sht7oRSiVFqKzb025vzQ0hoZQiEik3lzeYTMoAE31KMlMA9iWBSHOPYdsrKv4zIKGVkiFeaYSgRCw_I3NRYsGtnA_-85gUTC2LAPaXYg_eXYGVZ8QVcebeiB7NwB4ElVZvCorhI_Aj4ccVuQdntu8f-FpNXtUceuh7wQ_Dq6pNb0SxbV68nCstHJTMvm6SxDfX5soN3D6qimabdFk2t5Noj1ov7xzX6HwoQBg0hX3EpyUe-PgJnAn9HtuEbMoTmjaN820V1LuISA5kraMIe4isofXBTuDADeeDYfMqSnd9AUN4OkPSOqcCipiVKADj-rQ0LR5mm0h5d8y1mNCB8LnwguHd-7W_dssEAG3VLHfz-6MxXx0EChhUzjupzJq5kZkcbw14DMwFl1fD3P-KowbG8ga8xlkwk2Hi-EwDC6drE0JoudmZqW-xM6oQ36EY68GLhz4yf9L26yWEQFWiZCCiGvNUtatLIgzuJd_NSLkPDKqv2GUS4FhLpWOLkjpb6_jTISE89n7y60c2QlNI7kcM45j8e4fkKoF6iZ8U4aqiJG8WtprFRdLfvXanaaiN_3PTiFdGUv23Rbwc75WZx7FsQPxpfo746U7u9YowPHX5DLGhOvznKEgt53dR2u-gXB_IrS6r8dqlrvXb0dRmAXhga0YaJ0IYgsXM6qRQNPVqHjnhU1SOqeUzEcBAIhTW9IeBYsDUPTAEtAAk-9VGSz2oZP_jLzKsddNq3chR2dR8X5xMAbvl5Xq9cy0iZF1bLTKVNRFij_UDBjh2frDHVMh2dBQ4RvnQC8PTHbRyMBYt0ct2azOfwW2ggkmYD_lNqHBWt4Vf-q1tGx0YQEi6jZMPs6UEL4_KKXurd0UwWshNmguRRgqjemxyHbsZlrnYQmep8NPyHjIsfuV85nET_cQeMCCi9IFh8C-YNenH2XwHnr8s0q2bHwP8smZu99W437rln5GwiRAv6cbHAb2oBIVABebfRHz31tfTYDLCU-tDMtn0EMijRzRFkZuwGcuve-D4RNHVoy9PYuOqgV8AQYIdhdNojJpaGCIZGYFu3-kcafJ1E3OcUbI7Enxi6xIdBFlStD9jVC78P3TXbpgiLzkpTf1r_t7mdNyNVgwGrZDxtirLRrLw6X4VD6z3AdUuSVuw9XQZkOVhnLzSNDG-thgTAMC-dPdAv4gylTlUVDjlRrA2wFq0y7AvZx4fhTa-UZ1QSlXU3o2srPaF3rgERQdmOjTEJKZahUb4ORaeg7_JjyzC9Av4yWWqj3vNwGy3iJMB5smHrVn-0OgjE6mGPM5hsUPgu2rJr_zFd7siQPWvzIiQ0iGB0FdSAVfFeWXQP3lsitee6zfxji4-0dmldU2FR2t85uBF2Kxzn8emYc68JA8IdmIE2rVKdTEjx7iw8EN46VcdnK7kA_HP_jWAl6vMh5HmMg7N6SYpekNEdWEwbQQ0BgAZhbY194kDyPZgiFT9E-PLOqwN65Pc6l1jA1gb6lsxj2jhwHGQ&lptoken=17913450469e704b3874&affiliate_id=722&source_id=722&rdid=&lander=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /benefit/dynamic/asset/main.js?v=10.5 HTTP/1.1Host: agitosvos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agitosvos.com/benefit/dynamic/?list_id=&externalid=4563e19f4bdf413a936bfe353ea2134c&affid=722&ph=&bread=60443be6-9ccb-428b-9a8b-409908a28a35&utm_content=&fbclid=&utm_source=&cep=rrZ4ukuuOwMxyj8Yg8GJTpmsf4Ytz_IWNnXpDO_c-Ag-F-I0RriYvluXnd4pFPtV0Rmic0LxP4JqoGWHvtPhQAKVJ_eJ7x590Yx4figoY1v9QJ135in-3clm3DCJbgTjnaWctD39aKR14mxDHdIRmffYCkbxO5Lp5xYvG8YiPp6C69SxsE0WLGuSfH86nWF8LWHvjWL_2sht7oRSiVFqKzb025vzQ0hoZQiEik3lzeYTMoAE31KMlMA9iWBSHOPYdsrKv4zIKGVkiFeaYSgRCw_I3NRYsGtnA_-85gUTC2LAPaXYg_eXYGVZ8QVcebeiB7NwB4ElVZvCorhI_Aj4ccVuQdntu8f-FpNXtUceuh7wQ_Dq6pNb0SxbV68nCstHJTMvm6SxDfX5soN3D6qimabdFk2t5Noj1ov7xzX6HwoQBg0hX3EpyUe-PgJnAn9HtuEbMoTmjaN820V1LuISA5kraMIe4isofXBTuDADeeDYfMqSnd9AUN4OkPSOqcCipiVKADj-rQ0LR5mm0h5d8y1mNCB8LnwguHd-7W_dssEAG3VLHfz-6MxXx0EChhUzjupzJq5kZkcbw14DMwFl1fD3P-KowbG8ga8xlkwk2Hi-EwDC6drE0JoudmZqW-xM6oQ36EY68GLhz4yf9L26yWEQFWiZCCiGvNUtatLIgzuJd_NSLkPDKqv2GUS4FhLpWOLkjpb6_jTISE89n7y60c2QlNI7kcM45j8e4fkKoF6iZ8U4aqiJG8WtprFRdLfvXanaaiN_3PTiFdGUv23Rbwc75WZx7FsQPxpfo746U7u9YowPHX5DLGhOvznKEgt53dR2u-gXB_IrS6r8dqlrvXb0dRmAXhga0YaJ0IYgsXM6qRQNPVqHjnhU1SOqeUzEcBAIhTW9IeBYsDUPTAEtAAk-9VGSz2oZP_jLzKsddNq3chR2dR8X5xMAbvl5Xq9cy0iZF1bLTKVNRFij_UDBjh2frDHVMh2dBQ4RvnQC8PTHbRyMBYt0ct2azOfwW2ggkmYD_lNqHBWt4Vf-q1tGx0YQEi6jZMPs6UEL4_KKXurd0UwWshNmguRRgqjemxyHbsZlrnYQmep8NPyHjIsfuV85nET_cQeMCCi9IFh8C-YNenH2XwHnr8s0q2bHwP8smZu99W437rln5GwiRAv6cbHAb2oBIVABebfRHz31tfTYDLCU-tDMtn0EMijRzRFkZuwGcuve-D4RNHVoy9PYuOqgV8AQYIdhdNojJpaGCIZGYFu3-kcafJ1E3OcUbI7Enxi6xIdBFlStD9jVC78P3TXbpgiLzkpTf1r_t7mdNyNVgwGrZDxtirLRrLw6X4VD6z3AdUuSVuw9XQZkOVhnLzSNDG-thgTAMC-dPdAv4gylTlUVDjlRrA2wFq0y7AvZx4fhTa-UZ1QSlXU3o2srPaF3rgERQdmOjTEJKZahUb4ORaeg7_JjyzC9Av4yWWqj3vNwGy3iJMB5smHrVn-0OgjE6mGPM5hsUPgu2rJr_zFd7siQPWvzIiQ0iGB0FdSAVfFeWXQP3lsitee6zfxji4-0dmldU2FR2t85uBF2Kxzn8emYc68JA8IdmIE2rVKdTEjx7iw8EN46VcdnK7kA_HP_jWAl6vMh5HmMg7N6SYpekNEdWEwbQQ0BgAZhbY194kDyPZgiFT9E-PLOqwN65Pc6l1jA1gb6lsxj2jhwHGQ&lptoken=17913450469e704b3874&affiliate_id=722&source_id=722&rdid=&lander=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /j.php?a=799078&u=https%3A%2F%2Fagitosvos.com%2Fbenefit%2Fdynamic%2F%3Flist_id%3D%26externalid%3D4563e19f4bdf413a936bfe353ea2134c%26affid%3D722%26ph%3D%26bread%3D60443be6-9ccb-428b-9a8b-409908a28a35%26utm_content%3D%26fbclid%3D%26utm_source%3D%26cep%3DrrZ4ukuuOwMxyj8Yg8GJTpmsf4Ytz_IWNnXpDO_c-Ag-F-I0RriYvluXnd4pFPtV0Rmic0LxP4JqoGWHvtPhQAKVJ_eJ7x590Yx4figoY1v9QJ135in-3clm3DCJbgTjnaWctD39aKR14mxDHdIRmffYCkbxO5Lp5xYvG8YiPp6C69SxsE0WLGuSfH86nWF8LWHvjWL_2sht7oRSiVFqKzb025vzQ0hoZQiEik3lzeYTMoAE31KMlMA9iWBSHOPYdsrKv4zIKGVkiFeaYSgRCw_I3NRYsGtnA_-85gUTC2LAPaXYg_eXYGVZ8QVcebeiB7NwB4ElVZvCorhI_Aj4ccVuQdntu8f-FpNXtUceuh7wQ_Dq6pNb0SxbV68nCstHJTMvm6SxDfX5soN3D6qimabdFk2t5Noj1ov7xzX6HwoQBg0hX3EpyUe-PgJnAn9HtuEbMoTmjaN820V1LuISA5kraMIe4isofXBTuDADeeDYfMqSnd9AUN4OkPSOqcCipiVKADj-rQ0LR5mm0h5d8y1mNCB8LnwguHd-7W_dssEAG3VLHfz-6MxXx0EChhUzjupzJq5kZkcbw14DMwFl1fD3P-KowbG8ga8xlkwk2Hi-EwDC6drE0JoudmZqW-xM6oQ36EY68GLhz4yf9L26yWEQFWiZCCiGvNUtatLIgzuJd_NSLkPDKqv2GUS4FhLpWOLkjpb6_jTISE89n7y60c2QlNI7kcM45j8e4fkKoF6iZ8U4aqiJG8WtprFRdLfvXanaaiN_3PTiFdGUv23Rbwc75WZx7FsQPxpfo746U7u9YowPHX5DLGhOvznKEgt53dR2u-gXB_IrS6r8dqlrvXb0dRmAXhga0YaJ0IYgsXM6qRQNPVqHjnhU1SOqeUzEcBAIhTW9IeBYsDUPTAEtAAk-9VGSz2oZP_jLzKsddNq3chR2dR8X5xMAbvl5Xq9cy0iZF1bLTKVNRFij_UDBjh2frDHVMh2dBQ4RvnQC8PTHbRyMBYt0ct2azOfwW2ggkmYD_lNqHBWt4Vf-q1tGx0YQEi6jZMPs6UEL4_KKXurd0UwWshNmguRRgqjemxyHbsZlrnYQmep8NPyHjIsfuV85nET_cQeMCCi9IFh8C-YNenH2XwHnr8s0q2bHwP8smZu99W437rln5GwiRAv6cbHAb2oBIVABebfRHz31tfTYDLCU-tDMtn0EMijRzRFkZuwGcuve-D4RNHVoy9PYuOqgV8AQYIdhdNojJpaGCIZGYFu3-kcafJ1E3OcUbI7Enxi6xIdBFlStD9jVC78P3TXbpgiLzkpTf1r_t7mdNyNVgwGrZDxtirLRrLw6X4VD6z3AdUuSVuw9XQZkOVhnLzSNDG-thgTAMC-dPdAv4gylTlUVDjlRrA2wFq0y7AvZx4fhTa-UZ1QSlXU3o2srPaF3rgERQdmOjTEJKZahUb4ORaeg7_JjyzC9Av4yWWqj3vNwGy3iJMB5smHrVn-0OgjE6mGPM5hsUPgu2rJr_zFd7siQPWvzIiQ0iGB0FdSAVfFeWXQP3lsitee6zfxji4-0dmldU2FR2t85uBF2Kxzn8emYc68JA8IdmIE2rVKdTEjx7iw8EN46VcdnK7kA_HP_jWAl6vMh5HmMg7N6SYpekNEdWEwbQQ0BgAZhbY194kDyPZgiFT9E-PLOqwN65Pc6l1jA1gb6lsxj2jhwHGQ%26lptoken%3D17913450469e704b3874%26affiliate_id%3D722%26source_id%3D722%26rdid%3D%26lander%3D&vn=2 HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/sdk/everflow.js HTTP/1.1Host: eftrk.agitosvos.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uniqueClick_9HJL91C=307e39e3-e7dc-4868-859f-620c7c745344:1734465233; transaction_id=4563e19f4bdf413a936bfe353ea2134c
Source: global traffic	HTTP traffic detected: GET /benefit/dynamic/asset/clean.png HTTP/1.1Host: agitosvos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://agitosvos.com/benefit/dynamic/asset/main.css?v=4.5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /benefit/dynamic/asset/check_green.svg HTTP/1.1Host: agitosvos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://agitosvos.com/benefit/dynamic/asset/main.css?v=4.5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /benefit/dynamic/asset/main.js?v=10.5 HTTP/1.1Host: agitosvos.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json?key=uDBlDLE4QL19zpt HTTP/1.1Host: pro.ip-api.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://agitosvos.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://agitosvos.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /benefit/dynamic/asset/jquery.min.js HTTP/1.1Host: agitosvos.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json?key=uDBlDLE4QL19zpt HTTP/1.1Host: pro.ip-api.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d/.js?lpref=&lpurl=https%3A%2F%2Fagitosvos.com%2Fbenefit%2Fdynamic%2F%3Flist_id%3D%26externalid%3D4563e19f4bdf413a936bfe353ea2134c%26affid%3D722%26ph%3D%26bread%3D60443be6-9ccb-428b-9a8b-409908a28a35%26utm_content%3D%26fbclid%3D%26utm_source%3D%26cep%3DrrZ4ukuuOwMxyj8Yg8GJTpmsf4Ytz_IWNnXpDO_c-Ag-F-I0RriYvluXnd4pFPtV0Rmic0LxP4JqoGWHvtPhQAKVJ_eJ7x590Yx4figoY1v9QJ135in-3clm3DCJbgTjnaWctD39aKR14mxDHdIRmffYCkbxO5Lp5xYvG8YiPp6C69SxsE0WLGuSfH86nWF8LWHvjWL_2sht7oRSiVFqKzb025vzQ0hoZQiEik3lzeYTMoAE31KMlMA9iWBSHOPYdsrKv4zIKGVkiFeaYSgRCw_I3NRYsGtnA_-85gUTC2LAPaXYg_eXYGVZ8QVcebeiB7NwB4ElVZvCorhI_Aj4ccVuQdntu8f-FpNXtUceuh7wQ_Dq6pNb0SxbV68nCstHJTMvm6SxDfX5soN3D6qimabdFk2t5Noj1ov7xzX6HwoQBg0hX3EpyUe-PgJnAn9HtuEbMoTmjaN820V1LuISA5kraMIe4isofXBTuDADeeDYfMqSnd9AUN4OkPSOqcCipiVKADj-rQ0LR5mm0h5d8y1mNCB8LnwguHd-7W_dssEAG3VLHfz-6MxXx0EChhUzjupzJq5kZkcbw14DMwFl1fD3P-KowbG8ga8xlkwk2Hi-EwDC6drE0JoudmZqW-xM6oQ36EY68GLhz4yf9L26yWEQFWiZCCiGvNUtatLIgzuJd_NSLkPDKqv2GUS4FhLpWOLkjpb6_jTISE89n7y60c2QlNI7kcM45j8e4fkKoF6iZ8U4aqiJG8WtprFRdLfvXanaaiN_3PTiFdGUv23Rbwc75WZx7FsQPxpfo746U7u9YowPHX5DLGhOvznKEgt53dR2u-gXB_IrS6r8dqlrvXb0dRmAXhga0YaJ0IYgsXM6qRQNPVqHjnhU1SOqeUzEcBAIhTW9IeBYsDUPTAEtAAk-9VGSz2oZP_jLzKsddNq3chR2dR8X5xMAbvl5Xq9cy0iZF1bLTKVNRFij_UDBjh2frDHVMh2dBQ4RvnQC8PTHbRyMBYt0ct2azOfwW2ggkmYD_lNqHBWt4Vf-q1tGx0YQEi6jZMPs6UEL4_KKXurd0UwWshNmguRRgqjemxyHbsZlrnYQmep8NPyHjIsfuV85nET_cQeMCCi9IFh8C-YNenH2XwHnr8s0q2bHwP8smZu99W437rln5GwiRAv6cbHAb2oBIVABebfRHz31tfTYDLCU-tDMtn0EMijRzRFkZuwGcuve-D4RNHVoy9PYuOqgV8AQYIdhdNojJpaGCIZGYFu3-kcafJ1E3OcUbI7Enxi6xIdBFlStD9jVC78P3TXbpgiLzkpTf1r_t7mdNyNVgwGrZDxtirLRrLw6X4VD6z3AdUuSVuw9XQZkOVhnLzSNDG-thgTAMC-dPdAv4gylTlUVDjlRrA2wFq0y7AvZx4fhTa-UZ1QSlXU3o2srPaF3rgERQdmOjTEJKZahUb4ORaeg7_JjyzC9Av4yWWqj3vNwGy3iJMB5smHrVn-0OgjE6mGPM5hsUPgu2rJr_zFd7siQPWvzIiQ0iGB0FdSAVfFeWXQP3lsitee6zfxji4-0dmldU2FR2t85uBF2Kxzn8emYc68JA8IdmIE2rVKdTEjx7iw8EN46VcdnK7kA_HP_jWAl6vMh5HmMg7N6SYpekNEdWEwbQQ0BgAZhbY194kDyPZgiFT9E-PLOqwN65Pc6l1jA1gb6lsxj2jhwHGQ%26lptoken%3D17913450469e704b3874%26affiliate_id%3D722%26source_id%3D722%26rdid%3D%26lander%3D&lpt=Agitosvos%20-%20We%20Do%20Justice%20Right&vtm=1734465244960 HTTP/1.1Host: trk.agitosvos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agitosvos.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 60443be6-9ccb-428b-9a8b-409908a28a35-v4=kfyXwjeytYj_NXHXxZjUIpISkvMfI_y4eGJ3h6tuRAc; cep-v4
Source: global traffic	HTTP traffic detected: GET /benefit/dynamic/asset/check_green.svg HTTP/1.1Host: agitosvos.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /benefit/dynamic/asset/clean.png HTTP/1.1Host: agitosvos.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d/.js?lpref=&lpurl=https%3A%2F%2Fagitosvos.com%2Fbenefit%2Fdynamic%2F%3Flist_id%3D%26externalid%3D4563e19f4bdf413a936bfe353ea2134c%26affid%3D722%26ph%3D%26bread%3D60443be6-9ccb-428b-9a8b-409908a28a35%26utm_content%3D%26fbclid%3D%26utm_source%3D%26cep%3DrrZ4ukuuOwMxyj8Yg8GJTpmsf4Ytz_IWNnXpDO_c-Ag-F-I0RriYvluXnd4pFPtV0Rmic0LxP4JqoGWHvtPhQAKVJ_eJ7x590Yx4figoY1v9QJ135in-3clm3DCJbgTjnaWctD39aKR14mxDHdIRmffYCkbxO5Lp5xYvG8YiPp6C69SxsE0WLGuSfH86nWF8LWHvjWL_2sht7oRSiVFqKzb025vzQ0hoZQiEik3lzeYTMoAE31KMlMA9iWBSHOPYdsrKv4zIKGVkiFeaYSgRCw_I3NRYsGtnA_-85gUTC2LAPaXYg_eXYGVZ8QVcebeiB7NwB4ElVZvCorhI_Aj4ccVuQdntu8f-FpNXtUceuh7wQ_Dq6pNb0SxbV68nCstHJTMvm6SxDfX5soN3D6qimabdFk2t5Noj1ov7xzX6HwoQBg0hX3EpyUe-PgJnAn9HtuEbMoTmjaN820V1LuISA5kraMIe4isofXBTuDADeeDYfMqSnd9AUN4OkPSOqcCipiVKADj-rQ0LR5mm0h5d8y1mNCB8LnwguHd-7W_dssEAG3VLHfz-6MxXx0EChhUzjupzJq5kZkcbw14DMwFl1fD3P-KowbG8ga8xlkwk2Hi-EwDC6drE0JoudmZqW-xM6oQ36EY68GLhz4yf9L26yWEQFWiZCCiGvNUtatLIgzuJd_NSLkPDKqv2GUS4FhLpWOLkjpb6_jTISE89n7y60c2QlNI7kcM45j8e4fkKoF6iZ8U4aqiJG8WtprFRdLfvXanaaiN_3PTiFdGUv23Rbwc75WZx7FsQPxpfo746U7u9YowPHX5DLGhOvznKEgt53dR2u-gXB_IrS6r8dqlrvXb0dRmAXhga0YaJ0IYgsXM6qRQNPVqHjnhU1SOqeUzEcBAIhTW9IeBYsDUPTAEtAAk-9VGSz2oZP_jLzKsddNq3chR2dR8X5xMAbvl5Xq9cy0iZF1bLTKVNRFij_UDBjh2frDHVMh2dBQ4RvnQC8PTHbRyMBYt0ct2azOfwW2ggkmYD_lNqHBWt4Vf-q1tGx0YQEi6jZMPs6UEL4_KKXurd0UwWshNmguRRgqjemxyHbsZlrnYQmep8NPyHjIsfuV85nET_cQeMCCi9IFh8C-YNenH2XwHnr8s0q2bHwP8smZu99W437rln5GwiRAv6cbHAb2oBIVABebfRHz31tfTYDLCU-tDMtn0EMijRzRFkZuwGcuve-D4RNHVoy9PYuOqgV8AQYIdhdNojJpaGCIZGYFu3-kcafJ1E3OcUbI7Enxi6xIdBFlStD9jVC78P3TXbpgiLzkpTf1r_t7mdNyNVgwGrZDxtirLRrLw6X4VD6z3AdUuSVuw9XQZkOVhnLzSNDG-thgTAMC-dPdAv4gylTlUVDjlRrA2wFq0y7AvZx4fhTa-UZ1QSlXU3o2srPaF3rgERQdmOjTEJKZahUb4ORaeg7_JjyzC9Av4yWWqj3vNwGy3iJMB5smHrVn-0OgjE6mGPM5hsUPgu2rJr_zFd7siQPWvzIiQ0iGB0FdSAVfFeWXQP3lsitee6zfxji4-0dmldU2FR2t85uBF2Kxzn8emYc68JA8IdmIE2rVKdTEjx7iw8EN46VcdnK7kA_HP_jWAl6vMh5HmMg7N6SYpekNEdWEwbQQ0BgAZhbY194kDyPZgiFT9E-PLOqwN65Pc6l1jA1gb6lsxj2jhwHGQ%26lptoken%3D17913450469e704b3874%26affiliate_id%3D722%26source_id%3D722%26rdid%3D%26lander%3D&lpt=Agitosvos%20-%20We%20Do%20Justice%20Right&vtm=1734465244960 HTTP/1.1Host: trk.agitosvos.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 60443be6-9ccb-428b-9a8b-409908a28a35-v4=kfyXwjeytYj_NXHXxZjUIpISkvMfI_y4eGJ3h6tuRAc; cep-v4=50QyVW1lBogK5O4u_CDBMTveY7QAemyJx7ytgqfOOuZjiQ1ld4JHicaBe3keyctvafzCTEjg4uppIBbg4vcsS96JFs2MAiJ9Jf3xmPHcA5ntwdb3hH0ozk8GJAAIIrYcA2xJHCy6mamcPKoYJkgO_5FlOWBVwEDCetZLVsUeVd3-RvRGuIsyOFbAQr-u69zjPxTCu7CtTrZHWBk0gHGtAVMwDTVulWJ4USlwSIMbMXIujHH7Uad5Bq_bAyz9AkPWDPhYXKctD2lYboM71VoYv1pssbo7N1FwzUyWp7_qv7aLQqjUdhKg79mFq6l55cAWiYtgzSJPFjjePW-QXAUIbXhSPxIrXp0L8wHN0wwldUZIl4XDxytRtNss3cc7TBxG9KAyPt8sOcdWUeZE10nazOetrbzpX_pH8kV3i88I_ARhkKggU8wT8Q3lw-u

Found strings which match to known social media urls

Source: chromecache_129.2.dr	String found in binary or memory: \n\/\u0026gt;\u0026lt;\/noscript\u0026gt;\n\u0026lt;!-- End Meta Pixel Code --\u0026gt;","vtp_supportDocumentWrite":false,"vtp_enableIframeMode":false,"vtp_enableEditJsMacroBehavior":false,"tag_id":191},{"function":"__html","metadata":["map"],"once_per_event":true,"vtp_html":"\n\u003Cscript type=\"text\/gtmscript\"\u003E!function(b,e,f,g,a,c,d){b.fbq||(a=b.fbq=function(){a.callMethod?a.callMethod.apply(a,arguments):a.queue.push(arguments)},b._fbq||(b._fbq=a),a.push=a,a.loaded=!0,a.version=\"2.0\",a.queue=[],c=e.createElement(f),c.async=!0,c.src=g,d=e.getElementsByTagName(f)[0],d.parentNode.insertBefore(c,d))}(window,document,\"script\",\"https:\/\/connect.facebook.net\/en_US\/fbevents.js\");fbq(\"init\",\"537135901828806\");fbq(\"track\",\"PageView\");\u003C\/script\u003E\n\u003Cnoscript\u003E\u0026lt;img height=\u0026quot;1\u0026quot; width=\u0026quot;1\u0026quot; style=\u0026quot;display:none\u0026quot;\nsrc=\u0026quot;https:\/\/www.facebook.com\/tr?id=537135901828806\u0026amp;ev=PageView\u0026amp;noscript=1 equals www.facebook.com (Facebook)
