Edit tour

Windows Analysis Report
https://qrco.de/bfRPUM?TQt=hHyjn9h

Overview

General Information

Sample URL:	https://qrco.de/bfRPUM?TQt=hHyjn9h
Analysis ID:	1522644
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected suspicious crossdomain redirect

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1220 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2004,i,14283968118612870979,16414242818034272880,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5628 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qrco.de/bfRPUM?TQt=hHyjn9h" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1727698719867&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49718 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_281.2.dr, chromecache_181.2.dr	String found in binary or memory: <a href="http://www.youtube.com/uksupremecourt" target="_blank"><img src="../sc-img/supreme-yt.png" alt="YouTube"></a> equals www.youtube.com (Youtube)
Source: chromecache_220.2.dr	String found in binary or memory: <a href="http://www.youtube.com/uksupremecourt"><img src="../sc-img/jcpc-yt.png" alt="YouTube"></a> equals www.youtube.com (Youtube)
Source: chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	String found in binary or memory: Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Yj:function(){e=zb()},nd:function(){d()}}};var gc=ja(["data-gtm-yt-inspected-"]),FC=["www.youtube.com","www.youtube-nocookie.com"],GC,HC=!1; equals www.youtube.com (Youtube)
Source: chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=lA(a,c,e);N(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return N(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},oA=function(){var a=[],b=function(c){return ob(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={eh:e,ah:f,bh:g,Ph:k,Qh:m,Ge:n,Bb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(QC(w,"iframe_api")\|\|QC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!HC&&OC(x[A],p.Ge))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	String found in binary or memory: var SB=function(a,b,c,d,e){var f=Jz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Jz("fsl","nv.ids",[]):Jz("fsl","ids",[]);if(!g.length)return!0;var k=Oz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);N(121);if(m==="https://www.facebook.com/tr/")return N(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!wy(k,yy(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: qrco.de
Source: global traffic	DNS traffic detected: DNS query: parkingzw.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.supremecourt.uk
Source: global traffic	DNS traffic detected: DNS query: addsearch.com
Source: global traffic	DNS traffic detected: DNS query: www.jcpc.uk
Source: global traffic	DNS traffic detected: DNS query: d20vwa69zln1wj.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: stats.addsearch.com