Source: chromecache_129.2.dr	String found in binary or memory: return b}VD.F="internal.enableAutoEventOnTimer";var Vb=wa(["data-gtm-yt-inspected-"]),XD=["www.youtube.com","www.youtube-nocookie.com"],YD,ZD=!1; equals www.youtube.com (Youtube)
Source: chromecache_129.2.dr	String found in binary or memory: var jD=function(a,b,c,d,e){var f=aB("fsl",c?"nv.mwt":"mwt",0),g;g=c?aB("fsl","nv.ids",[]):aB("fsl","ids",[]);if(!g.length)return!0;var k=fB(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);T(121);if(m==="https://www.facebook.com/tr/")return T(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!Mz(k,Oz(b, equals www.facebook.com (Facebook)

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: funcilnewshical.com
Source: global traffic	DNS traffic detected: DNS query: register.douglasgrimes.com
Source: global traffic	DNS traffic detected: DNS query: convertri.imgix.net
Source: global traffic	DNS traffic detected: DNS query: cdn.convertri.com
Source: global traffic	DNS traffic detected: DNS query: snowplow.convertri.com
Source: global traffic	DNS traffic detected: DNS query: www.rkd02ks.com
Source: global traffic	DNS traffic detected: DNS query: eftrk.agitosvos.com
Source: global traffic	DNS traffic detected: DNS query: trk.agitosvos.com
Source: global traffic	DNS traffic detected: DNS query: agitosvos.com
Source: global traffic	DNS traffic detected: DNS query: dev.visualwebsiteoptimizer.com
Source: global traffic	DNS traffic detected: DNS query: pro.ip-api.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net

URLs found in memory or binary data

Source: chromecache_132.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_110.2.dr	String found in binary or memory: http://scripts.sil.org/OFLMontserratThin-BoldVersion
Source: chromecache_90.2.dr	String found in binary or memory: http://scripts.sil.org/OFLMontserratThin-RegularVersion
Source: chromecache_109.2.dr, chromecache_127.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_114.2.dr	String found in binary or memory: http://www.imagemagick.org
Source: chromecache_122.2.dr	String found in binary or memory: https://agitosvos.com/contact.php
Source: chromecache_122.2.dr	String found in binary or memory: https://agitosvos.com/marketing-partners
Source: chromecache_122.2.dr	String found in binary or memory: https://agitosvos.com/open_offers.php?transaction_id=$
Source: chromecache_122.2.dr	String found in binary or memory: https://agitosvos.com/privacy-policy.html
Source: chromecache_122.2.dr	String found in binary or memory: https://agitosvos.com/privacy-policy.html#donotsell
Source: chromecache_122.2.dr	String found in binary or memory: https://agitosvos.com/terms-and-conditions.html
Source: chromecache_104.2.dr	String found in binary or memory: https://agitosvos.com/thank-you/?transaction_id=