Source: chromecache_213.2.dr, chromecache_155.2.dr, chromecache_308.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_197.2.dr	String found in binary or memory: http://supremecourtevents.co.uk/
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: http://twitter.com/uksupremecourt
Source: chromecache_223.2.dr, chromecache_284.2.dr	String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	String found in binary or memory: http://www.jcpc.uk
Source: chromecache_164.2.dr	String found in binary or memory: http://www.nationaljusticemuseum.org.uk/education/
Source: chromecache_188.2.dr, chromecache_197.2.dr	String found in binary or memory: http://www.supremecourt.uk/
Source: chromecache_166.2.dr, chromecache_164.2.dr, chromecache_305.2.dr	String found in binary or memory: http://www.supremecourt.uk/about/judicial-conduct-and-complaints.html
Source: chromecache_197.2.dr, chromecache_305.2.dr	String found in binary or memory: http://www.supremecourt.uk/accessibility.html
Source: chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	String found in binary or memory: http://www.supremecourt.uk/contact-us.html
Source: chromecache_166.2.dr, chromecache_164.2.dr, chromecache_305.2.dr	String found in binary or memory: http://www.supremecourt.uk/current-cases.html
Source: chromecache_188.2.dr, chromecache_197.2.dr	String found in binary or memory: http://www.supremecourt.uk/decided-cases.shtml
Source: chromecache_166.2.dr, chromecache_164.2.dr, chromecache_305.2.dr	String found in binary or memory: http://www.supremecourt.uk/decided-cases/index.html
Source: chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	String found in binary or memory: http://www.supremecourt.uk/index.html
Source: chromecache_188.2.dr, chromecache_166.2.dr, chromecache_281.2.dr, chromecache_172.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_181.2.dr, chromecache_305.2.dr, chromecache_220.2.dr	String found in binary or memory: http://www.supremecourt.uk/labels.rdf
Source: chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	String found in binary or memory: http://www.supremecourt.uk/news/index.html
Source: chromecache_200.2.dr, chromecache_293.2.dr	String found in binary or memory: http://www.supremecourt.uk/privacy-notice.html
Source: chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	String found in binary or memory: http://www.supremecourt.uk/results.html
Source: chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	String found in binary or memory: http://www.supremecourt.uk/sitemap.html
Source: chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	String found in binary or memory: http://www.supremecourt.uk/terms-and-conditions.html
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: http://www.youtube.com/uksupremecourt
Source: chromecache_188.2.dr, chromecache_166.2.dr, chromecache_281.2.dr, chromecache_172.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_181.2.dr, chromecache_305.2.dr, chromecache_220.2.dr	String found in binary or memory: https://addsearch.com/js/?key=bb5ed5a80ec6844383bbc6a01f347e00
Source: chromecache_249.2.dr, chromecache_158.2.dr	String found in binary or memory: https://addsearch.com/logo/AAAAAA-16.png);
Source: chromecache_196.2.dr, chromecache_297.2.dr, chromecache_173.2.dr	String found in binary or memory: https://addsearch.com/logo/AAAAAA-20.png
Source: chromecache_196.2.dr, chromecache_297.2.dr, chromecache_173.2.dr	String found in binary or memory: https://addsearch.com/searchui/
Source: chromecache_229.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_288.2.dr, chromecache_222.2.dr, chromecache_211.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	String found in binary or memory: https://cdn.reactandshare.com/plugin/rns.js
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Cormorant
Source: chromecache_151.2.dr, chromecache_275.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cormorantgaramond/v16/co3YmX5slCNuHLi8bLeY9MK7whWMhyjQAllfsA-I1hc.woff2)
Source: chromecache_151.2.dr, chromecache_275.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cormorantgaramond/v16/co3YmX5slCNuHLi8bLeY9MK7whWMhyjQAllfsQ-I1hc.woff2)
Source: chromecache_151.2.dr, chromecache_275.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cormorantgaramond/v16/co3YmX5slCNuHLi8bLeY9MK7whWMhyjQAllfsw-I1hc.woff2)
Source: chromecache_151.2.dr, chromecache_275.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cormorantgaramond/v16/co3YmX5slCNuHLi8bLeY9MK7whWMhyjQAllfug-I1hc.woff2)
Source: chromecache_151.2.dr, chromecache_275.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cormorantgaramond/v16/co3YmX5slCNuHLi8bLeY9MK7whWMhyjQAllfvg-I.woff2)
Source: chromecache_151.2.dr, chromecache_275.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cormorantgaramond/v16/co3bmX5slCNuHLi8bLeY9MK7whWMhyjYp3tKgS4.woff2)
Source: chromecache_151.2.dr, chromecache_275.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cormorantgaramond/v16/co3bmX5slCNuHLi8bLeY9MK7whWMhyjYpHtKgS4.woff2)
Source: chromecache_151.2.dr, chromecache_275.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cormorantgaramond/v16/co3bmX5slCNuHLi8bLeY9MK7whWMhyjYpntKgS4.woff2)
Source: chromecache_151.2.dr, chromecache_275.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cormorantgaramond/v16/co3bmX5slCNuHLi8bLeY9MK7whWMhyjYqXtK.woff2)
Source: chromecache_151.2.dr, chromecache_275.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cormorantgaramond/v16/co3bmX5slCNuHLi8bLeY9MK7whWMhyjYrXtKgS4.woff2)
Source: chromecache_229.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_211.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_288.2.dr, chromecache_222.2.dr, chromecache_211.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_166.2.dr	String found in binary or memory: https://www.actionfraud.police.uk/
Source: chromecache_288.2.dr, chromecache_222.2.dr, chromecache_211.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_288.2.dr, chromecache_222.2.dr, chromecache_211.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_288.2.dr, chromecache_222.2.dr, chromecache_211.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_229.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_288.2.dr, chromecache_222.2.dr, chromecache_211.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_229.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_288.2.dr, chromecache_222.2.dr, chromecache_211.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_265.2.dr, chromecache_271.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-K660MK23DQ
Source: chromecache_300.2.dr, chromecache_236.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-RF2TC9QCFD
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: https://www.instagram.com/uksupremecourt
Source: chromecache_181.2.dr	String found in binary or memory: https://www.jcpc.uk/
Source: chromecache_220.2.dr	String found in binary or memory: https://www.jcpc.uk/rss-feeds.html
Source: chromecache_188.2.dr	String found in binary or memory: https://www.jcpc.uk/visiting/court-sittings.html
Source: chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_220.2.dr	String found in binary or memory: https://www.supremecourt.uk/
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: https://www.supremecourt.uk/about/judicial-conduct-and-complaints.html
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: https://www.supremecourt.uk/accessibility.html
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: https://www.supremecourt.uk/contact-us.html
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: https://www.supremecourt.uk/current-cases.html
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: https://www.supremecourt.uk/index.html
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: https://www.supremecourt.uk/news/index.html
Source: chromecache_164.2.dr	String found in binary or memory: https://www.supremecourt.uk/news/stories/uk-supreme-court-to-launch-paid-internship-for-aspiring-law
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: https://www.supremecourt.uk/results.html
Source: chromecache_281.2.dr, chromecache_181.2.dr	String found in binary or memory: https://www.supremecourt.uk/rss-feeds.html
Source: chromecache_220.2.dr	String found in binary or memory: https://www.supremecourt.uk/scams.html
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: https://www.supremecourt.uk/sitemap.html
Source: chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	String found in binary or memory: https://www.supremecourt.uk/terms-and-conditions.html
Source: chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2004,i,14283968118612870979,16414242818034272880,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qrco.de/bfRPUM?TQt=hHyjn9h"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2004,i,14283968118612870979,16414242818034272880,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source: global traffic	HTTP traffic detected: GET /bfRPUM?TQt=hHyjn9h HTTP/1.1Host: qrco.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: parkingzw.topConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logo/AAAAAA-16.png HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logo/AAAAAA-16.png HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.supremecourt.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.jcpc.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logo/AAAAAA-16.png HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.jcpc.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1Host: addsearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.jcpc.uk/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source	Detection	Scanner	Label	Link
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
http://jqueryui.com	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://stats.g.doubleclick.net/j/collect	0%	URL Reputation	safe
http://www.bohemiancoding.com/sketch	0%	URL Reputation	safe
https://tagassistant.google.com/	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://www.merchant-center-analytics.goog	0%	URL Reputation	safe
https://cdn.reactandshare.com/plugin/rns.js	0%	Virustotal		Browse
https://addsearch.com/logo/AAAAAA-20.png	0%	Virustotal		Browse
https://www.supremecourt.uk/terms-and-conditions.html	0%	Virustotal		Browse
https://addsearch.com/js/?key=bb5ed5a80ec6844383bbc6a01f347e00	0%	Virustotal		Browse
https://www.supremecourt.uk/index.html	0%	Virustotal		Browse
https://www.supremecourt.uk/sitemap.html	0%	Virustotal		Browse
https://www.instagram.com/uksupremecourt	0%	Virustotal		Browse
https://www.supremecourt.uk/rss-feeds.html	0%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://www.youtube.com/iframe_api	0%	Virustotal		Browse
http://www.nationaljusticemuseum.org.uk/education/	0%	Virustotal		Browse
http://www.supremecourt.uk/privacy-notice.html	0%	Virustotal		Browse
http://www.jcpc.uk	0%	Virustotal		Browse
http://www.supremecourt.uk/decided-cases/index.html	0%	Virustotal		Browse
https://www.supremecourt.uk/about/judicial-conduct-and-complaints.html	0%	Virustotal		Browse
https://addsearch.com/searchui/	0%	Virustotal		Browse
http://www.supremecourt.uk/labels.rdf	0%	Virustotal		Browse
http://www.youtube.com/uksupremecourt	0%	Virustotal		Browse
https://addsearch.com/www/script/v3/loading-gray.gif	0%	Virustotal		Browse
https://addsearch.com/www/script/v3/logo-red.svg	0%	Virustotal		Browse
https://www.supremecourt.uk/contact-us.html	0%	Virustotal		Browse
https://www.supremecourt.uk/results.html	0%	Virustotal		Browse
http://twitter.com/uksupremecourt	0%	Virustotal		Browse
https://www.supremecourt.uk/current-cases.html	0%	Virustotal		Browse
https://www.google.com/ads/ga-audiences	0%	Virustotal		Browse
http://www.supremecourt.uk/	0%	Virustotal		Browse
https://td.doubleclick.net	0%	Virustotal		Browse
http://supremecourtevents.co.uk/	0%	Virustotal		Browse
https://www.supremecourt.uk/accessibility.html	0%	Virustotal		Browse
https://www.actionfraud.police.uk/	0%	Virustotal		Browse
https://adservice.google.com/pagead/regclk?	0%	Virustotal		Browse

IP	Domain	Country	ASN	ASN Name	Malicious
13.32.118.166	d20vwa69zln1wj.cloudfront.net	United States	16509	AMAZON-02US	false
35.168.142.78	stats.addsearch.com	United States	14618	AMAZON-AESUS	false
99.80.22.109	addsearch.com	United States	16509	AMAZON-02US	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
104.21.54.161	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.33.187.122	qrco.de	United States	16509	AMAZON-02US	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522644
Start date and time:	2024-09-30 14:18:01 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://qrco.de/bfRPUM?TQt=hHyjn9h
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@26/265@38/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.supremecourt.uk/news/index.html Browse: https://www.supremecourt.uk/education.html Browse: https://www.supremecourt.uk/scams.html Browse: https://www.supremecourt.uk/visiting/index.html Browse: https://www.supremecourt.uk/#primaryContent Browse: https://www.supremecourt.uk/visiting/court-sittings.html Browse: https://www.supremecourt.uk/about/index.html Browse: https://www.jcpc.uk/ Browse: https://www.supremecourt.uk/cases/index.html

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
d20vwa69zln1wj.cloudfront.net	13.32.118.166	true	false	unknown
stats.addsearch.com	35.168.142.78	true	false	unknown
www.google.com	142.250.184.196	true	false	unknown
addsearch.com	99.80.22.109	true	false	unknown
qrco.de	13.33.187.122	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
parkingzw.top	172.67.140.90	true	false	unknown
www.jcpc.uk	unknown	unknown	false	unknown
www.supremecourt.uk	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://addsearch.com/js/?key=bb5ed5a80ec6844383bbc6a01f347e00	false	0%, Virustotal, Browse	unknown
https://www.supremecourt.uk/	false		unknown
https://www.supremecourt.uk/scams.html	false		unknown
https://d20vwa69zln1wj.cloudfront.net/i.gif?v0.6840183720318354	false		unknown
https://www.supremecourt.uk/education.html	false		unknown
https://www.supremecourt.uk/visiting/court-sittings.html	false		unknown
https://stats.addsearch.com/event/bb5ed5a80ec6844383bbc6a01f347e00/54qbi9o3nh/null.gif?a=ping	false		unknown
https://www.jcpc.uk/	false		unknown
https://www.supremecourt.uk/cases/index.html	false		unknown
https://addsearch.com/www/script/v3/loading-gray.gif	false	0%, Virustotal, Browse	unknown
https://addsearch.com/searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i=	false		unknown
https://addsearch.com/www/script/v3/logo-red.svg	false	0%, Virustotal, Browse	unknown
https://addsearch.com/logo/AAAAAA-16.png	false		unknown
https://www.supremecourt.uk/#primaryContent	false		unknown
https://qrco.de/bfRPUM?TQt=hHyjn9h	false		unknown
https://www.supremecourt.uk/news/index.html	false		unknown
https://www.supremecourt.uk/visiting/index.html	false		unknown
https://www.supremecourt.uk/about/index.html	false		unknown
https://d20vwa69zln1wj.cloudfront.net/x.gif	false	0%, Virustotal, Browse	unknown
https://parkingzw.top/	false	0%, Virustotal, Browse	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://addsearch.com/logo/AAAAAA-20.png	chromecache_196.2.dr, chromecache_297.2.dr, chromecache_173.2.dr	false	0%, Virustotal, Browse	unknown
http://www.supremecourt.uk/terms-and-conditions.html	chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	false		unknown
https://stats.g.doubleclick.net/g/collect	chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://cdn.reactandshare.com/plugin/rns.js	chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	false	0%, Virustotal, Browse	unknown
https://www.instagram.com/uksupremecourt	chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
http://www.supremecourt.uk/contact-us.html	chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	false		unknown
http://jqueryui.com	chromecache_213.2.dr, chromecache_155.2.dr, chromecache_308.2.dr	false	URL Reputation: safe	unknown
https://www.supremecourt.uk/news/stories/uk-supreme-court-to-launch-paid-internship-for-aspiring-law	chromecache_164.2.dr	false		unknown
https://www.supremecourt.uk/terms-and-conditions.html	chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
http://www.supremecourt.uk/news/index.html	chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	false		unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_288.2.dr, chromecache_222.2.dr, chromecache_211.2.dr	false	URL Reputation: safe	unknown
https://www.supremecourt.uk/index.html	chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
http://www.supremecourt.uk/sitemap.html	chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	false		unknown
https://www.google.com	chromecache_229.2.dr	false	0%, Virustotal, Browse	unknown
https://www.supremecourt.uk/sitemap.html	chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
https://www.youtube.com/iframe_api	chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	false	0%, Virustotal, Browse	unknown
https://www.supremecourt.uk/rss-feeds.html	chromecache_281.2.dr, chromecache_181.2.dr	false	0%, Virustotal, Browse	unknown
http://www.nationaljusticemuseum.org.uk/education/	chromecache_164.2.dr	false	0%, Virustotal, Browse	unknown
http://www.supremecourt.uk/privacy-notice.html	chromecache_200.2.dr, chromecache_293.2.dr	false	0%, Virustotal, Browse	unknown
http://www.supremecourt.uk/accessibility.html	chromecache_197.2.dr, chromecache_305.2.dr	false		unknown
http://www.supremecourt.uk/decided-cases/index.html	chromecache_166.2.dr, chromecache_164.2.dr, chromecache_305.2.dr	false	0%, Virustotal, Browse	unknown
http://www.supremecourt.uk/about/judicial-conduct-and-complaints.html	chromecache_166.2.dr, chromecache_164.2.dr, chromecache_305.2.dr	false		unknown
https://stats.g.doubleclick.net/j/collect	chromecache_211.2.dr	false	URL Reputation: safe	unknown
https://www.supremecourt.uk/about/judicial-conduct-and-complaints.html	chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
http://www.jcpc.uk	chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	false	0%, Virustotal, Browse	unknown
http://www.supremecourt.uk/index.html	chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	false		unknown
http://www.supremecourt.uk/labels.rdf	chromecache_188.2.dr, chromecache_166.2.dr, chromecache_281.2.dr, chromecache_172.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_181.2.dr, chromecache_305.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
http://www.youtube.com/uksupremecourt	chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
http://www.supremecourt.uk/decided-cases.shtml	chromecache_188.2.dr, chromecache_197.2.dr	false		unknown
https://addsearch.com/searchui/	chromecache_196.2.dr, chromecache_297.2.dr, chromecache_173.2.dr	false	0%, Virustotal, Browse	unknown
https://www.jcpc.uk/visiting/court-sittings.html	chromecache_188.2.dr	false		unknown
http://www.supremecourt.uk/results.html	chromecache_188.2.dr, chromecache_166.2.dr, chromecache_164.2.dr, chromecache_197.2.dr, chromecache_305.2.dr	false		unknown
https://www.jcpc.uk/rss-feeds.html	chromecache_220.2.dr	false		unknown
https://addsearch.com/logo/AAAAAA-16.png);	chromecache_249.2.dr, chromecache_158.2.dr	false		unknown
http://www.bohemiancoding.com/sketch	chromecache_223.2.dr, chromecache_284.2.dr	false	URL Reputation: safe	unknown
https://www.supremecourt.uk/current-cases.html	chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
https://www.supremecourt.uk/contact-us.html	chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
https://tagassistant.google.com/	chromecache_288.2.dr, chromecache_222.2.dr, chromecache_211.2.dr	false	URL Reputation: safe	unknown
http://twitter.com/uksupremecourt	chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
https://www.supremecourt.uk/results.html	chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
http://www.supremecourt.uk/	chromecache_188.2.dr, chromecache_197.2.dr	false	0%, Virustotal, Browse	unknown
https://cct.google/taggy/agent.js	chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/ads/ga-audiences	chromecache_288.2.dr, chromecache_222.2.dr, chromecache_211.2.dr	false	0%, Virustotal, Browse	unknown
https://www.google.%/ads/ga-audiences	chromecache_288.2.dr, chromecache_222.2.dr, chromecache_211.2.dr	false		unknown
https://td.doubleclick.net	chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	false	0%, Virustotal, Browse	unknown
http://supremecourtevents.co.uk/	chromecache_197.2.dr	false	0%, Virustotal, Browse	unknown
https://www.merchant-center-analytics.goog	chromecache_219.2.dr, chromecache_174.2.dr, chromecache_160.2.dr, chromecache_229.2.dr	false	URL Reputation: safe	unknown
http://www.supremecourt.uk/current-cases.html	chromecache_166.2.dr, chromecache_164.2.dr, chromecache_305.2.dr	false		unknown
https://www.supremecourt.uk/accessibility.html	chromecache_281.2.dr, chromecache_181.2.dr, chromecache_220.2.dr	false	0%, Virustotal, Browse	unknown
https://www.actionfraud.police.uk/	chromecache_166.2.dr	false	0%, Virustotal, Browse	unknown
https://adservice.google.com/pagead/regclk?	chromecache_229.2.dr	false	0%, Virustotal, Browse	unknown

Input	Output
URL: https://www.supremecourt.uk/scams.html Model: jbxai	""
	""
URL: https://www.supremecourt.uk/education.html Model: jbxai	""
	""
URL: https://www.supremecourt.uk/news/index.html Model: jbxai	""
	""
URL: https://www.supremecourt.uk/ Model: jbxai	""
	""
URL: https://www.supremecourt.uk/visiting/index.html Model: jbxai	""
	""
URL: https://www.supremecourt.uk/#primaryContent Model: jbxai

URL: https://www.supremecourt.uk/#primaryContent Model: jbxai

URL: https://www.supremecourt.uk/visiting/court-sittings.html Model: jbxai

URL: https://www.supremecourt.uk/visiting/court-sittings.html Model: jbxai

URL: https://www.jcpc.uk/ Model: jbxai

URL: https://www.jcpc.uk/ Model: jbxai

URL: https://www.supremecourt.uk/cases/index.html Model: jbxai

URL: https://www.supremecourt.uk/cases/index.html Model: jbxai

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 30 11:18:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.977708242878945
Encrypted:	false
SSDEEP:	48:8adTTbHjTHLidAKZdA19ehwiZUklqehvy+3:8OTZYy
MD5:	4B5B79068AC1A38C64DBCB0BF730AEA8
SHA1:	34CF9B8261209BEAC588CA4C57E396F6127ED83C
SHA-256:	6A6159AB03CB2DC5DDD6D78502F6578D52877FA6E7C89A1F535E10521025802E
SHA-512:	90E84600AFF00FA1382DA366620725392A5588C2397B9E97C6302EBA23B7681F7987C88D86E67BB9A4650B0014AC8046707E4211B965EE55ABB480AEA03ED68A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....V-..2...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I>Y[b....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>Y[b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V>Y[b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V>Y[b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V>Y]b...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 14:18:57.294504881 CEST	53	56728	1.1.1.1	192.168.2.5
Sep 30, 2024 14:18:57.295723915 CEST	53	57102	1.1.1.1	192.168.2.5
Sep 30, 2024 14:18:58.270240068 CEST	53	52554	1.1.1.1	192.168.2.5
Sep 30, 2024 14:18:58.496412039 CEST	62260	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:18:58.496820927 CEST	56693	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:18:58.505198002 CEST	53	56693	1.1.1.1	192.168.2.5
Sep 30, 2024 14:18:58.514765024 CEST	53	62260	1.1.1.1	192.168.2.5
Sep 30, 2024 14:18:59.993849993 CEST	65328	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:18:59.994676113 CEST	65382	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:00.175719023 CEST	53	65382	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:00.235644102 CEST	54134	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:00.235873938 CEST	56501	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:00.421350956 CEST	53	65328	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:00.663201094 CEST	53	54134	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:00.674129009 CEST	53	56501	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:00.696031094 CEST	51277	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:00.696311951 CEST	51976	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:00.703159094 CEST	53	51277	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:00.703309059 CEST	53	51976	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:02.320723057 CEST	59863	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:02.321772099 CEST	64760	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:02.369883060 CEST	53	64760	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:03.532685041 CEST	53	60826	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:05.345077038 CEST	50541	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:05.345633030 CEST	54343	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:05.382813931 CEST	53	54343	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:06.131130934 CEST	55628	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:06.131772995 CEST	64706	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:06.143034935 CEST	53	53788	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:06.149744987 CEST	53	55628	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:06.150331974 CEST	53	64706	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:07.644254923 CEST	58972	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:07.648397923 CEST	53	49370	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:07.650767088 CEST	53389	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:07.659040928 CEST	53	53389	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:07.662008047 CEST	53	58972	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:07.716272116 CEST	53	53261	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:08.712322950 CEST	53	58303	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:10.452327013 CEST	53	60026	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:15.374815941 CEST	53	58960	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:35.680372000 CEST	53	57579	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:56.095804930 CEST	59476	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:56.096193075 CEST	60315	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:56.134491920 CEST	53	60315	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:56.774739981 CEST	53	59466	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:57.437130928 CEST	53	55989	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:58.828804970 CEST	56068	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:58.829405069 CEST	59042	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:58.872479916 CEST	53	59042	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:59.694508076 CEST	53	59477	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:59.767748117 CEST	57925	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:59.767749071 CEST	64808	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:19:59.775298119 CEST	53	57925	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:59.777776003 CEST	53	64808	1.1.1.1	192.168.2.5
Sep 30, 2024 14:19:59.780889988 CEST	53	59431	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:01.322113037 CEST	53	62496	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:01.325078964 CEST	53	50743	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:07.071578979 CEST	53115	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:07.071994066 CEST	62756	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:07.074326992 CEST	53894	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:07.074515104 CEST	63823	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:07.081983089 CEST	53	56065	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:07.082079887 CEST	53	63823	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:07.082854033 CEST	53	53894	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:07.102792978 CEST	53	62756	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:08.308964968 CEST	53	49349	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:08.454252958 CEST	64453	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:08.454783916 CEST	53870	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:08.462982893 CEST	53	53870	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:08.463048935 CEST	53	64453	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:08.607852936 CEST	61014	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:08.607992887 CEST	55364	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:08.647095919 CEST	53	55364	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:10.076813936 CEST	53	58750	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:11.593290091 CEST	61851	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:11.593291044 CEST	63452	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:11.594705105 CEST	55386	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:11.594911098 CEST	62113	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:11.718274117 CEST	53	62113	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:11.718368053 CEST	53	63452	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:11.720561028 CEST	53	55386	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:11.776124001 CEST	53	61851	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:12.420413017 CEST	59828	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:12.420686007 CEST	58854	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:12.440448999 CEST	53	58854	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:12.440454960 CEST	53	59828	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:12.783849955 CEST	51433	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:12.783984900 CEST	57353	53	192.168.2.5	1.1.1.1
Sep 30, 2024 14:20:12.791631937 CEST	53	57353	1.1.1.1	192.168.2.5
Sep 30, 2024 14:20:12.807231903 CEST	53	51433	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:18:59 UTC	668	OUT	GET /bfRPUM?TQt=hHyjn9h HTTP/1.1 Host: qrco.de Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 12:18:59 UTC	513	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Mon, 30 Sep 2024 12:18:59 GMT Server: nginx Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Location: http://parkingzw.top/ X-Cache: Miss from cloudfront Via: 1.1 f8e909d80b83cb9eeaf200975944eb56.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P9 X-Amz-Cf-Id: _rb5eI7UtZDyCnliLqD3iJvbFu81eNi93HmjpPJJb_gqOlsQUzfDIA==
2024-09-30 12:18:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:01 UTC	656	OUT	GET / HTTP/1.1 Host: parkingzw.top Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 12:19:02 UTC	665	IN	HTTP/1.1 302 Found Date: Mon, 30 Sep 2024 12:19:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close location: https://www.supremecourt.uk vary: Accept-Encoding x-cache: MISS CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dTXq2qPI12bKU9pnHc%2BdzAnwQLu1NQbEQIMcu7lX%2BYP08K715dclkmfSevyPkx0AqcJgLCJi4NU2dyhcuVW6sEbTglaz%2B7OwFKT8iBnLLzdV%2F0s%2B0qszJucJLzEodKva"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb428affed07c84-EWR
2024-09-30 12:19:02 UTC	56	IN	Data Raw: 33 32 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 75 70 72 65 6d 65 63 6f 75 72 74 2e 75 6b 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 32<a href="https://www.supremecourt.uk">Found</a>.
2024-09-30 12:19:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:02 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-30 12:19:03 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF17) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=16022 Date: Mon, 30 Sep 2024 12:19:02 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:03 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-30 12:19:04 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=26008 Date: Mon, 30 Sep 2024 12:19:03 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-30 12:19:04 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://qrco.de/bfRPUM?TQt=hHyjn9h

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Windows Analysis Report
https://qrco.de/bfRPUM?TQt=hHyjn9h

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:06 UTC	556	OUT	GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1 Host: addsearch.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.supremecourt.uk/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 12:19:07 UTC	219	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 12:19:07 GMT Content-Type: application/javascript;charset=UTF-8 Content-Length: 1394 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: *
2024-09-30 12:19:07 UTC	1394	IN	Data Raw: 2f 2f 20 47 65 74 20 79 6f 75 72 20 53 65 61 72 63 68 20 66 72 6f 6d 20 41 64 64 53 65 61 72 63 68 2e 63 6f 6d 20 2d 20 43 6f 70 79 72 69 67 68 74 20 41 64 64 53 65 61 72 63 68 20 4c 74 64 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 76 61 72 20 61 64 64 73 65 61 72 63 68 5f 63 75 73 74 64 61 74 61 20 3d 20 7b 22 61 63 74 69 76 65 22 3a 22 31 22 2c 22 6b 65 79 22 3a 22 62 62 35 65 64 35 61 38 30 65 63 36 38 34 34 33 38 33 62 62 63 36 61 30 31 66 33 34 37 65 30 30 22 2c 22 73 63 72 69 70 74 5f 76 65 72 73 69 6f 6e 22 3a 22 76 33 22 2c 22 63 75 73 74 6f 6d 5f 63 73 73 5f 76 65 72 73 69 6f 6e 22 3a 22 30 22 2c 22 66 69 65 6c 64 5f 63 73 73 22 3a 22 22 2c 22 63 61 63 68 65 5f 70 75 72 67 65 22 3a 22 31 33 38 32 22 2c 22 73 65 61 72 63 Data Ascii: // Get your Search from AddSearch.com - Copyright AddSearch Ltd. All rights reserved.var addsearch_custdata = {"active":"1","key":"bb5ed5a80ec6844383bbc6a01f347e00","script_version":"v3","custom_css_version":"0","field_css":"","cache_purge":"1382","searc

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:07 UTC	594	OUT	GET /logo/AAAAAA-16.png HTTP/1.1 Host: addsearch.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.supremecourt.uk/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 12:19:07 UTC	276	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 12:19:07 GMT Content-Type: image/png Content-Length: 558 Connection: close Cache-Control: max-age=315360000 Expires: Thu, 31 Dec 2037 23:55:55 GMT Strict-Transport-Security: max-age=63072000; includeSubdomains;
2024-09-30 12:19:07 UTC	558	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 04 00 00 00 b5 fa 37 ea 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 02 62 4b 47 44 00 aa 9c 8e 69 c4 00 00 00 09 70 48 59 73 00 00 00 48 00 00 00 48 00 46 c9 6b 3e 00 00 00 07 74 49 4d 45 07 e1 0a 08 06 2c 11 c9 c4 65 27 00 00 00 fc 49 44 41 54 28 cf 85 d1 bf 2b c4 71 1c c7 f1 c7 7d 49 74 25 06 06 36 83 4c 2c a7 30 38 8b 0c ca 8f c1 e7 1f b0 9c c5 c6 80 22 25 a3 98 58 6d 3e 0b c9 c2 26 94 c8 60 51 b7 a9 13 ca a0 18 2c 74 06 37 5c 1c de e3 bb e7 fb f5 ee f5 7a f1 cf a4 7e ae 62 ad 8c b4 9b 50 a8 00 44 a6 2d 69 44 d1 81 5c b8 4f be 9d 2f 5a Data Ascii: PNGIHDR7gAMAa cHRMz&u0`:pQ<bKGDipHYsHHFk>tIME,e'IDAT(+q}It%6L,08"%Xm>&`Q,t7\z~bPD-iD\O/Z

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:08 UTC	377	OUT	GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1 Host: addsearch.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 12:19:08 UTC	219	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 12:19:08 GMT Content-Type: application/javascript;charset=UTF-8 Content-Length: 1394 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: *
2024-09-30 12:19:08 UTC	1394	IN	Data Raw: 2f 2f 20 47 65 74 20 79 6f 75 72 20 53 65 61 72 63 68 20 66 72 6f 6d 20 41 64 64 53 65 61 72 63 68 2e 63 6f 6d 20 2d 20 43 6f 70 79 72 69 67 68 74 20 41 64 64 53 65 61 72 63 68 20 4c 74 64 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 76 61 72 20 61 64 64 73 65 61 72 63 68 5f 63 75 73 74 64 61 74 61 20 3d 20 7b 22 61 63 74 69 76 65 22 3a 22 31 22 2c 22 6b 65 79 22 3a 22 62 62 35 65 64 35 61 38 30 65 63 36 38 34 34 33 38 33 62 62 63 36 61 30 31 66 33 34 37 65 30 30 22 2c 22 73 63 72 69 70 74 5f 76 65 72 73 69 6f 6e 22 3a 22 76 33 22 2c 22 63 75 73 74 6f 6d 5f 63 73 73 5f 76 65 72 73 69 6f 6e 22 3a 22 30 22 2c 22 66 69 65 6c 64 5f 63 73 73 22 3a 22 22 2c 22 63 61 63 68 65 5f 70 75 72 67 65 22 3a 22 31 33 38 32 22 2c 22 73 65 61 72 63 Data Ascii: // Get your Search from AddSearch.com - Copyright AddSearch Ltd. All rights reserved.var addsearch_custdata = {"active":"1","key":"bb5ed5a80ec6844383bbc6a01f347e00","script_version":"v3","custom_css_version":"0","field_css":"","cache_purge":"1382","searc

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:09 UTC	568	OUT	GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1 Host: addsearch.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.supremecourt.uk/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 12:19:09 UTC	225	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 12:19:09 GMT Content-Type: application/javascript;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: *
2024-09-30 12:19:09 UTC	16159	IN	Data Raw: 31 66 37 64 0d 0a 76 61 72 20 61 64 64 73 65 61 72 63 68 5f 73 75 69 64 20 3d 20 27 44 34 71 62 69 38 65 31 63 48 27 3b 2f 2f 20 74 72 61 70 70 65 64 20 69 6e 20 6a 61 76 61 73 63 72 69 70 74 20 66 61 63 74 6f 72 79 2c 20 73 65 6e 64 20 68 65 6c 70 20 2d 20 6a 6f 62 73 40 61 64 64 73 65 61 72 63 68 2e 63 6f 6d 0a 76 61 72 20 61 64 64 73 65 61 72 63 68 5f 73 65 61 72 63 68 73 65 74 74 69 6e 67 73 20 3d 20 7b 22 61 74 74 72 69 62 75 74 65 73 22 3a 7b 22 61 6e 61 6c 79 74 69 63 73 5f 65 6e 61 62 6c 65 64 22 3a 22 74 72 75 65 22 7d 2c 22 74 69 74 6c 65 5f 70 72 65 66 69 78 5f 66 69 6c 74 65 72 73 22 3a 5b 5d 2c 22 74 69 74 6c 65 5f 73 75 66 66 69 78 5f 66 69 6c 74 65 72 73 22 3a 5b 5d 2c 22 63 61 74 65 67 6f 72 79 5f 61 6c 69 61 73 65 73 22 3a 5b 5d 2c 22 69 Data Ascii: 1f7dvar addsearch_suid = 'D4qbi8e1cH';// trapped in javascript factory, send help - jobs@addsearch.comvar addsearch_searchsettings = {"attributes":{"analytics_enabled":"true"},"title_prefix_filters":[],"title_suffix_filters":[],"category_aliases":[],"i
2024-09-30 12:19:09 UTC	16384	IN	Data Raw: 6e 64 65 78 4f 66 28 6e 29 21 3d 2d 31 29 7b 76 61 72 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 72 2e 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 2c 72 2e 61 73 79 6e 63 3d 21 30 2c 72 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 64 0d 0a 32 30 30 30 0d 0a 73 65 61 72 63 68 2e 63 6f 6d 2f 77 77 77 2f 73 63 72 69 70 74 2f 76 33 2f 69 31 38 6e 2f 22 2b 6e 2b 22 2e 6a 73 22 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 7d 61 64 64 73 65 61 72 63 68 2e 73 74 61 74 73 28 22 70 69 6e 67 22 2c 6e 75 6c 6c 29 2c 61 64 64 73 65 61 72 63 68 2e 66 69 72 73 74 48 6f 76 65 72 44 6f 6e 65 3d 21 30 7d 7d 2c 66 6f 6c 6c 6f 77 46 69 65 6c 64 Data Ascii: ndexOf(n)!=-1){var r=document.createElement("script");r.type="text/javascript",r.async=!0,r.src="https://add2000search.com/www/script/v3/i18n/"+n+".js",document.body.appendChild(r)}addsearch.stats("ping",null),addsearch.firstHoverDone=!0}},followField
2024-09-30 12:19:09 UTC	16384	IN	Data Raw: 70 3d 22 22 3b 61 64 64 73 65 61 72 63 68 2e 67 65 74 53 65 74 74 69 6e 67 41 74 74 72 69 62 75 74 65 28 22 67 61 5f 73 70 65 63 69 61 6c 5f 74 72 61 63 6b 65 72 22 29 21 3d 6e 75 6c 6c 26 26 28 70 3d 61 64 64 73 65 61 72 63 68 2e 67 65 74 53 65 74 74 69 6e 67 41 74 74 72 69 62 75 74 65 28 22 67 61 5f 73 70 65 63 69 61 6c 5f 74 72 61 63 6b 65 72 22 29 2b 22 2e 22 29 3b 0d 0a 31 30 30 30 0d 0a 76 61 72 20 64 3d 61 64 64 73 65 61 72 63 68 2e 67 65 74 47 61 54 72 61 63 6b 69 6e 67 49 64 28 29 2c 76 3d 64 26 26 64 2e 69 6e 63 6c 75 64 65 73 28 22 55 41 2d 22 29 3b 69 66 28 74 79 70 65 6f 66 20 67 74 61 67 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 76 3d 3d 31 29 74 72 79 7b 69 66 28 65 3d 3d 22 70 61 75 73 65 22 29 67 74 61 67 28 22 65 76 65 6e 74 22 2c 22 Data Ascii: p="";addsearch.getSettingAttribute("ga_special_tracker")!=null&&(p=addsearch.getSettingAttribute("ga_special_tracker")+".");1000var d=addsearch.getGaTrackingId(),v=d&&d.includes("UA-");if(typeof gtag!="undefined"&&v==1)try{if(e=="pause")gtag("event","
2024-09-30 12:19:09 UTC	7918	IN	Data Raw: 65 72 74 42 65 66 6f 72 65 28 46 2c 69 29 2c 46 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 2c 73 26 26 28 61 64 64 73 65 61 72 63 68 2e 68 61 73 46 75 7a 7a 79 52 65 73 75 6c 74 73 3d 21 30 29 7d 7d 65 6c 73 65 20 69 66 28 61 64 64 73 65 61 72 63 68 2e 6e 6f 68 69 74 73 54 69 6d 65 72 3d 3d 6e 75 6c 6c 29 7b 76 61 72 20 6c 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 6c 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 22 61 64 64 73 65 61 72 63 68 2d 6e 6f 68 69 74 73 2d 6e 65 77 22 29 3b 76 61 72 20 63 3d 61 64 64 73 65 61 72 63 68 2e 73 65 61 72 63 68 52 65 73 75 6c 74 73 54 65 72 6d 2e 72 65 70 6c 61 63 65 28 22 7e 22 2c 22 22 29 3b 6c 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c Data Ascii: ertBefore(F,i),F.style.display="block",s&&(addsearch.hasFuzzyResults=!0)}}else if(addsearch.nohitsTimer==null){var l=document.createElement("div");l.setAttribute("id","addsearch-nohits-new");var c=addsearch.searchResultsTerm.replace("~","");l.innerHTML="<

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:10 UTC	389	OUT	GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1 Host: addsearch.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 12:19:10 UTC	225	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 12:19:10 GMT Content-Type: application/javascript;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: *
2024-09-30 12:19:10 UTC	16159	IN	Data Raw: 31 66 37 64 0d 0a 76 61 72 20 61 64 64 73 65 61 72 63 68 5f 73 75 69 64 20 3d 20 27 65 34 71 62 69 38 65 79 32 52 27 3b 2f 2f 20 74 72 61 70 70 65 64 20 69 6e 20 6a 61 76 61 73 63 72 69 70 74 20 66 61 63 74 6f 72 79 2c 20 73 65 6e 64 20 68 65 6c 70 20 2d 20 6a 6f 62 73 40 61 64 64 73 65 61 72 63 68 2e 63 6f 6d 0a 76 61 72 20 61 64 64 73 65 61 72 63 68 5f 73 65 61 72 63 68 73 65 74 74 69 6e 67 73 20 3d 20 7b 22 61 74 74 72 69 62 75 74 65 73 22 3a 7b 22 61 6e 61 6c 79 74 69 63 73 5f 65 6e 61 62 6c 65 64 22 3a 22 74 72 75 65 22 7d 2c 22 74 69 74 6c 65 5f 70 72 65 66 69 78 5f 66 69 6c 74 65 72 73 22 3a 5b 5d 2c 22 74 69 74 6c 65 5f 73 75 66 66 69 78 5f 66 69 6c 74 65 72 73 22 3a 5b 5d 2c 22 63 61 74 65 67 6f 72 79 5f 61 6c 69 61 73 65 73 22 3a 5b 5d 2c 22 69 Data Ascii: 1f7dvar addsearch_suid = 'e4qbi8ey2R';// trapped in javascript factory, send help - jobs@addsearch.comvar addsearch_searchsettings = {"attributes":{"analytics_enabled":"true"},"title_prefix_filters":[],"title_suffix_filters":[],"category_aliases":[],"i
2024-09-30 12:19:10 UTC	16384	IN	Data Raw: 6e 64 65 78 4f 66 28 6e 29 21 3d 2d 31 29 7b 76 61 72 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 72 2e 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 2c 72 2e 61 73 79 6e 63 3d 21 30 2c 72 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 64 0d 0a 32 30 30 30 0d 0a 73 65 61 72 63 68 2e 63 6f 6d 2f 77 77 77 2f 73 63 72 69 70 74 2f 76 33 2f 69 31 38 6e 2f 22 2b 6e 2b 22 2e 6a 73 22 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 7d 61 64 64 73 65 61 72 63 68 2e 73 74 61 74 73 28 22 70 69 6e 67 22 2c 6e 75 6c 6c 29 2c 61 64 64 73 65 61 72 63 68 2e 66 69 72 73 74 48 6f 76 65 72 44 6f 6e 65 3d 21 30 7d 7d 2c 66 6f 6c 6c 6f 77 46 69 65 6c 64 Data Ascii: ndexOf(n)!=-1){var r=document.createElement("script");r.type="text/javascript",r.async=!0,r.src="https://add2000search.com/www/script/v3/i18n/"+n+".js",document.body.appendChild(r)}addsearch.stats("ping",null),addsearch.firstHoverDone=!0}},followField
2024-09-30 12:19:11 UTC	16384	IN	Data Raw: 70 3d 22 22 3b 61 64 64 73 65 61 72 63 68 2e 67 65 74 53 65 74 74 69 6e 67 41 74 74 72 69 62 75 74 65 28 22 67 61 5f 73 70 65 63 69 61 6c 5f 74 72 61 63 6b 65 72 22 29 21 3d 6e 75 6c 6c 26 26 28 70 3d 61 64 64 73 65 61 72 63 68 2e 67 65 74 53 65 74 74 69 6e 67 41 74 74 72 69 62 75 74 65 28 22 67 61 5f 73 70 65 63 69 61 6c 5f 74 72 61 63 6b 65 72 22 29 2b 22 2e 22 29 3b 0d 0a 31 30 30 30 0d 0a 76 61 72 20 64 3d 61 64 64 73 65 61 72 63 68 2e 67 65 74 47 61 54 72 61 63 6b 69 6e 67 49 64 28 29 2c 76 3d 64 26 26 64 2e 69 6e 63 6c 75 64 65 73 28 22 55 41 2d 22 29 3b 69 66 28 74 79 70 65 6f 66 20 67 74 61 67 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 76 3d 3d 31 29 74 72 79 7b 69 66 28 65 3d 3d 22 70 61 75 73 65 22 29 67 74 61 67 28 22 65 76 65 6e 74 22 2c 22 Data Ascii: p="";addsearch.getSettingAttribute("ga_special_tracker")!=null&&(p=addsearch.getSettingAttribute("ga_special_tracker")+".");1000var d=addsearch.getGaTrackingId(),v=d&&d.includes("UA-");if(typeof gtag!="undefined"&&v==1)try{if(e=="pause")gtag("event","
2024-09-30 12:19:11 UTC	7918	IN	Data Raw: 65 72 74 42 65 66 6f 72 65 28 46 2c 69 29 2c 46 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 2c 73 26 26 28 61 64 64 73 65 61 72 63 68 2e 68 61 73 46 75 7a 7a 79 52 65 73 75 6c 74 73 3d 21 30 29 7d 7d 65 6c 73 65 20 69 66 28 61 64 64 73 65 61 72 63 68 2e 6e 6f 68 69 74 73 54 69 6d 65 72 3d 3d 6e 75 6c 6c 29 7b 76 61 72 20 6c 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 6c 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 22 61 64 64 73 65 61 72 63 68 2d 6e 6f 68 69 74 73 2d 6e 65 77 22 29 3b 76 61 72 20 63 3d 61 64 64 73 65 61 72 63 68 2e 73 65 61 72 63 68 52 65 73 75 6c 74 73 54 65 72 6d 2e 72 65 70 6c 61 63 65 28 22 7e 22 2c 22 22 29 3b 6c 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c Data Ascii: ertBefore(F,i),F.style.display="block",s&&(addsearch.hasFuzzyResults=!0)}}else if(addsearch.nohitsTimer==null){var l=document.createElement("div");l.setAttribute("id","addsearch-nohits-new");var c=addsearch.searchResultsTerm.replace("~","");l.innerHTML="<

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:13 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1727698719867&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-09-30 12:19:13 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-09-30 12:19:13 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-09-30 12:19:13 UTC	476	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A9847FFED9864D6C8C597CAA8D461C44 Ref B: LAXEDGE2015 Ref C: 2024-09-30T12:19:13Z Date: Mon, 30 Sep 2024 12:19:13 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.5fed0117.1727698753.29e274ac

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:19 UTC	556	OUT	GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1 Host: addsearch.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.supremecourt.uk/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 12:19:20 UTC	219	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 12:19:20 GMT Content-Type: application/javascript;charset=UTF-8 Content-Length: 1394 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: *
2024-09-30 12:19:20 UTC	1394	IN	Data Raw: 2f 2f 20 47 65 74 20 79 6f 75 72 20 53 65 61 72 63 68 20 66 72 6f 6d 20 41 64 64 53 65 61 72 63 68 2e 63 6f 6d 20 2d 20 43 6f 70 79 72 69 67 68 74 20 41 64 64 53 65 61 72 63 68 20 4c 74 64 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 76 61 72 20 61 64 64 73 65 61 72 63 68 5f 63 75 73 74 64 61 74 61 20 3d 20 7b 22 61 63 74 69 76 65 22 3a 22 31 22 2c 22 6b 65 79 22 3a 22 62 62 35 65 64 35 61 38 30 65 63 36 38 34 34 33 38 33 62 62 63 36 61 30 31 66 33 34 37 65 30 30 22 2c 22 73 63 72 69 70 74 5f 76 65 72 73 69 6f 6e 22 3a 22 76 33 22 2c 22 63 75 73 74 6f 6d 5f 63 73 73 5f 76 65 72 73 69 6f 6e 22 3a 22 30 22 2c 22 66 69 65 6c 64 5f 63 73 73 22 3a 22 22 2c 22 63 61 63 68 65 5f 70 75 72 67 65 22 3a 22 31 33 38 32 22 2c 22 73 65 61 72 63 Data Ascii: // Get your Search from AddSearch.com - Copyright AddSearch Ltd. All rights reserved.var addsearch_custdata = {"active":"1","key":"bb5ed5a80ec6844383bbc6a01f347e00","script_version":"v3","custom_css_version":"0","field_css":"","cache_purge":"1382","searc

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:21 UTC	377	OUT	GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1 Host: addsearch.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 12:19:21 UTC	219	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 12:19:21 GMT Content-Type: application/javascript;charset=UTF-8 Content-Length: 1394 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: *
2024-09-30 12:19:21 UTC	1394	IN	Data Raw: 2f 2f 20 47 65 74 20 79 6f 75 72 20 53 65 61 72 63 68 20 66 72 6f 6d 20 41 64 64 53 65 61 72 63 68 2e 63 6f 6d 20 2d 20 43 6f 70 79 72 69 67 68 74 20 41 64 64 53 65 61 72 63 68 20 4c 74 64 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 76 61 72 20 61 64 64 73 65 61 72 63 68 5f 63 75 73 74 64 61 74 61 20 3d 20 7b 22 61 63 74 69 76 65 22 3a 22 31 22 2c 22 6b 65 79 22 3a 22 62 62 35 65 64 35 61 38 30 65 63 36 38 34 34 33 38 33 62 62 63 36 61 30 31 66 33 34 37 65 30 30 22 2c 22 73 63 72 69 70 74 5f 76 65 72 73 69 6f 6e 22 3a 22 76 33 22 2c 22 63 75 73 74 6f 6d 5f 63 73 73 5f 76 65 72 73 69 6f 6e 22 3a 22 30 22 2c 22 66 69 65 6c 64 5f 63 73 73 22 3a 22 22 2c 22 63 61 63 68 65 5f 70 75 72 67 65 22 3a 22 31 33 38 32 22 2c 22 73 65 61 72 63 Data Ascii: // Get your Search from AddSearch.com - Copyright AddSearch Ltd. All rights reserved.var addsearch_custdata = {"active":"1","key":"bb5ed5a80ec6844383bbc6a01f347e00","script_version":"v3","custom_css_version":"0","field_css":"","cache_purge":"1382","searc

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:22 UTC	389	OUT	GET /searchui/v3/?key=bb5ed5a80ec6844383bbc6a01f347e00&i= HTTP/1.1 Host: addsearch.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 12:19:22 UTC	225	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 12:19:22 GMT Content-Type: application/javascript;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: *
2024-09-30 12:19:22 UTC	16159	IN	Data Raw: 31 66 37 64 0d 0a 76 61 72 20 61 64 64 73 65 61 72 63 68 5f 73 75 69 64 20 3d 20 27 36 34 71 62 69 38 6f 38 62 30 27 3b 2f 2f 20 74 72 61 70 70 65 64 20 69 6e 20 6a 61 76 61 73 63 72 69 70 74 20 66 61 63 74 6f 72 79 2c 20 73 65 6e 64 20 68 65 6c 70 20 2d 20 6a 6f 62 73 40 61 64 64 73 65 61 72 63 68 2e 63 6f 6d 0a 76 61 72 20 61 64 64 73 65 61 72 63 68 5f 73 65 61 72 63 68 73 65 74 74 69 6e 67 73 20 3d 20 7b 22 61 74 74 72 69 62 75 74 65 73 22 3a 7b 22 61 6e 61 6c 79 74 69 63 73 5f 65 6e 61 62 6c 65 64 22 3a 22 74 72 75 65 22 7d 2c 22 74 69 74 6c 65 5f 70 72 65 66 69 78 5f 66 69 6c 74 65 72 73 22 3a 5b 5d 2c 22 74 69 74 6c 65 5f 73 75 66 66 69 78 5f 66 69 6c 74 65 72 73 22 3a 5b 5d 2c 22 63 61 74 65 67 6f 72 79 5f 61 6c 69 61 73 65 73 22 3a 5b 5d 2c 22 69 Data Ascii: 1f7dvar addsearch_suid = '64qbi8o8b0';// trapped in javascript factory, send help - jobs@addsearch.comvar addsearch_searchsettings = {"attributes":{"analytics_enabled":"true"},"title_prefix_filters":[],"title_suffix_filters":[],"category_aliases":[],"i
2024-09-30 12:19:22 UTC	16384	IN	Data Raw: 6e 64 65 78 4f 66 28 6e 29 21 3d 2d 31 29 7b 76 61 72 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 72 2e 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 2c 72 2e 61 73 79 6e 63 3d 21 30 2c 72 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 64 0d 0a 32 30 30 30 0d 0a 73 65 61 72 63 68 2e 63 6f 6d 2f 77 77 77 2f 73 63 72 69 70 74 2f 76 33 2f 69 31 38 6e 2f 22 2b 6e 2b 22 2e 6a 73 22 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 7d 61 64 64 73 65 61 72 63 68 2e 73 74 61 74 73 28 22 70 69 6e 67 22 2c 6e 75 6c 6c 29 2c 61 64 64 73 65 61 72 63 68 2e 66 69 72 73 74 48 6f 76 65 72 44 6f 6e 65 3d 21 30 7d 7d 2c 66 6f 6c 6c 6f 77 46 69 65 6c 64 Data Ascii: ndexOf(n)!=-1){var r=document.createElement("script");r.type="text/javascript",r.async=!0,r.src="https://add2000search.com/www/script/v3/i18n/"+n+".js",document.body.appendChild(r)}addsearch.stats("ping",null),addsearch.firstHoverDone=!0}},followField
2024-09-30 12:19:23 UTC	16384	IN	Data Raw: 70 3d 22 22 3b 61 64 64 73 65 61 72 63 68 2e 67 65 74 53 65 74 74 69 6e 67 41 74 74 72 69 62 75 74 65 28 22 67 61 5f 73 70 65 63 69 61 6c 5f 74 72 61 63 6b 65 72 22 29 21 3d 6e 75 6c 6c 26 26 28 70 3d 61 64 64 73 65 61 72 63 68 2e 67 65 74 53 65 74 74 69 6e 67 41 74 74 72 69 62 75 74 65 28 22 67 61 5f 73 70 65 63 69 61 6c 5f 74 72 61 63 6b 65 72 22 29 2b 22 2e 22 29 3b 0d 0a 31 30 30 30 0d 0a 76 61 72 20 64 3d 61 64 64 73 65 61 72 63 68 2e 67 65 74 47 61 54 72 61 63 6b 69 6e 67 49 64 28 29 2c 76 3d 64 26 26 64 2e 69 6e 63 6c 75 64 65 73 28 22 55 41 2d 22 29 3b 69 66 28 74 79 70 65 6f 66 20 67 74 61 67 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 76 3d 3d 31 29 74 72 79 7b 69 66 28 65 3d 3d 22 70 61 75 73 65 22 29 67 74 61 67 28 22 65 76 65 6e 74 22 2c 22 Data Ascii: p="";addsearch.getSettingAttribute("ga_special_tracker")!=null&&(p=addsearch.getSettingAttribute("ga_special_tracker")+".");1000var d=addsearch.getGaTrackingId(),v=d&&d.includes("UA-");if(typeof gtag!="undefined"&&v==1)try{if(e=="pause")gtag("event","
2024-09-30 12:19:23 UTC	7918	IN	Data Raw: 65 72 74 42 65 66 6f 72 65 28 46 2c 69 29 2c 46 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 2c 73 26 26 28 61 64 64 73 65 61 72 63 68 2e 68 61 73 46 75 7a 7a 79 52 65 73 75 6c 74 73 3d 21 30 29 7d 7d 65 6c 73 65 20 69 66 28 61 64 64 73 65 61 72 63 68 2e 6e 6f 68 69 74 73 54 69 6d 65 72 3d 3d 6e 75 6c 6c 29 7b 76 61 72 20 6c 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 6c 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 22 61 64 64 73 65 61 72 63 68 2d 6e 6f 68 69 74 73 2d 6e 65 77 22 29 3b 76 61 72 20 63 3d 61 64 64 73 65 61 72 63 68 2e 73 65 61 72 63 68 52 65 73 75 6c 74 73 54 65 72 6d 2e 72 65 70 6c 61 63 65 28 22 7e 22 2c 22 22 29 3b 6c 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c Data Ascii: ertBefore(F,i),F.style.display="block",s&&(addsearch.hasFuzzyResults=!0)}}else if(addsearch.nohitsTimer==null){var l=document.createElement("div");l.setAttribute("id","addsearch-nohits-new");var c=addsearch.searchResultsTerm.replace("~","");l.innerHTML="<

Timestamp	Bytes transferred	Direction	Data
2024-09-30 12:19:24 UTC	556	OUT	GET /js/?key=bb5ed5a80ec6844383bbc6a01f347e00 HTTP/1.1 Host: addsearch.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.supremecourt.uk/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 12:19:25 UTC	219	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 12:19:24 GMT Content-Type: application/javascript;charset=UTF-8 Content-Length: 1394 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: *
2024-09-30 12:19:25 UTC	1394	IN	Data Raw: 2f 2f 20 47 65 74 20 79 6f 75 72 20 53 65 61 72 63 68 20 66 72 6f 6d 20 41 64 64 53 65 61 72 63 68 2e 63 6f 6d 20 2d 20 43 6f 70 79 72 69 67 68 74 20 41 64 64 53 65 61 72 63 68 20 4c 74 64 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 76 61 72 20 61 64 64 73 65 61 72 63 68 5f 63 75 73 74 64 61 74 61 20 3d 20 7b 22 61 63 74 69 76 65 22 3a 22 31 22 2c 22 6b 65 79 22 3a 22 62 62 35 65 64 35 61 38 30 65 63 36 38 34 34 33 38 33 62 62 63 36 61 30 31 66 33 34 37 65 30 30 22 2c 22 73 63 72 69 70 74 5f 76 65 72 73 69 6f 6e 22 3a 22 76 33 22 2c 22 63 75 73 74 6f 6d 5f 63 73 73 5f 76 65 72 73 69 6f 6e 22 3a 22 30 22 2c 22 66 69 65 6c 64 5f 63 73 73 22 3a 22 22 2c 22 63 61 63 68 65 5f 70 75 72 67 65 22 3a 22 31 33 38 32 22 2c 22 73 65 61 72 63 Data Ascii: // Get your Search from AddSearch.com - Copyright AddSearch Ltd. All rights reserved.var addsearch_custdata = {"active":"1","key":"bb5ed5a80ec6844383bbc6a01f347e00","script_version":"v3","custom_css_version":"0","field_css":"","cache_purge":"1382","searc