Source: chromecache_112.2.dr, chromecache_104.2.dr	String found in binary or memory: https://agitosvos.com/thank-you/crosscall/?clickId=
Source: chromecache_129.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_129.2.dr	String found in binary or memory: https://cdn.by.wonderpush.com/sdk/1.1/wonderpush-loader.min.js
Source: chromecache_132.2.dr	String found in binary or memory: https://cdn.convertri.com/cdn.min.css?v=2024-01-23-10-02-44
Source: chromecache_132.2.dr	String found in binary or memory: https://cdn.convertri.com/jquery-1.12.2.min.js?v=2024-01-23-10-02-44
Source: chromecache_122.2.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com
Source: chromecache_122.2.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/j.php?a=
Source: chromecache_122.2.dr	String found in binary or memory: https://eftrk.agitosvos.com/scripts/sdk/everflow.js
Source: chromecache_122.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: chromecache_122.2.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Lato:wght
Source: chromecache_122.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: chromecache_97.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwaPGR_p.woff2)
Source: chromecache_97.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwiPGQ.woff2)
Source: chromecache_97.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2)
Source: chromecache_97.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2)
Source: chromecache_97.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwaPGR_p.woff2)
Source: chromecache_97.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ.woff2)
Source: chromecache_90.2.dr, chromecache_110.2.dr	String found in binary or memory: https://github.com/JulietaUla/Montserrat)
Source: chromecache_94.2.dr, chromecache_128.2.dr	String found in binary or memory: https://github.com/notofonts/latin-greek-cyrillic)
Source: chromecache_132.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_129.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_129.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_112.2.dr, chromecache_104.2.dr	String found in binary or memory: https://pro.ip-api.com/json?key=uDBlDLE4QL19zpt
Source: chromecache_129.2.dr	String found in binary or memory: https://px.ads.linkedin.com/collect?
Source: chromecache_94.2.dr	String found in binary or memory: https://scripts.sil.org/OFLNotoSans-BoldVersion
Source: chromecache_128.2.dr	String found in binary or memory: https://scripts.sil.org/OFLNotoSans-RegularVersion
Source: chromecache_129.2.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: chromecache_129.2.dr	String found in binary or memory: https://static.hotjar.com/c/hotjar-
Source: chromecache_129.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com
Source: chromecache_122.2.dr, chromecache_112.2.dr, chromecache_104.2.dr	String found in binary or memory: https://trk.agitosvos.com/
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/11
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/12
Source: chromecache_122.2.dr, chromecache_112.2.dr, chromecache_104.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/13
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/15
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/16
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/2
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/20
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/25
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/26
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/27
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/29
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/3
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/34
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/36
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/37
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/38
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/4
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/5
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/6
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/7
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/8
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/click/9
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/d/.js
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com/d/.js?noscript=true&ourl=
Source: chromecache_122.2.dr	String found in binary or memory: https://trk.agitosvos.com;
Source: chromecache_129.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_129.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_129.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_122.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_122.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-W886N4V6

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

System Summary

Classification label

Source: classification engine

Classification label: mal56.win@20/91@50/16

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2016,i,2438033404348975924,14980259009640844384,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://funcilnewshical.com/76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=cost"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2016,i,2438033404348975924,14980259009640844384,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Windows shortcut file (LNK) contains relative path

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior