6e6c575ee591c848f0f7c6c846fa26b6c6ba9d4bb766643a98f7e9157e9d0927

Resubmissions

19/05/2023, 12:57 UTC

230519-p623hagg4v 9

19/05/2023, 12:54 UTC

230519-p5pqsagg3z 1

19/05/2023, 12:53 UTC

230519-p4sfaagg3y 1

18/05/2023, 16:08 UTC

230518-tllx1abh2w 1

18/05/2023, 14:43 UTC

230518-r3s2jabe9t 1

Analysis

max time kernel
1799s
max time network
1718s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2023, 14:43 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

17KB
MD5

5cf52e78e409d3d29219d8f6a3cbd4fe
SHA1

a2a56bf637930273ddaf0e5d4ba68fdac0546490
SHA256

6e6c575ee591c848f0f7c6c846fa26b6c6ba9d4bb766643a98f7e9157e9d0927
SHA512

9508f415eea77e28cbc2e402fd7077c4803945c38723e34113de197e0ac717e3c9548b77b7ed145d923facce500bc02935ae28eaf2f2cd190d687b6d884df08e
SSDEEP

384:r9AWy20DpmRgVoOsK2ElKeGM8U8HhhbplUS7N28B2ZBJCBXQL:rSWp0fVoOsK5I1M2Bhbbb5OJQQL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{279B8F95-F59B-11ED-8227-D22EDD327857} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31033767"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4233341411"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051d6db365ce0f843a8e6cfaf226c4d2b000000000200000000001066000000010000200000001cb51270f48fa718c2f00e49fde86d24962a31d2629d9c3e1a876704bc1d9a8c000000000e80000000020000200000009cad78302e78e5a3059746c74ad93a952842f28b10aa9a4f203cc285ec8dc6b420000000e7408ead377c6e185b4dfc1e7899a580d3d2d2fec221339666e4a0b89ec25dff40000000400443958b448d896c93ed206796f212af9029b0088c916bf594641707774af6077c3abd1409a0edc1e3976b95eef476891db6e14106293e05d0c6f21d15b395	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307ef7f2a789d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31033767"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4233341411"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133289018612758116"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.xr3e4d1a088c1f6d498c84f3c86de73ce49f82a104\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268\Moniker = "cr.sb.xr3e4d1a088c1f6d498c84f3c86de73ce49f82a104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.xr3e4d1a088c1f6d498c84f3c86de73ce49f82a104	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3680	chrome.exe
3680	chrome.exe
1444	chrome.exe
1444	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2500	iexplore.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1452	2500	iexplore.exe	82
PID 2500 wrote to memory of 1452	2500	iexplore.exe	82
PID 2500 wrote to memory of 1452	2500	iexplore.exe	82
PID 3680 wrote to memory of 1796	3680	chrome.exe	93
PID 3680 wrote to memory of 1796	3680	chrome.exe	93
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4136	3680	chrome.exe	94
PID 3680 wrote to memory of 4928	3680	chrome.exe	95
PID 3680 wrote to memory of 4928	3680	chrome.exe	95
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96
PID 3680 wrote to memory of 2576	3680	chrome.exe	96

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd39099758,0x7ffd39099768,0x7ffd39099778
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3320 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4548 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4688 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4840 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4836 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5164 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5340 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3320 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3424 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5540 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5788 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5532 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6124 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=device.mojom.XRDeviceService --lang=en-US --service-sandbox-type=xr_compositing --mojo-platform-channel-handle=5968 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6420 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1812,i,3133500776480226036,11139670245460945689,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4588

Network

DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

assets.msn.com

Remote address:

8.8.8.8:53

Request

assets.msn.com

IN A

Response

assets.msn.com

IN CNAME

assets.msn.com.edgekey.net

assets.msn.com.edgekey.net

IN CNAME

e28578.d.akamaiedge.net

e28578.d.akamaiedge.net

IN A

2.21.35.200

e28578.d.akamaiedge.net

IN A

2.21.35.233
GET

https://assets.msn.com/serviceak/v1/news/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&activityId=292df3a2-dfa7-40eb-aa2a-40b4987b2a0f&ocid=windows-windowsShell-feeds&user=m-cf89462b11a8449c8f6b21e7993ab708&Treatment=T6&MaximumDimensions=660x640&experience=Taskbar&AppVersion=1&osLocale=en-US&caller=bgtask

Remote address:

2.21.35.200:443

Request

GET /serviceak/v1/news/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&activityId=292df3a2-dfa7-40eb-aa2a-40b4987b2a0f&ocid=windows-windowsShell-feeds&user=m-cf89462b11a8449c8f6b21e7993ab708&Treatment=T6&MaximumDimensions=660x640&experience=Taskbar&AppVersion=1&osLocale=en-US&caller=bgtask HTTP/2.0
host: assets.msn.com
x-search-account: None
accept-encoding: gzip, deflate
x-device-machineid: {C9E8DBBA-7F76-41FC-929E-89520C801A1F}
x-userageclass: Unknown
x-bm-market: US
x-bm-dateformat: M/d/yyyy
x-device-ossku: 48
x-bm-dtz: 0
x-deviceid: 0100B2E609000CC3
x-bm-windowsflights: FX:117B9872,FX:119E26AD,FX:11D898D7,FX:11DB147C,FX:11DE505A,FX:11E11E97,FX:11E3E2BA,FX:11E50151,FX:11E9EE98,FX:11F1992A,FX:11F4161E,FX:11F41B68,FX:11FB0F2F,FX:1201B330,FX:1202B7FC,FX:120BB68E,FX:121A20E1,FX:121BF15F,FX:121E5EC8,FX:122D8E86,FX:123031A3,FX:1231B88B,FX:123371B1,FX:1233C945,FX:123D7C31,FX:1240013C,FX:1246E4A3,FX:1248306D,FX:124B38D0,FX:1250080B,FX:125A7FDA,FX:1264FA75,FX:126DBC22,FX:127159BE,FX:12769734,FX:127C935B,FX:127DC03A,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:129135BB
sitename: www.msn.com
x-bm-theme: 000000;0078d7
muid: CF89462B11A8449C8F6B21E7993AB708
x-agent-deviceid: 0100B2E609000CC3
x-bm-onlinesearchdisabled: true
x-bm-cbt: 1684428227
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.2.19041; 10.0.0.0.19041.1288) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
x-device-isoptin: false
accept-language: en-US, en
x-device-touch: false
x-device-clientsession: 39EAC7DBC5F84CC6921FDF39754E0EF7
cookie: MUID=CF89462B11A8449C8F6B21E7993AB708

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
server: Kestrel
access-control-allow-credentials: true
access-control-allow-headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent
access-control-allow-methods: PUT,PATCH,POST,GET,OPTIONS,DELETE
access-control-allow-origin: *.msn.com
access-control-expose-headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent
content-encoding: gzip
ddd-authenticatedwithjwtflow: False
ddd-usertype: AnonymousMuid
ddd-tmpl: tbn:0;lowC:0;SportsMatch_all:1;lowT:0;partialResponse:1;daucoldcap:1;winbadge:1;coldStart:1;coldStartUpsell:1
x-wpo-activityid: 7061E502-59ED-401C-A8D3-1D6CE881EAA1|2023-05-18T14:43:50.5501665Z|fabric:/wpo|FRC|WPO_14
ddd-feednewsitemcount: 0
ddd-activityid: 7061e502-59ed-401c-a8d3-1d6ce881eaa1
ddd-strategyexecutionlatency: 00:00:00.2063315
ddd-debugid: 7061e502-59ed-401c-a8d3-1d6ce881eaa1|2023-05-18T14:43:50.5595436Z|fabric:/winfeed|FRC|WinFeed_409
onewebservicelatency: 207
x-msedge-responseinfo: 207
x-ceto-ref: 646639a6572b4476ba4118da58b404e3|2023-05-18T14:43:50.350Z
expires: Thu, 18 May 2023 14:43:50 GMT
date: Thu, 18 May 2023 14:43:50 GMT
content-length: 1713
akamai-request-bc: [a=2.21.35.196,b=1139566336,c=g,n=FR_IDF_PARIS,o=20940],[a=20.74.25.147,c=o]
server-timing: clientrtt; dur=29, clienttt; dur=, origin; dur=213 , cdntime; dur=-213
akamai-cache-status: Miss from child
akamai-server-ip: 2.21.35.196
akamai-request-id: 43ec6700
x-as-suppresssetcookie: 1
cache-control: private, max-age=0
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
timing-allow-origin: *
vary: Origin
DNS

74.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

74.32.126.40.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

200.35.21.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.35.21.2.in-addr.arpa

IN PTR

Response

200.35.21.2.in-addr.arpa

IN PTR

a2-21-35-200deploystaticakamaitechnologiescom
DNS

200.232.18.117.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.232.18.117.in-addr.arpa

IN PTR

Response
DNS

250.255.255.239.in-addr.arpa

Remote address:

8.8.8.8:53

Request

250.255.255.239.in-addr.arpa

IN PTR

Response
DNS

195.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

195.179.250.142.in-addr.arpa

IN PTR

Response

195.179.250.142.in-addr.arpa

IN PTR

ams15s42-in-f31e100net
DNS

10.36.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

10.36.251.142.in-addr.arpa

IN PTR

Response

10.36.251.142.in-addr.arpa

IN PTR

ams15s44-in-f101e100net
DNS

100.39.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

100.39.251.142.in-addr.arpa

IN PTR

Response

100.39.251.142.in-addr.arpa

IN PTR

ams15s48-in-f41e100net
DNS

apis.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

apis.google.com

IN A

Response

apis.google.com

IN CNAME

plus.l.google.com

plus.l.google.com

IN A

172.217.23.206
GET

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.UjJbvPIecP0.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_flbzE3yQmWQ7n7N3yCQZtJt8-oA/cb=gapi.loaded_0

chrome.exe

Remote address:

172.217.23.206:443

Request

GET /_/scs/abc-static/_/js/k=gapi.gapi.en.UjJbvPIecP0.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_flbzE3yQmWQ7n7N3yCQZtJt8-oA/cb=gapi.loaded_0 HTTP/2.0
host: apis.google.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: 1P_JAR=2023-05-18-14
cookie: NID=511=RtIsF9AEtf77E9GXkVNL09VVFAe8espFsxz1-JDpY3jx9CEBRe2pr6fwLMmZxsk1a-3d2-zpG6vQsKS8JIsPqeCBqoMp2Uje__SA9h9ZCOHScWrikPn-UJzjlzl7-ewyPp-a78OPjFZwYHds_gzIGDoD95whTiVzRopZvO8wqrY
DNS

ogs.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

ogs.google.com

IN A

Response

ogs.google.com

IN CNAME

www3.l.google.com

www3.l.google.com

IN A

142.250.179.206
GET

https://ogs.google.com/widget/callout?prid=19035139&pgid=19035138&puid=5501dadb089d1f63&dc=1&ssc=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=callout&pid=1&spid=243&hl=en

chrome.exe

Remote address:

142.250.179.206:443

Request

GET /widget/callout?prid=19035139&pgid=19035138&puid=5501dadb089d1f63&dc=1&ssc=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=callout&pid=1&spid=243&hl=en HTTP/2.0
host: ogs.google.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: 1P_JAR=2023-05-18-14
cookie: NID=511=RtIsF9AEtf77E9GXkVNL09VVFAe8espFsxz1-JDpY3jx9CEBRe2pr6fwLMmZxsk1a-3d2-zpG6vQsKS8JIsPqeCBqoMp2Uje__SA9h9ZCOHScWrikPn-UJzjlzl7-ewyPp-a78OPjFZwYHds_gzIGDoD95whTiVzRopZvO8wqrY
DNS

ssl.gstatic.com

chrome.exe

Remote address:

8.8.8.8:53

Request

ssl.gstatic.com

IN A

Response

ssl.gstatic.com

IN A

172.217.23.195
GET

https://ssl.gstatic.com/gb/images/sprites/p_1x_ced8ed050bd0.png

chrome.exe

Remote address:

172.217.23.195:443

Request

GET /gb/images/sprites/p_1x_ced8ed050bd0.png HTTP/2.0
host: ssl.gstatic.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://ogs.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

206.23.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.217.172.in-addr.arpa

IN PTR

Response

206.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f2061e100net

206.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f14�J

206.23.217.172.in-addr.arpa

IN PTR

ams16s37-in-f14�J
DNS

206.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.179.250.142.in-addr.arpa

IN PTR

Response

206.179.250.142.in-addr.arpa

IN PTR

ams15s42-in-f141e100net
DNS

195.23.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

195.23.217.172.in-addr.arpa

IN PTR

Response

195.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f31e100net

195.23.217.172.in-addr.arpa

IN PTR

ams16s37-in-f3�H

195.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f195�H
DNS

131.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

131.179.250.142.in-addr.arpa

IN PTR

Response

131.179.250.142.in-addr.arpa

IN PTR

ams17s10-in-f31e100net
DNS

play.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

play.google.com

IN A

Response

play.google.com

IN A

142.251.36.14
POST

https://play.google.com/log?format=json&hasfast=true

chrome.exe

Remote address:

142.251.36.14:443

Request

POST /log?format=json&hasfast=true HTTP/2.0
host: play.google.com
content-length: 2359
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
content-type: application/x-www-form-urlencoded;charset=UTF-8
accept: */*
origin: chrome-untrusted://new-tab-page
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NID=511=RtIsF9AEtf77E9GXkVNL09VVFAe8espFsxz1-JDpY3jx9CEBRe2pr6fwLMmZxsk1a-3d2-zpG6vQsKS8JIsPqeCBqoMp2Uje__SA9h9ZCOHScWrikPn-UJzjlzl7-ewyPp-a78OPjFZwYHds_gzIGDoD95whTiVzRopZvO8wqrY
cookie: 1P_JAR=2023-05-18-14
OPTIONS

https://play.google.com/log?format=json&hasfast=true&authuser=0

chrome.exe

Remote address:

142.251.36.14:443

Request

OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/2.0
host: play.google.com
accept: */*
access-control-request-method: POST
access-control-request-headers: x-goog-authuser
origin: https://ogs.google.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: same-site
sec-fetch-dest: empty
referer: https://ogs.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

clients2.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

clients2.google.com

IN A

Response

clients2.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

142.251.36.46
GET

https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=106.0.5249.119&lang=en-US&acceptformat=crx3&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D1.58.4%26installsource%3Dnotfromwebstore%26installedby%3Dexternal%26uc%26ping%3Dr%253D87%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D1.0.0.6%26installsource%3Dnotfromwebstore%26installedby%3Dother%26uc%26ping%3Dr%253D87%2526e%253D1

chrome.exe

Remote address:

142.251.36.46:443

Request

GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=106.0.5249.119&lang=en-US&acceptformat=crx3&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D1.58.4%26installsource%3Dnotfromwebstore%26installedby%3Dexternal%26uc%26ping%3Dr%253D87%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D1.0.0.6%26installsource%3Dnotfromwebstore%26installedby%3Dother%26uc%26ping%3Dr%253D87%2526e%253D1 HTTP/2.0
host: clients2.google.com
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: 1P_JAR=2023-05-18-14
cookie: NID=511=eT8YiN3fHIw-TDiVaRt6qrtCJk9VusnFcHsV6MOtCifzo4BI0uHXwdOeuBPC_RrWsHSlYl6LhdVUDXM_58Fivln2ZmVlM3afmGVEH7FeWIJB9j3I27oc4vUeY1X5rFBz8AajRDPa-c6PN2nAMM5WrtMTJuQ1ienEF46iBVR8HUg
DNS

14.36.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.36.251.142.in-addr.arpa

IN PTR

Response

14.36.251.142.in-addr.arpa

IN PTR

ams15s44-in-f141e100net
DNS

46.36.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

46.36.251.142.in-addr.arpa

IN PTR

Response

46.36.251.142.in-addr.arpa

IN PTR

ams17s12-in-f141e100net
DNS

krew.io

chrome.exe

Remote address:

8.8.8.8:53

Request

krew.io

IN A

Response

krew.io

IN A

172.67.178.36

krew.io

IN A

104.21.43.106
DNS

krew.io

chrome.exe

Remote address:

8.8.8.8:53

Request

krew.io

IN A

Response

krew.io

IN A

172.67.178.36

krew.io

IN A

104.21.43.106
GET

https://krew.io/

chrome.exe

Remote address:

172.67.178.36:443

Request

GET / HTTP/2.0
host: krew.io
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:36 GMT
content-type: text/html; charset=utf-8
x-powered-by: Express
set-cookie: connect.sid=s%3AQ_ssablXmrkR1LhEi0uuIYHL3F9Bk6L3.mNvVyoYphRURo1GAZfa%2FUzaNAch6CMM2Fqc0Qkp38Eo; Path=/; HttpOnly
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aTq5GvrOUQ8XtWM6ouAX01Ct6VUJaGyMHeg66IJ32aMboZZUzmqDf8JdV8ks7xjQ9ORRm%2FUtMWtDEwPZNC%2FKF1qHrP0b9mjMLv5Oguf4Gb7H5TnMQWGuL0eq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
cf-ray: 7c94e10c0ef31cca-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
DNS

cdnjs.cloudflare.com

chrome.exe

Remote address:

8.8.8.8:53

Request

cdnjs.cloudflare.com

IN A

Response

cdnjs.cloudflare.com

IN A

104.17.25.14

cdnjs.cloudflare.com

IN A

104.17.24.14
DNS

maxcdn.bootstrapcdn.com

chrome.exe

Remote address:

8.8.8.8:53

Request

maxcdn.bootstrapcdn.com

IN A

Response

maxcdn.bootstrapcdn.com

IN A

104.18.11.207

maxcdn.bootstrapcdn.com

IN A

104.18.10.207
GET

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.3/jquery.min.js

chrome.exe

Remote address:

104.17.25.14:443

Request

GET /ajax/libs/jquery/3.6.3/jquery.min.js HTTP/2.0
host: cdnjs.cloudflare.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
origin: https://krew.io
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 6546
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ed4-4ef8"
last-modified: Mon, 04 May 2020 16:12:04 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1457806
expires: Tue, 07 May 2024 14:44:36 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=td5DAmC1jhMxhQ0NdxouC3MT67zrR2pq%2BpcqeKaWb2qkUoK9uAlGcP228VHzKfKVkMxeqPilf4LySrOa1xFUT6qpCWX1Zd6LBkmlusn9g0PY%2BJotNJqMQiGRsqyO%2FTq8LjnkClx8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7c94e10ffc430a5b-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET

https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.13.2/jquery-ui.min.js

chrome.exe

Remote address:

104.17.25.14:443

Request

GET /ajax/libs/jqueryui/1.13.2/jquery-ui.min.js HTTP/2.0
host: cdnjs.cloudflare.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
origin: https://krew.io
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 28112
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "63a24ddb-6dd0"
last-modified: Wed, 21 Dec 2022 00:05:47 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 145189
expires: Tue, 07 May 2024 14:44:36 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HIdsyWr3sYF0J5PZ1xUonDSiV%2FBnnljv%2FfMVEnrN%2BD5dVr2N5yrv%2BsRFpQRWKrlJuOa3YxLITDBjAzHLPS1TlQWdMkS4gdEM2Ncbyi6h1eeCCDediZ%2FjoShd0cx%2BQJWcX9MIhQ%2FZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7c94e10ffc400a5b-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET

https://cdnjs.cloudflare.com/ajax/libs/magnific-popup.js/1.1.0/jquery.magnific-popup.min.js

chrome.exe

Remote address:

104.17.25.14:443

Request

GET /ajax/libs/magnific-popup.js/1.1.0/jquery.magnific-popup.min.js HTTP/2.0
host: cdnjs.cloudflare.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
origin: https://krew.io
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 6759
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ffc-6231"
last-modified: Mon, 04 May 2020 16:17:00 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1456473
expires: Tue, 07 May 2024 14:44:36 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Zgx5f2%2BtR0iBR5s4cfpu%2FJ4%2BZzD67B4kg7o0H91g4ek39J2fA9KysG6iP3B4B7IwnjxoKDyUS%2BxjGQCeGAV%2B7j1nAbB8XNdeNGAq1VqYE9ASnrJxIzjif4JKikI%2BtopYm%2BpX2Gc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7c94e10ffc440a5b-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET

https://cdnjs.cloudflare.com/ajax/libs/tether/1.4.7/js/tether.min.js

chrome.exe

Remote address:

104.17.25.14:443

Request

GET /ajax/libs/tether/1.4.7/js/tether.min.js HTTP/2.0
host: cdnjs.cloudflare.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
origin: https://krew.io
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 56990
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "62e445d5-de9e"
last-modified: Fri, 29 Jul 2022 20:40:53 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 4882813
expires: Tue, 07 May 2024 14:44:36 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JXhmzzLXH7HnNs6F3K7ypBhC%2Fk6kdLY7u0VhB5T%2FZTJAOvvI2oUzpnIAy%2F4ii71NEEGyw5Vo0jNv4ca8x2aOwu%2BX%2B%2F9%2BdCoB1ZjG3mVSzQ476q4RbttVUsT1%2BO82Cto83THFccPY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7c94e10ffc420a5b-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET

https://cdnjs.cloudflare.com/ajax/libs/three.js/r108/three.min.js

chrome.exe

Remote address:

104.17.25.14:443

Request

GET /ajax/libs/three.js/r108/three.min.js HTTP/2.0
host: cdnjs.cloudflare.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
origin: https://krew.io
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 119184
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5efb2bfa-8e6ca"
last-modified: Tue, 30 Jun 2020 12:11:38 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 110379
expires: Tue, 07 May 2024 14:44:36 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DYz8L9bcj1MyunY1NeDrF9CzjnOXNFtmc6p9igSxEePGl%2B%2F6BPDAWQWNUvdVRVlcVD8Ac5ju6JRrhe0J%2F30VPnzBmBB5XnwLf1havzF6K9OwKPOjfhwTabQ67qBrfLKHDf9H0rTV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7c94e10ffc470a5b-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/js/bootstrap.min.js

chrome.exe

Remote address:

104.18.11.207:443

Request

GET /bootstrap/4.0.0-alpha.5/js/bootstrap.min.js HTTP/2.0
host: maxcdn.bootstrapcdn.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
origin: https://krew.io
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:36 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"31bd1c00779daba3350e648fd9bb8d2a"
last-modified: Mon, 25 Jan 2021 22:04:02 GMT
cdn-cachedat: 08/20/2022 02:42:06
cdn-proxyver: 1.02
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 756
cdn-status: 200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-requestid: 433632f1753a94d002b68021b4920563
cdn-cache: HIT
cf-cache-status: HIT
age: 112121
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 7c94e10fff850bcb-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
DNS

api.adinplay.com

chrome.exe

Remote address:

8.8.8.8:53

Request

api.adinplay.com

IN A

Response

api.adinplay.com

IN A

172.66.43.66

api.adinplay.com

IN A

172.66.40.190
GET

https://api.adinplay.com/libs/aiptag/pub/BLS/krew.io/tag.min.js

chrome.exe

Remote address:

172.66.43.66:443

Request

GET /libs/aiptag/pub/BLS/krew.io/tag.min.js HTTP/2.0
host: api.adinplay.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:36 GMT
content-type: application/javascript
access-control-allow-credentials: true
access-control-allow-origin: *
etag: W/"6436755a-82991"
last-modified: Wed, 12 Apr 2023 09:09:46 GMT
x-host: adinplay-1
cache-control: max-age=1800
cf-cache-status: HIT
age: 110166
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AEoeWovvkYPy34r4cgkes3tKwGvSzo4D5GRn8W0KKUWsfaDOSubP06ktfjMjHq%2BrzFBkO%2BWJgtGIiP71Ms0upIdg2doP671PWTi0Ply%2B6xjghthTfuilmDAy%2F%2BK05zd%2F5Pg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7c94e1120a871af8-AMS
content-encoding: br
GET

https://api.adinplay.com/libs/aiptag/assets/adsbygoogle.js

chrome.exe

Remote address:

172.66.43.66:443

Request

GET /libs/aiptag/assets/adsbygoogle.js HTTP/2.0
host: api.adinplay.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:37 GMT
content-type: application/javascript
content-length: 16
access-control-allow-credentials: true
access-control-allow-origin: *
etag: "5ac4f9a5-10"
last-modified: Wed, 04 Apr 2018 16:13:25 GMT
x-host: adinplay-2
cache-control: max-age=1800
cf-cache-status: HIT
age: 697504
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D7TeugCrU3lPBIxdwBLNckiyb8zmYSN0bxwG0BCgOVfC8lfI4C%2BbddVW33MyNvwos5cKjnlPyoObfNv8Lx8eLtrEaETqB7oeH%2BAaX3%2F7QP4t3BZZQxDP2%2BG2eHliy6QwiAY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7c94e1135c5d1af8-AMS
DNS

36.178.67.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.178.67.172.in-addr.arpa

IN PTR

Response
DNS

14.25.17.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.25.17.104.in-addr.arpa

IN PTR

Response
DNS

207.11.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

207.11.18.104.in-addr.arpa

IN PTR

Response
DNS

66.43.66.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

66.43.66.172.in-addr.arpa

IN PTR

Response
DNS

a.nel.cloudflare.com

chrome.exe

Remote address:

8.8.8.8:53

Request

a.nel.cloudflare.com

IN A

Response

a.nel.cloudflare.com

IN A

35.190.80.1
OPTIONS

https://a.nel.cloudflare.com/report/v3?s=uASmhA8rRRKAn%2ByDUc9Ud78Otpr3JEkUulBLQ0KQVoGlW2%2BkzB%2FrHTBG%2ByL4TU2xwTuukedPSqqgw%2BRaNDjMt5YdFgxK5%2FfumUN3zh6lCzDdYdg88Mw2quvf

chrome.exe

Remote address:

35.190.80.1:443

Request

OPTIONS /report/v3?s=uASmhA8rRRKAn%2ByDUc9Ud78Otpr3JEkUulBLQ0KQVoGlW2%2BkzB%2FrHTBG%2ByL4TU2xwTuukedPSqqgw%2BRaNDjMt5YdFgxK5%2FfumUN3zh6lCzDdYdg88Mw2quvf HTTP/2.0
host: a.nel.cloudflare.com
origin: https://krew.io
access-control-request-method: POST
access-control-request-headers: content-type
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

cdn.jsdelivr.net

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.jsdelivr.net

IN A

Response

cdn.jsdelivr.net

IN CNAME

jsdelivr.map.fastly.net

jsdelivr.map.fastly.net

IN A

151.101.1.229

jsdelivr.map.fastly.net

IN A

151.101.65.229

jsdelivr.map.fastly.net

IN A

151.101.129.229

jsdelivr.map.fastly.net

IN A

151.101.193.229
DNS

country.adinplay.workers.dev

chrome.exe

Remote address:

8.8.8.8:53

Request

country.adinplay.workers.dev

IN A

Response

country.adinplay.workers.dev

IN A

104.21.69.205

country.adinplay.workers.dev

IN A

172.67.213.21
DNS

securepubads.g.doubleclick.net

chrome.exe

Remote address:

8.8.8.8:53

Request

securepubads.g.doubleclick.net

IN A

Response

securepubads.g.doubleclick.net

IN CNAME

securepubads46.g.doubleclick.net

securepubads46.g.doubleclick.net

IN A

172.217.23.194
DNS

imasdk.googleapis.com

chrome.exe

Remote address:

8.8.8.8:53

Request

imasdk.googleapis.com

IN A

Response

imasdk.googleapis.com

IN A

142.250.179.170
DNS

apps.identrust.com

chrome.exe

Remote address:

8.8.8.8:53

Request

apps.identrust.com

IN A

Response

apps.identrust.com

IN CNAME

identrust.edgesuite.net

identrust.edgesuite.net

IN CNAME

a1952.dscq.akamai.net

a1952.dscq.akamai.net

IN A

88.221.25.153

a1952.dscq.akamai.net

IN A

88.221.25.169
GET

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20230518

chrome.exe

Remote address:

151.101.1.229:443

Request

GET /gh/prebid/currency-file@1/latest.json?date=20230518 HTTP/2.0
host: cdn.jsdelivr.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
content-type: text/plain
accept: */*
origin: https://krew.io
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json; charset=utf-8
x-jsd-version: 1.0.1699
x-jsd-version-type: version
etag: W/"63b-V8h/lme10kyBaIL5aWQ7pOSf4nk"
content-encoding: br
accept-ranges: bytes
date: Thu, 18 May 2023 14:44:37 GMT
age: 38625
x-served-by: cache-fra-eddf8230103-FRA, cache-ams21067-AMS
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 833
GET

https://imasdk.googleapis.com/js/sdkloader/ima3.js

chrome.exe

Remote address:

142.250.179.170:443

Request

GET /js/sdkloader/ima3.js HTTP/2.0
host: imasdk.googleapis.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://country.adinplay.workers.dev/

chrome.exe

Remote address:

104.21.69.205:443

Request

GET / HTTP/2.0
host: country.adinplay.workers.dev
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://krew.io
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:37 GMT
content-type: text/plain;charset=UTF-8
content-length: 2
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, HEAD, POST, OPTIONS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oFgDyfXkvEb146RgO39B%2Bwz%2BTFrVlKuAfPe7SB5n6SsZh3as7xYhe15zuRomwm8PMyx6Qu9Wo1cp9uSrIoDZN6bsajPq7DOYRPuCsB%2BAwFdHIhcaix2MtkJjjZIqHxhHunQiSuXXrV%2FhfOMWFaKB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7c94e113db73b8fc-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET

http://apps.identrust.com/roots/dstrootcax3.p7c

chrome.exe

Remote address:

88.221.25.153:80

Request

GET /roots/dstrootcax3.p7c HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: apps.identrust.com

Response

HTTP/1.1 200 OK

X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=15768000
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' *.identrust.com
Last-Modified: Wed, 08 Feb 2023 16:52:56 GMT
ETag: "37d-5f433188daa00"
Accept-Ranges: bytes
Content-Length: 893
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Type: application/pkcs7-mime
Cache-Control: max-age=3600
Expires: Thu, 18 May 2023 15:44:37 GMT
Date: Thu, 18 May 2023 14:44:37 GMT
Connection: keep-alive
DNS

fastlane.rubiconproject.com

chrome.exe

Remote address:

8.8.8.8:53

Request

fastlane.rubiconproject.com

IN A

Response

fastlane.rubiconproject.com

IN CNAME

tagged-by.rubiconproject.net.akadns.net

tagged-by.rubiconproject.net.akadns.net

IN A

69.173.144.140

tagged-by.rubiconproject.net.akadns.net

IN A

213.19.162.41

tagged-by.rubiconproject.net.akadns.net

IN A

213.19.162.51

tagged-by.rubiconproject.net.akadns.net

IN A

213.19.162.31

tagged-by.rubiconproject.net.akadns.net

IN A

213.19.162.21
DNS

ib.adnxs.com

chrome.exe

Remote address:

8.8.8.8:53

Request

ib.adnxs.com

IN A

Response

ib.adnxs.com

IN CNAME

g.geogslb.com

g.geogslb.com

IN CNAME

ib.anycast.adnxs.com

ib.anycast.adnxs.com

IN A

37.252.171.53

ib.anycast.adnxs.com

IN A

37.252.171.85

ib.anycast.adnxs.com

IN A

37.252.171.52

ib.anycast.adnxs.com

IN A

37.252.171.149

ib.anycast.adnxs.com

IN A

37.252.172.123

ib.anycast.adnxs.com

IN A

37.252.171.22

ib.anycast.adnxs.com

IN A

37.252.173.215

ib.anycast.adnxs.com

IN A

37.252.171.21

ib.anycast.adnxs.com

IN A

37.252.171.84
GET

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23042&site_id=360062&zone_id=2685800&size_id=15&rp_schain=1.0,1!adinplay.com,BLS,1,,,&rf=https%3A%2F%2Fkrew.io%2F&kw=krew%2Cio%2Cdevclied%2Cshooter%2Cgame%2Cpirate%2C3D%2Cmultiplayer%2Cfree&tg_i.domain=krew.io&tg_i.page=https%3A%2F%2Fkrew.io%2F&tk_flint=pbjs_lite_v7.42.0&x_source.tid=df81e39e-5676-40aa-aefe-d8b17bbbd391&l_pb_bid_id=2344cc09204f2c&p_screen_res=1280x720&rp_secure=1&rp_maxbids=1&slots=1&rand=0.44062737575775346

chrome.exe

Remote address:

69.173.144.140:443

Request

GET /a/api/fastlane.json?account_id=23042&site_id=360062&zone_id=2685800&size_id=15&rp_schain=1.0,1!adinplay.com,BLS,1,,,&rf=https%3A%2F%2Fkrew.io%2F&kw=krew%2Cio%2Cdevclied%2Cshooter%2Cgame%2Cpirate%2C3D%2Cmultiplayer%2Cfree&tg_i.domain=krew.io&tg_i.page=https%3A%2F%2Fkrew.io%2F&tk_flint=pbjs_lite_v7.42.0&x_source.tid=df81e39e-5676-40aa-aefe-d8b17bbbd391&l_pb_bid_id=2344cc09204f2c&p_screen_res=1280x720&rp_secure=1&rp_maxbids=1&slots=1&rand=0.44062737575775346 HTTP/2.0
host: fastlane.rubiconproject.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
content-type: text/plain
accept: */*
origin: https://krew.io
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

server: nginx/1.21.4
date: Thu, 18 May 2023 14:44:37 GMT
content-type: application/json
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://krew.io
pragma: no-cache
vary: Accept-Encoding
set-cookie: khaos=LHT8THKJ-26-J8NV; Domain=.rubiconproject.com; Path=/; Expires=Fri, 17-May-2024 14:44:37 GMT; Max-Age=31536000; SameSite=None; Secure
set-cookie: audit=1|hLZGFuTafB1fbKPXdjiA6jQ/3SF9Y/s10y0okrXHckuVrGlQzrPCdE6iV3zs3EVo7YLrICeHmIyn+l/TnYoiWQ==; Domain=.rubiconproject.com; Path=/; Expires=Fri, 17-May-2024 14:44:37 GMT; Max-Age=31536000; SameSite=None; Secure
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 288
DNS

onetag-sys.com

chrome.exe

Remote address:

8.8.8.8:53

Request

onetag-sys.com

IN A

Response

onetag-sys.com

IN A

51.75.86.98

onetag-sys.com

IN A

51.89.9.251

onetag-sys.com

IN A

51.38.120.206

onetag-sys.com

IN A

51.89.9.252

onetag-sys.com

IN A

51.89.9.253

onetag-sys.com

IN A

51.89.9.254
DNS

server.cpmstar.com

chrome.exe

Remote address:

8.8.8.8:53

Request

server.cpmstar.com

IN A

Response

server.cpmstar.com

IN A

198.24.170.28

server.cpmstar.com

IN A

23.235.251.213

server.cpmstar.com

IN A

23.235.251.211

server.cpmstar.com

IN A

198.24.162.123

server.cpmstar.com

IN A

198.24.170.52

server.cpmstar.com

IN A

198.24.170.51
POST

https://onetag-sys.com/prebid-request

chrome.exe

Remote address:

51.75.86.98:443

Request

POST /prebid-request HTTP/2.0
host: onetag-sys.com
content-length: 1033
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
content-type: text/plain
accept: */*
origin: https://krew.io
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

access-control-allow-origin: https://krew.io
access-control-allow-headers: content-type, origin, referer, user-agent
access-control-allow-credentials: true
cache-control: no-transform, no-cache
content-type: application/json
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=V4XGeTmi8dbYTUfobR0pa1KKfyuAjenx5pofdQh5tt0; path=/; expires=Sat, 17 May 2025 14:44:37; domain=onetag-sys.com; SameSite=None; Secure;
content-encoding: gzip
content-length: 41
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/usync/?cb=1684428276854

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /usync/?cb=1684428276854 HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=V4XGeTmi8dbYTUfobR0pa1KKfyuAjenx5pofdQh5tt0

Response

HTTP/2.0 200

p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=0rb3O42iZWcm1lem8VqJ2WLH6nJRBzi_v7CSfZTzSlc; path=/; expires=Sat, 17 May 2025 14:44:38; domain=onetag-sys.com; SameSite=None; Secure
content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1371
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpbs.cpmstar.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26f%3Db%26uid%3D%24%7BUSER_TOKEN%7D

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /usync/?redir=https%3A%2F%2Fpbs.cpmstar.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26f%3Db%26uid%3D%24%7BUSER_TOKEN%7D HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=V4XGeTmi8dbYTUfobR0pa1KKfyuAjenx5pofdQh5tt0

Response

HTTP/2.0 200

p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:38; domain=onetag-sys.com; SameSite=None; Secure
content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1406
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=106&redir=1&ot_initiated=1 HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/usync/?cb=1684428276854
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 302

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:39; domain=onetag-sys.com; SameSite=None; Secure;
location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiC9R8VF9mK2gTg7lBSz9DxAJcL-u563sfA
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1 HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/usync/?cb=1684428276854
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 302

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:39; domain=onetag-sys.com; SameSite=None; Secure;
location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=106&redir=1&ot_initiated=1 HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpbs.cpmstar.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26f%3Db%26uid%3D%24%7BUSER_TOKEN%7D
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 302

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:39; domain=onetag-sys.com; SameSite=None; Secure;
location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiC9R8cEN4CcZIwfisem93EeIBGVTTxrofQ
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1 HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpbs.cpmstar.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26f%3Db%26uid%3D%24%7BUSER_TOKEN%7D
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 302

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:39; domain=onetag-sys.com; SameSite=None; Secure;
location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=679504853255603868

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=98&gdpr=1&gdpr_consent=&uid=679504853255603868 HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 200

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:40; domain=onetag-sys.com; SameSite=None; Secure;
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=679504853255603868

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=98&gdpr=1&gdpr_consent=&uid=679504853255603868 HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 200

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:17; domain=onetag-sys.com; SameSite=None; Secure;
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=106&google_error=15

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=106&google_error=15 HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 200

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:41; domain=onetag-sys.com; SameSite=None; Secure;
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=1&uid=18d36466-39d8-4a00-bb90-51cdeaaf10d6&gdpr=1&gdpr_consent=

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=1&uid=18d36466-39d8-4a00-bb90-51cdeaaf10d6&gdpr=1&gdpr_consent= HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 200

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:41; domain=onetag-sys.com; SameSite=None; Secure;
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=1&uid=ad796466-39d7-4700-93d4-20108193c500&gdpr=1&gdpr_consent=

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=1&uid=ad796466-39d7-4700-93d4-20108193c500&gdpr=1&gdpr_consent= HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 200

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:41; domain=onetag-sys.com; SameSite=None; Secure;
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=106&google_error=15

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=106&google_error=15 HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 200

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:41; domain=onetag-sys.com; SameSite=None; Secure;
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=110&uid=

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=110&uid= HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 200

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:41; domain=onetag-sys.com; SameSite=None; Secure;
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=29&uid=8d7d1376-dee5-4ebe-a0da-db737228964f&gdpr=0&gdpr_consent=

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=29&uid=8d7d1376-dee5-4ebe-a0da-db737228964f&gdpr=0&gdpr_consent= HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 200

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:41; domain=onetag-sys.com; SameSite=None; Secure;
content-length: 0
strict-transport-security: max-age=15552000
GET

https://onetag-sys.com/match/?int_id=29&uid=8d7d1376-dee5-4ebe-a0da-db737228964f&gdpr=0&gdpr_consent=

chrome.exe

Remote address:

51.75.86.98:443

Request

GET /match/?int_id=29&uid=8d7d1376-dee5-4ebe-a0da-db737228964f&gdpr=0&gdpr_consent= HTTP/2.0
host: onetag-sys.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M

Response

HTTP/2.0 200

cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: OTP=d0dlw_jC_TbFnZJqDCZVBkDVvWm700WvqWxEQvHxK5M; path=/; expires=Sat, 17 May 2025 14:44:41; domain=onetag-sys.com; SameSite=None; Secure;
content-length: 0
strict-transport-security: max-age=15552000
DNS

content-autofill.googleapis.com

chrome.exe

Remote address:

8.8.8.8:53

Request

content-autofill.googleapis.com

IN A

Response

content-autofill.googleapis.com

IN A

142.250.179.170

content-autofill.googleapis.com

IN A

142.250.179.202

content-autofill.googleapis.com

IN A

142.251.36.10

content-autofill.googleapis.com

IN A

142.251.39.106

content-autofill.googleapis.com

IN A

172.217.23.202

content-autofill.googleapis.com

IN A

216.58.208.106

content-autofill.googleapis.com

IN A

216.58.214.10

content-autofill.googleapis.com

IN A

142.250.179.138

content-autofill.googleapis.com

IN A

142.251.36.42
GET

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSFwmmE_ZepmfOvhIFDWZWAVcSBQ2OhiioEiwJu3HDWEgc7OcSBQ2ezAtWEgUNkfJlNxIFDcamXooSBQ1VqVwdEgUNU1pHxRIQCTg0YX8vuB6eEgUNQ7qIlRIQCT_FoZfWlVN_EgUN9UdfVBIQCSuKQ92nMlwhEgUNHNZb1RIeCanUMaACpRfGEgUNnIJuYBIFDeGhK0ASBQ30nz5MEhcJ1ti7xKMF1egSBQ0tyJOpEgUN5VbC_BIQCbkaOm0xg94qEgUNXXiq0hIzCWBW83me1iVxEgUNrzxMiBIFDW55USgSBQ3lx9dnEgUNJmCxIBIFDS0P6fASBQ0P4xJ-?alt=proto

chrome.exe

Remote address:

142.250.179.170:443

Request

GET /v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSFwmmE_ZepmfOvhIFDWZWAVcSBQ2OhiioEiwJu3HDWEgc7OcSBQ2ezAtWEgUNkfJlNxIFDcamXooSBQ1VqVwdEgUNU1pHxRIQCTg0YX8vuB6eEgUNQ7qIlRIQCT_FoZfWlVN_EgUN9UdfVBIQCSuKQ92nMlwhEgUNHNZb1RIeCanUMaACpRfGEgUNnIJuYBIFDeGhK0ASBQ30nz5MEhcJ1ti7xKMF1egSBQ0tyJOpEgUN5VbC_BIQCbkaOm0xg94qEgUNXXiq0hIzCWBW83me1iVxEgUNrzxMiBIFDW55USgSBQ3lx9dnEgUNJmCxIBIFDS0P6fASBQ0P4xJ-?alt=proto HTTP/2.0
host: content-autofill.googleapis.com
x-goog-encode-response-if-executable: base64
x-goog-api-key: AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
x-client-data: CID4ygE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

1.80.190.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.80.190.35.in-addr.arpa

IN PTR

Response

1.80.190.35.in-addr.arpa

IN PTR

18019035bcgoogleusercontentcom
DNS

229.1.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

229.1.101.151.in-addr.arpa

IN PTR

Response
DNS

229.1.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

229.1.101.151.in-addr.arpa

IN PTR

Response
DNS

194.23.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

194.23.217.172.in-addr.arpa

IN PTR

Response

194.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f1941e100net

194.23.217.172.in-addr.arpa

IN PTR

ams16s37-in-f2�J

194.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f2�J
DNS

170.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

170.179.250.142.in-addr.arpa

IN PTR

Response

170.179.250.142.in-addr.arpa

IN PTR

ams15s41-in-f101e100net
DNS

205.69.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

205.69.21.104.in-addr.arpa

IN PTR

Response
DNS

153.25.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

153.25.221.88.in-addr.arpa

IN PTR

Response

153.25.221.88.in-addr.arpa

IN PTR

a88-221-25-153deploystaticakamaitechnologiescom
DNS

153.25.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

153.25.221.88.in-addr.arpa

IN PTR

Response

153.25.221.88.in-addr.arpa

IN PTR

a88-221-25-153deploystaticakamaitechnologiescom
DNS

226.21.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.21.18.104.in-addr.arpa

IN PTR

Response
DNS

140.144.173.69.in-addr.arpa

Remote address:

8.8.8.8:53

Request

140.144.173.69.in-addr.arpa

IN PTR

Response
DNS

53.171.252.37.in-addr.arpa

Remote address:

8.8.8.8:53

Request

53.171.252.37.in-addr.arpa

IN PTR

Response

53.171.252.37.in-addr.arpa

IN PTR

1003bm-nginx-loadbalancermgmtfra1adnexusnet
DNS

98.86.75.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

98.86.75.51.in-addr.arpa

IN PTR

Response

98.86.75.51.in-addr.arpa

IN PTR

ip98ip-51-75-86eu
DNS

28.170.24.198.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.170.24.198.in-addr.arpa

IN PTR

Response
DNS

28.170.24.198.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.170.24.198.in-addr.arpa

IN PTR

Response
DNS

559395a8d5bb271a0e6c0ca3f8eb67fd.safeframe.googlesyndication.com

chrome.exe

Remote address:

8.8.8.8:53

Request

559395a8d5bb271a0e6c0ca3f8eb67fd.safeframe.googlesyndication.com

IN A

Response

559395a8d5bb271a0e6c0ca3f8eb67fd.safeframe.googlesyndication.com

IN CNAME

pagead-googlehosted.l.google.com

pagead-googlehosted.l.google.com

IN A

142.250.179.161
GET

https://559395a8d5bb271a0e6c0ca3f8eb67fd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

chrome.exe

Remote address:

142.250.179.161:443

Request

GET /safeframe/1-0-40/html/container.html HTTP/2.0
host: 559395a8d5bb271a0e6c0ca3f8eb67fd.safeframe.googlesyndication.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

194.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

194.179.250.142.in-addr.arpa

IN PTR

Response

194.179.250.142.in-addr.arpa

IN PTR

ams15s42-in-f21e100net
DNS

161.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

161.179.250.142.in-addr.arpa

IN PTR

Response

161.179.250.142.in-addr.arpa

IN PTR

ams15s41-in-f11e100net
DNS

eus.rubiconproject.com

chrome.exe

Remote address:

8.8.8.8:53

Request

eus.rubiconproject.com

IN A

Response

eus.rubiconproject.com

IN CNAME

eus.rubiconproject.com.edgekey.net

eus.rubiconproject.com.edgekey.net

IN CNAME

e8960.b.akamaiedge.net

e8960.b.akamaiedge.net

IN A

23.52.56.137
DNS

acdn.adnxs.com

chrome.exe

Remote address:

8.8.8.8:53

Request

acdn.adnxs.com

IN A

Response

acdn.adnxs.com

IN CNAME

prod.appnexus.map.fastly.net

prod.appnexus.map.fastly.net

IN A

151.101.1.108

prod.appnexus.map.fastly.net

IN A

151.101.65.108

prod.appnexus.map.fastly.net

IN A

151.101.129.108

prod.appnexus.map.fastly.net

IN A

151.101.193.108
GET

https://eus.rubiconproject.com/usync.html

chrome.exe

Remote address:

23.52.56.137:443

Request

GET /usync.html HTTP/1.1
Host: eus.rubiconproject.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://krew.io/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: khaos=LHT8THKJ-26-J8NV; audit=1|hLZGFuTafB1fbKPXdjiA6jQ/3SF9Y/s10y0okrXHckuVrGlQzrPCdE6iV3zs3EVo7YLrICeHmIyn+l/TnYoiWQ==

Response

HTTP/1.1 200 OK

Server: Apache/2.2.15 (CentOS)
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
ETag: "403b9-119-5ec73a0a33d00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 18 May 2023 14:44:39 GMT
Connection: keep-alive
Vary: Accept-Encoding
GET

https://eus.rubiconproject.com/usync.js

chrome.exe

Remote address:

23.52.56.137:443

Request

GET /usync.js HTTP/1.1
Host: eus.rubiconproject.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: */*
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: script
Referer: https://eus.rubiconproject.com/usync.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: khaos=LHT8THKJ-26-J8NV; audit=1|hLZGFuTafB1fbKPXdjiA6jQ/3SF9Y/s10y0okrXHcksJ5YoJOHcL+cS3IGa2kPNC4HEYI5ehIrU/nsrNWTRLIdzpQ7vzkXQ/

Response

HTTP/1.1 200 OK

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 17 May 2023 21:36:00 GMT
Content-Encoding: gzip
Content-Length: 10084
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=24624
Expires: Thu, 18 May 2023 21:35:05 GMT
Date: Thu, 18 May 2023 14:44:41 GMT
Connection: keep-alive
Vary: Accept-Encoding
DNS

oa.openxcdn.net

chrome.exe

Remote address:

8.8.8.8:53

Request

oa.openxcdn.net

IN A

Response

oa.openxcdn.net

IN A

34.102.146.192
GET

https://oa.openxcdn.net/esp.js

chrome.exe

Remote address:

34.102.146.192:443

Request

GET /esp.js HTTP/2.0
host: oa.openxcdn.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

static.criteo.net

chrome.exe

Remote address:

8.8.8.8:53

Request

static.criteo.net

IN A

Response

static.criteo.net

IN CNAME

static.nl3.vip.prod.criteo.net

static.nl3.vip.prod.criteo.net

IN A

178.250.1.3
DNS

cdn.id5-sync.com

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.id5-sync.com

IN A

Response

cdn.id5-sync.com

IN A

104.22.53.86

cdn.id5-sync.com

IN A

172.67.38.106

cdn.id5-sync.com

IN A

104.22.52.86
DNS

invstatic101.creativecdn.com

chrome.exe

Remote address:

8.8.8.8:53

Request

invstatic101.creativecdn.com

IN A

Response

invstatic101.creativecdn.com

IN A

34.96.70.87
DNS

tags.crwdcntrl.net

chrome.exe

Remote address:

8.8.8.8:53

Request

tags.crwdcntrl.net

IN A

Response

tags.crwdcntrl.net

IN A

52.222.139.7

tags.crwdcntrl.net

IN A

52.222.139.35

tags.crwdcntrl.net

IN A

52.222.139.100

tags.crwdcntrl.net

IN A

52.222.139.112
DNS

cdn.prod.uidapi.com

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.prod.uidapi.com

IN A

Response

cdn.prod.uidapi.com

IN CNAME

d2avimlm6gq3h9.cloudfront.net

d2avimlm6gq3h9.cloudfront.net

IN A

52.222.141.36
DNS

cdn.ampproject.org

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.ampproject.org

IN A

Response

cdn.ampproject.org

IN CNAME

cdn-content.ampproject.org

cdn-content.ampproject.org

IN A

142.250.179.161
GET

https://static.criteo.net/js/ld/publishertag.ids.js

chrome.exe

Remote address:

178.250.1.3:443

Request

GET /js/ld/publishertag.ids.js HTTP/2.0
host: static.criteo.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

server: nginx
date: Thu, 18 May 2023 14:44:39 GMT
content-type: text/javascript
last-modified: Fri, 24 Feb 2023 07:57:33 GMT
etag: W/"63f86ded-9c20"
expires: Fri, 19 May 2023 14:44:39 GMT
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
cache-control: public
timing-allow-origin: *
access-control-allow-origin: *
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
GET

https://cdn.id5-sync.com/api/1.0/esp.js

chrome.exe

Remote address:

104.22.53.86:443

Request

GET /api/1.0/esp.js HTTP/2.0
host: cdn.id5-sync.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:39 GMT
content-type: text/javascript;charset=utf-8
x-amz-id-2: SVTd7px0oa9s2g16ZMEbtjbSm+9mjgny5JAItCXVA/BBc0mwNgZ0tsF0wNTOKJEbYhxhorsH3w8=
x-amz-request-id: NPJKRCKCE05AE40D
last-modified: Thu, 06 Apr 2023 12:00:04 GMT
etag: W/"110f0c3c343ee36404c8a2300f4755c3"
x-amz-server-side-encryption: AES256
cache-control: public, max-age=3600
cf-cache-status: HIT
age: 1805
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
server: cloudflare
cf-ray: 7c94e1231cc10eb2-AMS
content-encoding: gzip
DNS

sync.mathtag.com

chrome.exe

Remote address:

8.8.8.8:53

Request

sync.mathtag.com

IN A

Response

sync.mathtag.com

IN CNAME

pixel-origin.mathtag.com

pixel-origin.mathtag.com

IN A

185.29.132.245

pixel-origin.mathtag.com

IN A

185.29.132.241

pixel-origin.mathtag.com

IN A

185.29.134.248

pixel-origin.mathtag.com

IN A

185.29.134.244
DNS

pixel-eu.rubiconproject.com

chrome.exe

Remote address:

8.8.8.8:53

Request

pixel-eu.rubiconproject.com

IN A

Response

pixel-eu.rubiconproject.com

IN CNAME

pixel-eu.rubiconproject.net.akadns.net

pixel-eu.rubiconproject.net.akadns.net

IN A

213.19.162.90

pixel-eu.rubiconproject.net.akadns.net

IN A

213.19.162.80
DNS

id.rlcdn.com

chrome.exe

Remote address:

8.8.8.8:53

Request

id.rlcdn.com

IN A

Response

id.rlcdn.com

IN A

35.190.60.146
DNS

match.adsrvr.org

chrome.exe

Remote address:

8.8.8.8:53

Request

match.adsrvr.org

IN A

Response

match.adsrvr.org

IN A

52.223.40.198

match.adsrvr.org

IN A

35.71.131.137

match.adsrvr.org

IN A

15.197.193.217

match.adsrvr.org

IN A

3.33.220.150
DNS

match.adsrvr.org

chrome.exe

Remote address:

8.8.8.8:53

Request

match.adsrvr.org

IN A

Response

match.adsrvr.org

IN A

52.223.40.198

match.adsrvr.org

IN A

35.71.131.137

match.adsrvr.org

IN A

15.197.193.217

match.adsrvr.org

IN A

3.33.220.150
DNS

ssbsync-global.smartadserver.com

chrome.exe

Remote address:

8.8.8.8:53

Request

ssbsync-global.smartadserver.com

IN A

Response

ssbsync-global.smartadserver.com

IN CNAME

usersync-geo-global.usersync-prod-sas.akadns.net

usersync-geo-global.usersync-prod-sas.akadns.net

IN CNAME

ssbsync-itx4.smartadserver.com

ssbsync-itx4.smartadserver.com

IN A

185.86.139.94

ssbsync-itx4.smartadserver.com

IN A

185.86.139.102

ssbsync-itx4.smartadserver.com

IN A

185.86.139.93

ssbsync-itx4.smartadserver.com

IN A

185.86.139.104

ssbsync-itx4.smartadserver.com

IN A

185.86.139.101

ssbsync-itx4.smartadserver.com

IN A

185.86.139.103
DNS

ups.analytics.yahoo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

ups.analytics.yahoo.com

IN A

Response

ups.analytics.yahoo.com

IN CNAME

prod.ups-ats.aolp-ds-prd.aws.oath.cloud

prod.ups-ats.aolp-ds-prd.aws.oath.cloud

IN CNAME

prod.ups-ats.eu-central-1.aolp-ds-prd.aws.oath.cloud

prod.ups-ats.eu-central-1.aolp-ds-prd.aws.oath.cloud

IN CNAME

ats-eks.eu-central-1.dcs-online-targeting-prd.aws.oath.cloud

ats-eks.eu-central-1.dcs-online-targeting-prd.aws.oath.cloud

IN A

3.75.62.37

ats-eks.eu-central-1.dcs-online-targeting-prd.aws.oath.cloud

IN A

3.71.149.231
DNS

pixel.rubiconproject.com

chrome.exe

Remote address:

8.8.8.8:53

Request

pixel.rubiconproject.com

IN A

Response

pixel.rubiconproject.com

IN CNAME

pixel.rubiconproject.net.akadns.net

pixel.rubiconproject.net.akadns.net

IN A

213.19.162.80

pixel.rubiconproject.net.akadns.net

IN A

213.19.162.90
DNS

pixel.rubiconproject.com

chrome.exe

Remote address:

8.8.8.8:53

Request

pixel.rubiconproject.com

IN A

Response

pixel.rubiconproject.com

IN CNAME

pixel.rubiconproject.net.akadns.net

pixel.rubiconproject.net.akadns.net

IN A

213.19.162.90

pixel.rubiconproject.net.akadns.net

IN A

213.19.162.80
DNS

image8.pubmatic.com

chrome.exe

Remote address:

8.8.8.8:53

Request

image8.pubmatic.com

IN A

Response

image8.pubmatic.com

IN CNAME

image8-v2.pubmnet.com

image8-v2.pubmnet.com

IN CNAME

imagesync-sin12.pubmnet.com

imagesync-sin12.pubmnet.com

IN A

207.65.33.79
GET

https://cdn.ampproject.org/rtv/012305051745000/amp4ads-v0.mjs

chrome.exe

Remote address:

142.250.179.161:443

Request

GET /rtv/012305051745000/amp4ads-v0.mjs HTTP/2.0
host: cdn.ampproject.org
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://cdn.ampproject.org/rtv/012305051745000/v0/amp-ad-exit-0.1.mjs

chrome.exe

Remote address:

142.250.179.161:443

Request

GET /rtv/012305051745000/v0/amp-ad-exit-0.1.mjs HTTP/2.0
host: cdn.ampproject.org
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://cdn.ampproject.org/rtv/012305051745000/v0/amp-analytics-0.1.mjs

chrome.exe

Remote address:

142.250.179.161:443

Request

GET /rtv/012305051745000/v0/amp-analytics-0.1.mjs HTTP/2.0
host: cdn.ampproject.org
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://cdn.ampproject.org/rtv/012305051745000/v0/amp-fit-text-0.1.mjs

chrome.exe

Remote address:

142.250.179.161:443

Request

GET /rtv/012305051745000/v0/amp-fit-text-0.1.mjs HTTP/2.0
host: cdn.ampproject.org
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://cdn.ampproject.org/rtv/012305051745000/v0/amp-form-0.1.mjs

chrome.exe

Remote address:

142.250.179.161:443

Request

GET /rtv/012305051745000/v0/amp-form-0.1.mjs HTTP/2.0
host: cdn.ampproject.org
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js

chrome.exe

Remote address:

34.96.70.87:443

Request

GET /encrypted-signals/encrypted-tag-g.js HTTP/2.0
host: invstatic101.creativecdn.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://tags.crwdcntrl.net/lt/c/16589/sync.min.js

chrome.exe

Remote address:

52.222.139.7:443

Request

GET /lt/c/16589/sync.min.js HTTP/2.0
host: tags.crwdcntrl.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/javascript
last-modified: Thu, 27 Apr 2023 00:14:05 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
date: Thu, 18 May 2023 05:55:32 GMT
cache-control: public, max-age=86400
etag: W/"37e703da55f96b973658b8e7aeed0e93"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 abc3ecd1d98ae9cd426d47386509de18.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS50-C1
x-amz-cf-id: SRAeKGdWQzOPdc7XCbk7ZKWkUsYPVXF4wF43Dci44re9EUiLUp5qZw==
age: 31748
GET

https://cdn.prod.uidapi.com/uid2SecureSignal.js

chrome.exe

Remote address:

52.222.141.36:443

Request

GET /uid2SecureSignal.js HTTP/1.1
Host: cdn.prod.uidapi.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: */*
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: script
Referer: https://krew.io/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: text/javascript
Content-Length: 1858
Connection: keep-alive
Last-Modified: Thu, 04 May 2023 00:14:06 GMT
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Server: AmazonS3
Date: Thu, 18 May 2023 02:36:56 GMT
ETag: "4d5acbf33f4a0592ac0515db92fe88e6"
X-Cache: Hit from cloudfront
Via: 1.1 dd133741afef09b02f3e6afd7cb39f40.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS50-C1
X-Amz-Cf-Id: lGkS9heE8Wh1cx8Enrq28DngZWrzdMInUwkkNn28ovZ0Mfk-GRonEg==
Age: 43664
DNS

cm.g.doubleclick.net

chrome.exe

Remote address:

8.8.8.8:53

Request

cm.g.doubleclick.net

IN A

Response

cm.g.doubleclick.net

IN A

142.250.179.162
DNS

tpc.googlesyndication.com

chrome.exe

Remote address:

8.8.8.8:53

Request

tpc.googlesyndication.com

IN A

Response

tpc.googlesyndication.com

IN A

142.250.179.193
GET

https://id.rlcdn.com/711916.gif?ct=4&cv=

chrome.exe

Remote address:

35.190.60.146:443

Request

GET /711916.gif?ct=4&cv= HTTP/2.0
host: id.rlcdn.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID

chrome.exe

Remote address:

207.65.33.79:443

Request

GET /AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID HTTP/2.0
host: image8.pubmatic.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:40 GMT
content-length: 0
GET

https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID

chrome.exe

Remote address:

207.65.33.79:443

Request

GET /AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID HTTP/2.0
host: image8.pubmatic.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:40 GMT
content-length: 0
GET

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]

chrome.exe

Remote address:

185.86.139.94:443

Request

GET /api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid] HTTP/2.0
host: ssbsync-global.smartadserver.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-length: 0
date: Thu, 18 May 2023 14:44:39 GMT
GET

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]

chrome.exe

Remote address:

185.86.139.94:443

Request

GET /api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid] HTTP/2.0
host: ssbsync-global.smartadserver.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-length: 0
date: Thu, 18 May 2023 14:44:39 GMT
GET

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm

chrome.exe

Remote address:

142.250.179.162:443

Request

GET /pixel?google_nid=onetag_eb&google_cm HTTP/2.0
host: cm.g.doubleclick.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: test_cookie=CheckForPermission
GET

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

chrome.exe

Remote address:

3.75.62.37:443

Request

GET /ups/58488/occ?&gdpr=1&gdpr_consent= HTTP/2.0
host: ups.analytics.yahoo.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

chrome.exe

Remote address:

3.75.62.37:443

Request

GET /ups/58488/occ?&gdpr=1&gdpr_consent= HTTP/2.0
host: ups.analytics.yahoo.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://onetag-sys.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://tpc.googlesyndication.com/simgad/14161806019441194284?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkB0iHw0_gZvX9_ePO5hc3qh-u2hg

chrome.exe

Remote address:

142.250.179.193:443

Request

GET /simgad/14161806019441194284?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkB0iHw0_gZvX9_ePO5hc3qh-u2hg HTTP/2.0
host: tpc.googlesyndication.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

chrome.exe

Remote address:

142.250.179.193:443

Request

GET /pagead/images/adchoices/en.png HTTP/2.0
host: tpc.googlesyndication.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

chrome.exe

Remote address:

142.250.179.193:443

Request

GET /pagead/images/adchoices/icon.png HTTP/2.0
host: tpc.googlesyndication.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

esp.rtbhouse.com

chrome.exe

Remote address:

8.8.8.8:53

Request

esp.rtbhouse.com

IN A

Response

esp.rtbhouse.com

IN A

35.190.39.111
DNS

id5-sync.com

chrome.exe

Remote address:

8.8.8.8:53

Request

id5-sync.com

IN A

Response

id5-sync.com

IN A

141.95.98.65

id5-sync.com

IN A

141.95.98.64

id5-sync.com

IN A

162.19.138.119

id5-sync.com

IN A

162.19.138.120

id5-sync.com

IN A

141.95.33.111

id5-sync.com

IN A

162.19.138.118

id5-sync.com

IN A

162.19.138.117

id5-sync.com

IN A

162.19.138.82

id5-sync.com

IN A

162.19.138.83

id5-sync.com

IN A

162.19.138.116
DNS

x.bidswitch.net

chrome.exe

Remote address:

8.8.8.8:53

Request

x.bidswitch.net

IN A

Response

x.bidswitch.net

IN CNAME

alb-aws-fr-bruges-1875226813.eu-central-1.elb.amazonaws.com

alb-aws-fr-bruges-1875226813.eu-central-1.elb.amazonaws.com

IN A

18.185.28.161

alb-aws-fr-bruges-1875226813.eu-central-1.elb.amazonaws.com

IN A

18.196.152.216

alb-aws-fr-bruges-1875226813.eu-central-1.elb.amazonaws.com

IN A

3.68.180.113

alb-aws-fr-bruges-1875226813.eu-central-1.elb.amazonaws.com

IN A

3.64.44.143

alb-aws-fr-bruges-1875226813.eu-central-1.elb.amazonaws.com

IN A

18.185.196.61

alb-aws-fr-bruges-1875226813.eu-central-1.elb.amazonaws.com

IN A

18.198.83.202

alb-aws-fr-bruges-1875226813.eu-central-1.elb.amazonaws.com

IN A

3.65.79.246

alb-aws-fr-bruges-1875226813.eu-central-1.elb.amazonaws.com

IN A

18.195.11.242
OPTIONS

https://esp.rtbhouse.com/encrypt

chrome.exe

Remote address:

35.190.39.111:443

Request

OPTIONS /encrypt HTTP/2.0
host: esp.rtbhouse.com
accept: */*
access-control-request-method: POST
access-control-request-headers: content-type
origin: https://krew.io
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

108.1.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

108.1.101.151.in-addr.arpa

IN PTR

Response
DNS

137.56.52.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

137.56.52.23.in-addr.arpa

IN PTR

Response

137.56.52.23.in-addr.arpa

IN PTR

a23-52-56-137deploystaticakamaitechnologiescom
DNS

192.146.102.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

192.146.102.34.in-addr.arpa

IN PTR

Response

192.146.102.34.in-addr.arpa

IN PTR

19214610234bcgoogleusercontentcom
DNS

3.1.250.178.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.1.250.178.in-addr.arpa

IN PTR

Response
DNS

87.70.96.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

87.70.96.34.in-addr.arpa

IN PTR

Response

87.70.96.34.in-addr.arpa

IN PTR

87709634bcgoogleusercontentcom
DNS

86.53.22.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.53.22.104.in-addr.arpa

IN PTR

Response
DNS

36.141.222.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.141.222.52.in-addr.arpa

IN PTR

Response

36.141.222.52.in-addr.arpa

IN PTR

server-52-222-141-36ams50r cloudfrontnet
DNS

90.162.19.213.in-addr.arpa

Remote address:

8.8.8.8:53

Request

90.162.19.213.in-addr.arpa

IN PTR

Response
DNS

7.139.222.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

7.139.222.52.in-addr.arpa

IN PTR

Response

7.139.222.52.in-addr.arpa

IN PTR

server-52-222-139-7ams50r cloudfrontnet
DNS

245.132.29.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

245.132.29.185.in-addr.arpa

IN PTR

Response
DNS

162.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

162.179.250.142.in-addr.arpa

IN PTR

Response

162.179.250.142.in-addr.arpa

IN PTR

ams15s41-in-f21e100net
DNS

146.60.190.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

146.60.190.35.in-addr.arpa

IN PTR

Response

146.60.190.35.in-addr.arpa

IN PTR

1466019035bcgoogleusercontentcom
DNS

198.40.223.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.40.223.52.in-addr.arpa

IN PTR

Response

198.40.223.52.in-addr.arpa

IN PTR

a6370ebea231e0c9aawsglobalacceleratorcom
DNS

94.139.86.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

94.139.86.185.in-addr.arpa

IN PTR

Response
DNS

37.62.75.3.in-addr.arpa

Remote address:

8.8.8.8:53

Request

37.62.75.3.in-addr.arpa

IN PTR

Response

37.62.75.3.in-addr.arpa

IN PTR

ec2-3-75-62-37eu-central-1compute amazonawscom
DNS

80.162.19.213.in-addr.arpa

Remote address:

8.8.8.8:53

Request

80.162.19.213.in-addr.arpa

IN PTR

Response
DNS

193.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

193.179.250.142.in-addr.arpa

IN PTR

Response

193.179.250.142.in-addr.arpa

IN PTR

ams15s42-in-f11e100net
DNS

79.33.65.207.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.33.65.207.in-addr.arpa

IN PTR
DNS

79.33.65.207.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.33.65.207.in-addr.arpa

IN PTR
DNS

79.33.65.207.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.33.65.207.in-addr.arpa

IN PTR
DNS

79.33.65.207.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.33.65.207.in-addr.arpa

IN PTR
DNS

79.33.65.207.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.33.65.207.in-addr.arpa

IN PTR
DNS

oajs.openx.net

chrome.exe

Remote address:

8.8.8.8:53

Request

oajs.openx.net

IN A

Response

oajs.openx.net

IN A

34.120.135.53

oajs.openx.net

IN A

34.120.107.143
DNS

gumi.criteo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

gumi.criteo.com

IN A

Response

gumi.criteo.com

IN CNAME

gum.sg1.vip.prod.criteo.com

gum.sg1.vip.prod.criteo.com

IN A

182.161.73.136
DNS

pbs.cpmstar.com

chrome.exe

Remote address:

8.8.8.8:53

Request

pbs.cpmstar.com

IN A

Response

pbs.cpmstar.com

IN A

198.24.171.50
DNS

pbs.cpmstar.com

chrome.exe

Remote address:

8.8.8.8:53

Request

pbs.cpmstar.com

IN A

Response

pbs.cpmstar.com

IN A

198.24.171.50
GET

https://oajs.openx.net/esp?url=https%3A%2F%2Fkrew.io%2F&rid=esp

chrome.exe

Remote address:

34.120.135.53:443

Request

GET /esp?url=https%3A%2F%2Fkrew.io%2F&rid=esp HTTP/2.0
host: oajs.openx.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://krew.io
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://gumi.criteo.com/syncframe?origin=publishertagids&topUrl=krew.io

chrome.exe

Remote address:

182.161.73.136:443

Request

GET /syncframe?origin=publishertagids&topUrl=krew.io HTTP/2.0
host: gumi.criteo.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:40 GMT
content-type: text/html; charset=utf-8
server: Kestrel
cache-control: private, max-age=3600
set-cookie: uid=a315ddc2-75e7-42d8-afa4-0d9a487fc3d2; expires=Tue, 11 Jun 2024 14:44:40 GMT; domain=.criteo.com; path=/; secure; samesite=none
set-cookie: optout=0; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=.criteo.com; path=/
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 826782
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
content-encoding: gzip
GET

https://gumi.criteo.com/sid/json?origin=publishertagids&domain=krew.io&sn=ChromeSyncframe&so=0&topUrl=krew.io&cw=1&lsw=1&topicsavail=0&fledgeavail=0

chrome.exe

Remote address:

182.161.73.136:443

Request

GET /sid/json?origin=publishertagids&domain=krew.io&sn=ChromeSyncframe&so=0&topUrl=krew.io&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP/2.0
host: gumi.criteo.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://gumi.criteo.com/syncframe?origin=publishertagids&topUrl=krew.io
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: uid=a315ddc2-75e7-42d8-afa4-0d9a487fc3d2

Response

HTTP/2.0 200

date: Thu, 18 May 2023 14:44:40 GMT
content-type: application/json; charset=utf-8
server: Kestrel
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
server-processing-duration-in-ticks: 1730098
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
content-encoding: gzip
GET

https://id5-sync.com/api/esp/increment?counter=no-config

chrome.exe

Remote address:

141.95.98.65:443

Request

GET /api/esp/increment?counter=no-config HTTP/1.1
Host: id5-sync.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Content-Type: text/plain
Accept: */*
Origin: https://krew.io
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://krew.io/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 204

vary: Origin
vary: Access-Control-Request-Method
vary: Access-Control-Request-Headers
access-control-allow-origin: https://krew.io
vary: Origin
access-control-allow-credentials: true
date: Thu, 18 May 2023 14:44:39 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
DNS

googleads.g.doubleclick.net

chrome.exe

Remote address:

8.8.8.8:53

Request

googleads.g.doubleclick.net

IN A

Response

googleads.g.doubleclick.net

IN A

172.217.168.226
GET

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

chrome.exe

Remote address:

172.217.168.226:443

Request

GET /pagead/drt/si?st=NO_DATA HTTP/2.0
host: googleads.g.doubleclick.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: IDE=AHWqTUmkzNEbDVTlg3YcPtoM5swsT2qeiuk2_rPmJXqE6RGsQZLUq2iHXxQLvg1Gvks
DNS

s.amazon-adsystem.com

chrome.exe

Remote address:

8.8.8.8:53

Request

s.amazon-adsystem.com

IN A

Response

s.amazon-adsystem.com

IN A

209.54.182.161
DNS

17.211.227.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

17.211.227.13.in-addr.arpa

IN PTR

Response

17.211.227.13.in-addr.arpa

IN PTR

server-13-227-211-17ams54r cloudfrontnet
DNS

17.211.227.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

17.211.227.13.in-addr.arpa

IN PTR

Response

17.211.227.13.in-addr.arpa

IN PTR

server-13-227-211-17ams54r cloudfrontnet
DNS

111.39.190.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

111.39.190.35.in-addr.arpa

IN PTR

Response

111.39.190.35.in-addr.arpa

IN PTR

1113919035bcgoogleusercontentcom
DNS

161.28.185.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

161.28.185.18.in-addr.arpa

IN PTR

Response

161.28.185.18.in-addr.arpa

IN PTR

ec2-18-185-28-161eu-central-1compute amazonawscom
DNS

53.135.120.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

53.135.120.34.in-addr.arpa

IN PTR

Response

53.135.120.34.in-addr.arpa

IN PTR

5313512034bcgoogleusercontentcom
DNS

65.98.95.141.in-addr.arpa

Remote address:

8.8.8.8:53

Request

65.98.95.141.in-addr.arpa

IN PTR

Response

65.98.95.141.in-addr.arpa

IN PTR

ns3216659ip-141-95-98eu
DNS

bcp.crwdcntrl.net

chrome.exe

Remote address:

8.8.8.8:53

Request

bcp.crwdcntrl.net

IN A

Response

bcp.crwdcntrl.net

IN A

3.1.234.252

bcp.crwdcntrl.net

IN A

52.76.53.82

bcp.crwdcntrl.net

IN A

54.255.71.233

bcp.crwdcntrl.net

IN A

52.77.132.121

bcp.crwdcntrl.net

IN A

52.76.1.43

bcp.crwdcntrl.net

IN A

54.179.8.241

bcp.crwdcntrl.net

IN A

52.76.10.75

bcp.crwdcntrl.net

IN A

54.254.94.149
DNS

226.168.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.168.217.172.in-addr.arpa

IN PTR

Response

226.168.217.172.in-addr.arpa

IN PTR

ams15s40-in-f21e100net
DNS

226.168.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.168.217.172.in-addr.arpa

IN PTR

Response

226.168.217.172.in-addr.arpa

IN PTR

ams15s40-in-f21e100net
DNS

50.171.24.198.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.171.24.198.in-addr.arpa

IN PTR

Response
DNS

50.171.24.198.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.171.24.198.in-addr.arpa

IN PTR

Response
DNS

136.73.161.182.in-addr.arpa

Remote address:

8.8.8.8:53

Request

136.73.161.182.in-addr.arpa

IN PTR

Response
DNS

aax-eu.amazon-adsystem.com

chrome.exe

Remote address:

8.8.8.8:53

Request

aax-eu.amazon-adsystem.com

IN A

Response

aax-eu.amazon-adsystem.com

IN A

52.95.122.74
DNS

token.rubiconproject.com

chrome.exe

Remote address:

8.8.8.8:53

Request

token.rubiconproject.com

IN A

Response

token.rubiconproject.com

IN CNAME

pixel.rubiconproject.net.akadns.net

pixel.rubiconproject.net.akadns.net

IN A

213.19.162.80

pixel.rubiconproject.net.akadns.net

IN A

213.19.162.90
DNS

1.77.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.77.109.52.in-addr.arpa

IN PTR

Response
DNS

161.182.54.209.in-addr.arpa

Remote address:

8.8.8.8:53

Request

161.182.54.209.in-addr.arpa

IN PTR

Response
DNS

252.234.1.3.in-addr.arpa

Remote address:

8.8.8.8:53

Request

252.234.1.3.in-addr.arpa

IN PTR

Response

252.234.1.3.in-addr.arpa

IN PTR

ec2-3-1-234-252ap-southeast-1compute amazonawscom
DNS

pr-bh.ybp.yahoo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

pr-bh.ybp.yahoo.com

IN A

Response

pr-bh.ybp.yahoo.com

IN CNAME

ds-pr-bh.ybp.gysm.yahoodns.net

ds-pr-bh.ybp.gysm.yahoodns.net

IN A

54.229.197.230

ds-pr-bh.ybp.gysm.yahoodns.net

IN A

54.77.208.59

ds-pr-bh.ybp.gysm.yahoodns.net

IN A

54.194.166.94

ds-pr-bh.ybp.gysm.yahoodns.net

IN A

54.247.46.239
DNS

px.ads.linkedin.com

chrome.exe

Remote address:

8.8.8.8:53

Request

px.ads.linkedin.com

IN A

Response

px.ads.linkedin.com

IN CNAME

www.linkedin.com

www.linkedin.com

IN CNAME

www-linkedin-com.l-0005.l-msedge.net

www-linkedin-com.l-0005.l-msedge.net

IN CNAME

l-0005.l-msedge.net

l-0005.l-msedge.net

IN A

13.107.42.14
DNS

google-bidout-d.openx.net

chrome.exe

Remote address:

8.8.8.8:53

Request

google-bidout-d.openx.net

IN A

Response

google-bidout-d.openx.net

IN A

35.244.159.8

google-bidout-d.openx.net

IN A

34.98.64.218
GET

https://google-bidout-d.openx.net/w/1.0/pd?plm=5

chrome.exe

Remote address:

35.244.159.8:443

Request

GET /w/1.0/pd?plm=5 HTTP/2.0
host: google-bidout-d.openx.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://krew.io/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: i=ae4438d1-9b84-4699-b44b-4d6f19781345|1684421080
GET

https://us-u.openx.net/w/1.0/sd?id=537072971&val=8d7d1376-dee5-4ebe-a0da-db737228964f&ttd_puid=7de80788-3203-796e-ee9d-85877d5f20b8&gdpr=0&gdpr_consent=

chrome.exe

Remote address:

35.244.159.8:443

Request

GET /w/1.0/sd?id=537072971&val=8d7d1376-dee5-4ebe-a0da-db737228964f&ttd_puid=7de80788-3203-796e-ee9d-85877d5f20b8&gdpr=0&gdpr_consent= HTTP/2.0
host: us-u.openx.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://google-bidout-d.openx.net/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: i=ae4438d1-9b84-4699-b44b-4d6f19781345|1684421080
cookie: pd=v2|1684421082|gen0vNiygu
GET

https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7244244554700100776

chrome.exe

Remote address:

35.244.159.8:443

Request

GET /w/1.0/sd?id=537113484&val=7244244554700100776 HTTP/2.0
host: eu-u.openx.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://google-bidout-d.openx.net/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: i=ae4438d1-9b84-4699-b44b-4d6f19781345|1684421080
cookie: pd=v2|1684421082|gen0vNiygu
cookie: univ_id=537072971|8d7d1376-dee5-4ebe-a0da-db737228964f|1684421083507756
DNS

74.122.95.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

74.122.95.52.in-addr.arpa

IN PTR

Response
DNS

14.42.107.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.42.107.13.in-addr.arpa

IN PTR

Response
DNS

14.42.107.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.42.107.13.in-addr.arpa

IN PTR

Response
DNS

230.197.229.54.in-addr.arpa

Remote address:

8.8.8.8:53

Request

230.197.229.54.in-addr.arpa

IN PTR

Response

230.197.229.54.in-addr.arpa

IN PTR

ec2-54-229-197-230 eu-west-1compute amazonawscom
DNS

8.159.244.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.159.244.35.in-addr.arpa

IN PTR

Response

8.159.244.35.in-addr.arpa

IN PTR

815924435bcgoogleusercontentcom
DNS

8.159.244.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.159.244.35.in-addr.arpa

IN PTR

Response

8.159.244.35.in-addr.arpa

IN PTR

815924435bcgoogleusercontentcom
DNS

cms.quantserve.com

chrome.exe

Remote address:

8.8.8.8:53

Request

cms.quantserve.com

IN A

Response

cms.quantserve.com

IN CNAME

2kpixel.quantserve.com

2kpixel.quantserve.com

IN CNAME

global.px.quantserve.com

global.px.quantserve.com

IN A

103.229.10.171

global.px.quantserve.com

IN A

103.229.10.192

global.px.quantserve.com

IN A

103.229.10.247

global.px.quantserve.com

IN A

103.229.10.211

global.px.quantserve.com

IN A

103.229.10.180
DNS

c1.adform.net

chrome.exe

Remote address:

8.8.8.8:53

Request

c1.adform.net

IN A

Response

c1.adform.net

IN CNAME

track.adformnet.akadns.net

track.adformnet.akadns.net

IN A

37.157.5.84

track.adformnet.akadns.net

IN A

37.157.5.133

track.adformnet.akadns.net

IN A

37.157.5.132
DNS

us-u.openx.net

chrome.exe

Remote address:

8.8.8.8:53

Request

us-u.openx.net

IN A

Response

us-u.openx.net

IN A

34.98.64.218

us-u.openx.net

IN A

35.244.159.8
DNS

eu-u.openx.net

chrome.exe

Remote address:

8.8.8.8:53

Request

eu-u.openx.net

IN A

Response

eu-u.openx.net

IN A

35.244.159.8

eu-u.openx.net

IN A

34.98.64.218
DNS

84.5.157.37.in-addr.arpa

Remote address:

8.8.8.8:53

Request

84.5.157.37.in-addr.arpa

IN PTR

Response
DNS

171.10.229.103.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.10.229.103.in-addr.arpa

IN PTR

Response
DNS

218.64.98.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

218.64.98.34.in-addr.arpa

IN PTR

Response

218.64.98.34.in-addr.arpa

IN PTR

218649834bcgoogleusercontentcom
DNS

beacons.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

216.58.214.3
POST

https://beacons.gcp.gvt2.com/domainreliability/upload

chrome.exe

Remote address:

216.58.214.3:443

Request

POST /domainreliability/upload HTTP/2.0
host: beacons.gcp.gvt2.com
content-length: 271
content-type: application/json; charset=utf-8
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
POST

https://beacons.gcp.gvt2.com/domainreliability/upload

chrome.exe

Remote address:

216.58.214.3:443

Request

POST /domainreliability/upload HTTP/2.0
host: beacons.gcp.gvt2.com
content-length: 268
content-type: application/json; charset=utf-8
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

e2c28.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

e2c28.gcp.gvt2.com

IN A

Response

e2c28.gcp.gvt2.com

IN A

34.94.232.12
POST

https://e2c28.gcp.gvt2.com/nel/

chrome.exe

Remote address:

34.94.232.12:443

Request

POST /nel/ HTTP/2.0
host: e2c28.gcp.gvt2.com
content-length: 271
content-type: application/json; charset=utf-8
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Thu, 18 May 2023 14:45:37 GMT
DNS

3.214.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.214.58.216.in-addr.arpa

IN PTR

Response

3.214.58.216.in-addr.arpa

IN PTR

ams17s09-in-f31e100net

3.214.58.216.in-addr.arpa

IN PTR

lhr26s05-in-f3�F

3.214.58.216.in-addr.arpa

IN PTR

�]
DNS

12.232.94.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

12.232.94.34.in-addr.arpa

IN PTR

Response

12.232.94.34.in-addr.arpa

IN PTR

122329434bcgoogleusercontentcom
DNS

beacons.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gvt2.com

IN A

Response

beacons.gvt2.com

IN A

142.250.179.131
DNS

56.126.166.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.126.166.20.in-addr.arpa

IN PTR

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

2.36.159.162.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.36.159.162.in-addr.arpa

IN PTR

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

183.59.114.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.59.114.20.in-addr.arpa

IN PTR

Response
DNS

7.173.189.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

7.173.189.20.in-addr.arpa

IN PTR

Response
DNS

beacons.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

216.58.214.3
DNS

beacons.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

216.58.214.3
DNS

beacons.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

216.58.214.3
DNS

beacons.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

216.58.214.3
DNS

14.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.160.190.20.in-addr.arpa

IN PTR

Response
DNS

47.125.24.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

47.125.24.20.in-addr.arpa

IN PTR

Response
DNS

76.38.195.152.in-addr.arpa

Remote address:

8.8.8.8:53

Request

76.38.195.152.in-addr.arpa

IN PTR

Response
DNS

191.94.239.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

191.94.239.20.in-addr.arpa

IN PTR

Response
DNS

234.14.97.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

234.14.97.104.in-addr.arpa

IN PTR

Response

234.14.97.104.in-addr.arpa

IN PTR

a104-97-14-234deploystaticakamaitechnologiescom

2.21.35.200:443

https://assets.msn.com/serviceak/v1/news/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&activityId=292df3a2-dfa7-40eb-aa2a-40b4987b2a0f&ocid=windows-windowsShell-feeds&user=m-cf89462b11a8449c8f6b21e7993ab708&Treatment=T6&MaximumDimensions=660x640&experience=Taskbar&AppVersion=1&osLocale=en-US&caller=bgtask

tls, http2

2.7kB
10.9kB
22
20

HTTP Request

GET https://assets.msn.com/serviceak/v1/news/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&activityId=292df3a2-dfa7-40eb-aa2a-40b4987b2a0f&ocid=windows-windowsShell-feeds&user=m-cf89462b11a8449c8f6b21e7993ab708&Treatment=T6&MaximumDimensions=660x640&experience=Taskbar&AppVersion=1&osLocale=en-US&caller=bgtask

HTTP Response

200
52.152.110.14:443

260 B
5
172.217.23.206:443

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.UjJbvPIecP0.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_flbzE3yQmWQ7n7N3yCQZtJt8-oA/cb=gapi.loaded_0

tls, http2

chrome.exe

3.4kB
47.4kB
44
46

HTTP Request

GET https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.UjJbvPIecP0.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_flbzE3yQmWQ7n7N3yCQZtJt8-oA/cb=gapi.loaded_0
142.250.179.206:443

https://ogs.google.com/widget/callout?prid=19035139&pgid=19035138&puid=5501dadb089d1f63&dc=1&ssc=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=callout&pid=1&spid=243&hl=en

tls, http2

chrome.exe

3.1kB
23.1kB
25
30

HTTP Request

GET https://ogs.google.com/widget/callout?prid=19035139&pgid=19035138&puid=5501dadb089d1f63&dc=1&ssc=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=callout&pid=1&spid=243&hl=en
172.217.23.195:443

https://ssl.gstatic.com/gb/images/sprites/p_1x_ced8ed050bd0.png

tls, http2

chrome.exe

2.9kB
60.5kB
38
57

HTTP Request

GET https://ssl.gstatic.com/gb/images/sprites/p_1x_ced8ed050bd0.png
142.251.36.14:443

https://play.google.com/log?format=json&hasfast=true

tls, http2

chrome.exe

7.2kB
9.8kB
25
26

HTTP Request

POST https://play.google.com/log?format=json&hasfast=true
142.251.36.14:443

https://play.google.com/log?format=json&hasfast=true&authuser=0

tls, http2

chrome.exe

2.0kB
8.8kB
20
21

HTTP Request

OPTIONS https://play.google.com/log?format=json&hasfast=true&authuser=0
142.251.36.46:443

https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=106.0.5249.119&lang=en-US&acceptformat=crx3&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D1.58.4%26installsource%3Dnotfromwebstore%26installedby%3Dexternal%26uc%26ping%3Dr%253D87%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D1.0.0.6%26installsource%3Dnotfromwebstore%26installedby%3Dother%26uc%26ping%3Dr%253D87%2526e%253D1

tls, http2

chrome.exe

2.4kB
10.0kB
20
23

HTTP Request

GET https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=106.0.5249.119&lang=en-US&acceptformat=crx3&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D1.58.4%26installsource%3Dnotfromwebstore%26installedby%3Dexternal%26uc%26ping%3Dr%253D87%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D1.0.0.6%26installsource%3Dnotfromwebstore%26installedby%3Dother%26uc%26ping%3Dr%253D87%2526e%253D1
20.189.173.2:443

322 B
7
93.184.221.240:80

322 B
7
172.67.178.36:443

krew.io

tls, http2

chrome.exe

989 B
5.1kB
9
8
172.67.178.36:443

https://krew.io/

tls, http2

chrome.exe

2.5kB
23.6kB
30
40

HTTP Request

GET https://krew.io/

HTTP Response

200
104.17.25.14:443

cdnjs.cloudflare.com

tls, http2

chrome.exe

943 B
2.9kB
8
6
104.17.25.14:443

https://cdnjs.cloudflare.com/ajax/libs/three.js/r108/three.min.js

tls, http2

chrome.exe

6.4kB
231.9kB
109
187

HTTP Request

GET https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.3/jquery.min.js

HTTP Request

GET https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.13.2/jquery-ui.min.js

HTTP Request

GET https://cdnjs.cloudflare.com/ajax/libs/magnific-popup.js/1.1.0/jquery.magnific-popup.min.js

HTTP Request

GET https://cdnjs.cloudflare.com/ajax/libs/tether/1.4.7/js/tether.min.js

HTTP Request

GET https://cdnjs.cloudflare.com/ajax/libs/three.js/r108/three.min.js

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200
104.17.25.14:443

cdnjs.cloudflare.com

tls, http2

chrome.exe

943 B
2.9kB
8
6
104.17.25.14:443

cdnjs.cloudflare.com

tls, http2

chrome.exe

943 B
2.9kB
8
6
104.17.25.14:443

cdnjs.cloudflare.com

tls, http2

chrome.exe

943 B
2.9kB
8
6
104.18.11.207:443

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/js/bootstrap.min.js

tls, http2

chrome.exe

2.5kB
17.1kB
30
31

HTTP Request

GET https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/js/bootstrap.min.js

HTTP Response

200
172.66.43.66:443

https://api.adinplay.com/libs/aiptag/assets/adsbygoogle.js

tls, http2

chrome.exe

6.5kB
173.1kB
109
146

HTTP Request

GET https://api.adinplay.com/libs/aiptag/pub/BLS/krew.io/tag.min.js

HTTP Response

200

HTTP Request

GET https://api.adinplay.com/libs/aiptag/assets/adsbygoogle.js

HTTP Response

200
35.190.80.1:443

https://a.nel.cloudflare.com/report/v3?s=uASmhA8rRRKAn%2ByDUc9Ud78Otpr3JEkUulBLQ0KQVoGlW2%2BkzB%2FrHTBG%2ByL4TU2xwTuukedPSqqgw%2BRaNDjMt5YdFgxK5%2FfumUN3zh6lCzDdYdg88Mw2quvf

tls, http2

chrome.exe

2.4kB
7.3kB
28
29

HTTP Request

OPTIONS https://a.nel.cloudflare.com/report/v3?s=uASmhA8rRRKAn%2ByDUc9Ud78Otpr3JEkUulBLQ0KQVoGlW2%2BkzB%2FrHTBG%2ByL4TU2xwTuukedPSqqgw%2BRaNDjMt5YdFgxK5%2FfumUN3zh6lCzDdYdg88Mw2quvf
151.101.1.229:443

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20230518

tls, http2

chrome.exe

2.3kB
9.1kB
26
29

HTTP Request

GET https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20230518

HTTP Response

200
142.250.179.170:443

https://imasdk.googleapis.com/js/sdkloader/ima3.js

tls, http2

chrome.exe

4.6kB
137.3kB
76
111

HTTP Request

GET https://imasdk.googleapis.com/js/sdkloader/ima3.js
104.21.69.205:443

https://country.adinplay.workers.dev/

tls, http2

chrome.exe

2.0kB
6.4kB
20
22

HTTP Request

GET https://country.adinplay.workers.dev/

HTTP Response

200
88.221.25.153:80

http://apps.identrust.com/roots/dstrootcax3.p7c

http

chrome.exe

468 B
1.7kB
7
6

HTTP Request

GET http://apps.identrust.com/roots/dstrootcax3.p7c

HTTP Response

200
69.173.144.140:443

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23042&site_id=360062&zone_id=2685800&size_id=15&rp_schain=1.0,1!adinplay.com,BLS,1,,,&rf=https%3A%2F%2Fkrew.io%2F&kw=krew%2Cio%2Cdevclied%2Cshooter%2Cgame%2Cpirate%2C3D%2Cmultiplayer%2Cfree&tg_i.domain=krew.io&tg_i.page=https%3A%2F%2Fkrew.io%2F&tk_flint=pbjs_lite_v7.42.0&x_source.tid=df81e39e-5676-40aa-aefe-d8b17bbbd391&l_pb_bid_id=2344cc09204f2c&p_screen_res=1280x720&rp_secure=1&rp_maxbids=1&slots=1&rand=0.44062737575775346

tls, http2

chrome.exe

2.6kB
6.2kB
19
24

HTTP Request

GET https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23042&site_id=360062&zone_id=2685800&size_id=15&rp_schain=1.0,1!adinplay.com,BLS,1,,,&rf=https%3A%2F%2Fkrew.io%2F&kw=krew%2Cio%2Cdevclied%2Cshooter%2Cgame%2Cpirate%2C3D%2Cmultiplayer%2Cfree&tg_i.domain=krew.io&tg_i.page=https%3A%2F%2Fkrew.io%2F&tk_flint=pbjs_lite_v7.42.0&x_source.tid=df81e39e-5676-40aa-aefe-d8b17bbbd391&l_pb_bid_id=2344cc09204f2c&p_screen_res=1280x720&rp_secure=1&rp_maxbids=1&slots=1&rand=0.44062737575775346

HTTP Response

200
37.252.171.53:443

ib.adnxs.com

tls

chrome.exe

3.3kB
6.0kB
13
15
51.75.86.98:443

https://onetag-sys.com/match/?int_id=29&uid=8d7d1376-dee5-4ebe-a0da-db737228964f&gdpr=0&gdpr_consent=

tls, http2

chrome.exe

5.9kB
13.5kB
39
38

HTTP Request

POST https://onetag-sys.com/prebid-request

HTTP Response

200

HTTP Request

GET https://onetag-sys.com/usync/?cb=1684428276854

HTTP Request

GET https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpbs.cpmstar.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26f%3Db%26uid%3D%24%7BUSER_TOKEN%7D

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1

HTTP Request

GET https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1

HTTP Response

302

HTTP Response

302

HTTP Request

GET https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1

HTTP Request

GET https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1

HTTP Response

302

HTTP Response

302

HTTP Request

GET https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=679504853255603868

HTTP Response

200

HTTP Request

GET https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=679504853255603868

HTTP Response

200

HTTP Request

GET https://onetag-sys.com/match/?int_id=106&google_error=15

HTTP Request

GET https://onetag-sys.com/match/?int_id=1&uid=18d36466-39d8-4a00-bb90-51cdeaaf10d6&gdpr=1&gdpr_consent=

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://onetag-sys.com/match/?int_id=1&uid=ad796466-39d7-4700-93d4-20108193c500&gdpr=1&gdpr_consent=

HTTP Request

GET https://onetag-sys.com/match/?int_id=106&google_error=15

HTTP Response

200

HTTP Request

GET https://onetag-sys.com/match/?int_id=110&uid=

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://onetag-sys.com/match/?int_id=29&uid=8d7d1376-dee5-4ebe-a0da-db737228964f&gdpr=0&gdpr_consent=

HTTP Response

200

HTTP Request

GET https://onetag-sys.com/match/?int_id=29&uid=8d7d1376-dee5-4ebe-a0da-db737228964f&gdpr=0&gdpr_consent=

HTTP Response

200
198.24.170.28:443

server.cpmstar.com

tls

chrome.exe

1.9kB
7.2kB
11
12
52.152.110.14:443

260 B
5
142.250.179.170:443

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSFwmmE_ZepmfOvhIFDWZWAVcSBQ2OhiioEiwJu3HDWEgc7OcSBQ2ezAtWEgUNkfJlNxIFDcamXooSBQ1VqVwdEgUNU1pHxRIQCTg0YX8vuB6eEgUNQ7qIlRIQCT_FoZfWlVN_EgUN9UdfVBIQCSuKQ92nMlwhEgUNHNZb1RIeCanUMaACpRfGEgUNnIJuYBIFDeGhK0ASBQ30nz5MEhcJ1ti7xKMF1egSBQ0tyJOpEgUN5VbC_BIQCbkaOm0xg94qEgUNXXiq0hIzCWBW83me1iVxEgUNrzxMiBIFDW55USgSBQ3lx9dnEgUNJmCxIBIFDS0P6fASBQ0P4xJ-?alt=proto

tls, http2

chrome.exe

2.2kB
7.5kB
19
21

HTTP Request

GET https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSFwmmE_ZepmfOvhIFDWZWAVcSBQ2OhiioEiwJu3HDWEgc7OcSBQ2ezAtWEgUNkfJlNxIFDcamXooSBQ1VqVwdEgUNU1pHxRIQCTg0YX8vuB6eEgUNQ7qIlRIQCT_FoZfWlVN_EgUN9UdfVBIQCSuKQ92nMlwhEgUNHNZb1RIeCanUMaACpRfGEgUNnIJuYBIFDeGhK0ASBQ30nz5MEhcJ1ti7xKMF1egSBQ0tyJOpEgUN5VbC_BIQCbkaOm0xg94qEgUNXXiq0hIzCWBW83me1iVxEgUNrzxMiBIFDW55USgSBQ3lx9dnEgUNJmCxIBIFDS0P6fASBQ0P4xJ-?alt=proto
142.250.179.161:443

https://559395a8d5bb271a0e6c0ca3f8eb67fd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

tls, http2

chrome.exe

2.1kB
10.0kB
19
21

HTTP Request

GET https://559395a8d5bb271a0e6c0ca3f8eb67fd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
151.101.1.108:443

acdn.adnxs.com

tls

chrome.exe

2.6kB
23.7kB
26
31
23.52.56.137:443

https://eus.rubiconproject.com/usync.js

tls, http

chrome.exe

3.2kB
16.1kB
24
28

HTTP Request

GET https://eus.rubiconproject.com/usync.html

HTTP Response

200

HTTP Request

GET https://eus.rubiconproject.com/usync.js

HTTP Response

200
34.102.146.192:443

https://oa.openxcdn.net/esp.js

tls, http2

chrome.exe

2.4kB
15.5kB
29
33

HTTP Request

GET https://oa.openxcdn.net/esp.js
178.250.1.3:443

https://static.criteo.net/js/ld/publishertag.ids.js

tls, http2

chrome.exe

1.8kB
18.0kB
17
21

HTTP Request

GET https://static.criteo.net/js/ld/publishertag.ids.js

HTTP Response

200
104.22.53.86:443

https://cdn.id5-sync.com/api/1.0/esp.js

tls, http2

chrome.exe

2.3kB
22.3kB
28
37

HTTP Request

GET https://cdn.id5-sync.com/api/1.0/esp.js

HTTP Response

200
142.250.179.161:443

cdn.ampproject.org

tls, http2

chrome.exe

1.1kB
12.1kB
11
12
142.250.179.161:443

cdn.ampproject.org

tls, http2

chrome.exe

1.1kB
12.1kB
11
12
142.250.179.161:443

cdn.ampproject.org

tls, http2

chrome.exe

1.1kB
12.1kB
11
12
142.250.179.161:443

cdn.ampproject.org

tls, http2

chrome.exe

1.1kB
12.1kB
11
12
142.250.179.161:443

https://cdn.ampproject.org/rtv/012305051745000/v0/amp-form-0.1.mjs

tls, http2

chrome.exe

4.5kB
130.4kB
67
108

HTTP Request

GET https://cdn.ampproject.org/rtv/012305051745000/amp4ads-v0.mjs

HTTP Request

GET https://cdn.ampproject.org/rtv/012305051745000/v0/amp-ad-exit-0.1.mjs

HTTP Request

GET https://cdn.ampproject.org/rtv/012305051745000/v0/amp-analytics-0.1.mjs

HTTP Request

GET https://cdn.ampproject.org/rtv/012305051745000/v0/amp-fit-text-0.1.mjs

HTTP Request

GET https://cdn.ampproject.org/rtv/012305051745000/v0/amp-form-0.1.mjs
34.96.70.87:443

https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js

tls, http2

chrome.exe

2.3kB
9.3kB
27
29

HTTP Request

GET https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
52.222.139.7:443

https://tags.crwdcntrl.net/lt/c/16589/sync.min.js

tls, http2

chrome.exe

2.1kB
19.6kB
23
31

HTTP Request

GET https://tags.crwdcntrl.net/lt/c/16589/sync.min.js

HTTP Response

200
52.222.141.36:443

https://cdn.prod.uidapi.com/uid2SecureSignal.js

tls, http

chrome.exe

1.9kB
8.5kB
16
20

HTTP Request

GET https://cdn.prod.uidapi.com/uid2SecureSignal.js

HTTP Response

200
185.29.132.245:443

sync.mathtag.com

tls

chrome.exe

2.8kB
5.8kB
16
15
213.19.162.90:443

pixel-eu.rubiconproject.com

tls

chrome.exe

3.4kB
4.4kB
21
18
35.190.60.146:443

https://id.rlcdn.com/711916.gif?ct=4&cv=

tls, http2

chrome.exe

2.3kB
8.6kB
26
28

HTTP Request

GET https://id.rlcdn.com/711916.gif?ct=4&cv=
207.65.33.79:443

https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID

tls, http2

chrome.exe

2.3kB
5.7kB
20
24

HTTP Request

GET https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID

HTTP Response

200

HTTP Request

GET https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID

HTTP Response

200
37.252.171.53:443

ib.adnxs.com

tls

chrome.exe

3.2kB
3.5kB
13
12
185.86.139.94:443

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]

tls, http2

chrome.exe

2.1kB
5.3kB
16
16

HTTP Request

GET https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]

HTTP Response

200

HTTP Request

GET https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]

HTTP Response

200
142.250.179.162:443

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm

tls, http2

chrome.exe

2.1kB
7.3kB
19
21

HTTP Request

GET https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
3.75.62.37:443

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

tls, http2

chrome.exe

2.0kB
5.7kB
18
18

HTTP Request

GET https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

HTTP Request

GET https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=
52.223.40.198:443

match.adsrvr.org

tls

chrome.exe

3.2kB
9.7kB
27
29
213.19.162.80:443

pixel.rubiconproject.com

tls

chrome.exe

6.8kB
8.5kB
25
22
142.250.179.193:443

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

tls, http2

chrome.exe

3.2kB
59.9kB
40
60

HTTP Request

GET https://tpc.googlesyndication.com/simgad/14161806019441194284?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkB0iHw0_gZvX9_ePO5hc3qh-u2hg

HTTP Request

GET https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

HTTP Request

GET https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
142.250.179.193:443

tpc.googlesyndication.com

tls, http2

chrome.exe

999 B
5.8kB
9
8
142.250.179.193:443

tpc.googlesyndication.com

tls, http2

chrome.exe

999 B
5.8kB
9
8
207.65.33.79:443

image8.pubmatic.com

tls, http2

chrome.exe

1.1kB
5.0kB
11
12
173.223.113.164:443

322 B
7
35.190.39.111:443

https://esp.rtbhouse.com/encrypt

tls, http2

chrome.exe

2.3kB
7.1kB
27
29

HTTP Request

OPTIONS https://esp.rtbhouse.com/encrypt
173.223.113.131:80

322 B
7
204.79.197.203:80

api.msn.com

322 B
7
18.185.28.161:443

x.bidswitch.net

tls

chrome.exe

2.1kB
6.7kB
18
23
34.120.135.53:443

https://oajs.openx.net/esp?url=https%3A%2F%2Fkrew.io%2F&rid=esp

tls, http2

chrome.exe

2.3kB
5.7kB
26
28

HTTP Request

GET https://oajs.openx.net/esp?url=https%3A%2F%2Fkrew.io%2F&rid=esp
182.161.73.136:443

https://gumi.criteo.com/sid/json?origin=publishertagids&domain=krew.io&sn=ChromeSyncframe&so=0&topUrl=krew.io&cw=1&lsw=1&topicsavail=0&fledgeavail=0

tls, http2

chrome.exe

2.3kB
11.5kB
18
19

HTTP Request

GET https://gumi.criteo.com/syncframe?origin=publishertagids&topUrl=krew.io

HTTP Response

200

HTTP Request

GET https://gumi.criteo.com/sid/json?origin=publishertagids&domain=krew.io&sn=ChromeSyncframe&so=0&topUrl=krew.io&cw=1&lsw=1&topicsavail=0&fledgeavail=0

HTTP Response

200
141.95.98.65:443

https://id5-sync.com/api/esp/increment?counter=no-config

tls, http

chrome.exe

1.8kB
5.2kB
13
12

HTTP Request

GET https://id5-sync.com/api/esp/increment?counter=no-config

HTTP Response

204
172.217.168.226:443

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

tls, http2

chrome.exe

2.1kB
7.2kB
19
21

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
198.24.171.50:443

pbs.cpmstar.com

tls

chrome.exe

1.8kB
5.7kB
11
10
182.161.73.136:443

gumi.criteo.com

tls

chrome.exe

943 B
4.2kB
8
9
198.24.171.50:443

pbs.cpmstar.com

tls

chrome.exe

1.1kB
5.3kB
9
9
209.54.182.161:443

s.amazon-adsystem.com

tls

chrome.exe

5.1kB
10.2kB
22
23
3.1.234.252:443

bcp.crwdcntrl.net

tls

chrome.exe

3.5kB
7.5kB
19
24
3.1.234.252:443

bcp.crwdcntrl.net

tls

chrome.exe

1.3kB
6.4kB
14
17
52.95.122.74:443

aax-eu.amazon-adsystem.com

tls

chrome.exe

3.5kB
9.7kB
17
24
213.19.162.80:443

token.rubiconproject.com

tls

chrome.exe

2.2kB
4.8kB
17
17
213.19.162.80:443

token.rubiconproject.com

tls

chrome.exe

2.4kB
4.4kB
17
17
213.19.162.80:443

token.rubiconproject.com

tls

chrome.exe

2.2kB
5.4kB
17
18
213.19.162.80:443

token.rubiconproject.com

tls

chrome.exe

2.2kB
5.4kB
17
18
54.229.197.230:443

pr-bh.ybp.yahoo.com

tls

chrome.exe

2.0kB
7.0kB
16
20
13.107.42.14:443

px.ads.linkedin.com

tls

chrome.exe

1.9kB
6.2kB
13
16
35.244.159.8:443

https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7244244554700100776

tls, http2

chrome.exe

3.3kB
7.6kB
34
40

HTTP Request

GET https://google-bidout-d.openx.net/w/1.0/pd?plm=5

HTTP Request

GET https://us-u.openx.net/w/1.0/sd?id=537072971&val=8d7d1376-dee5-4ebe-a0da-db737228964f&ttd_puid=7de80788-3203-796e-ee9d-85877d5f20b8&gdpr=0&gdpr_consent=

HTTP Request

GET https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7244244554700100776
37.157.5.84:443

c1.adform.net

tls

chrome.exe

2.1kB
7.2kB
18
19
103.229.10.171:443

cms.quantserve.com

tls

chrome.exe

1.7kB
5.1kB
12
16
103.229.10.171:443

cms.quantserve.com

tls

chrome.exe

1.2kB
4.5kB
13
14
52.152.110.14:443

260 B
5
52.152.110.14:443

260 B
5
216.58.214.3:443

beacons.gcp.gvt2.com

tls, http2

chrome.exe

999 B
5.8kB
9
8
216.58.214.3:443

https://beacons.gcp.gvt2.com/domainreliability/upload

tls, http2

chrome.exe

2.9kB
7.6kB
26
22

HTTP Request

POST https://beacons.gcp.gvt2.com/domainreliability/upload

HTTP Request

POST https://beacons.gcp.gvt2.com/domainreliability/upload
34.94.232.12:443

https://e2c28.gcp.gvt2.com/nel/

tls, http2

chrome.exe

1.9kB
5.9kB
15
19

HTTP Request

POST https://e2c28.gcp.gvt2.com/nel/

HTTP Response

204
52.152.110.14:443

260 B
5
52.152.110.14:443

260 B
5
52.152.110.14:443

260 B
5
52.152.110.14:443

260 B
5
52.152.110.14:443

260 B
5

8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

assets.msn.com

dns

60 B
166 B
1
1

DNS Request

assets.msn.com

DNS Response

2.21.35.200

2.21.35.233
8.8.8.8:53

74.32.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

74.32.126.40.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

200.35.21.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

200.35.21.2.in-addr.arpa
8.8.8.8:53

200.232.18.117.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

200.232.18.117.in-addr.arpa
8.8.8.8:53

250.255.255.239.in-addr.arpa

dns

74 B
131 B
1
1

DNS Request

250.255.255.239.in-addr.arpa
8.8.8.8:53

195.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

195.179.250.142.in-addr.arpa
8.8.8.8:53

10.36.251.142.in-addr.arpa

dns

72 B
111 B
1
1

DNS Request

10.36.251.142.in-addr.arpa
8.8.8.8:53

100.39.251.142.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

100.39.251.142.in-addr.arpa
8.8.8.8:53

apis.google.com

dns

chrome.exe

61 B
98 B
1
1

DNS Request

apis.google.com

DNS Response

172.217.23.206
8.8.8.8:53

ogs.google.com

dns

chrome.exe

60 B
97 B
1
1

DNS Request

ogs.google.com

DNS Response

142.250.179.206
8.8.8.8:53

ssl.gstatic.com

dns

chrome.exe

61 B
77 B
1
1

DNS Request

ssl.gstatic.com

DNS Response

172.217.23.195
8.8.8.8:53

206.23.217.172.in-addr.arpa

dns

73 B
173 B
1
1

DNS Request

206.23.217.172.in-addr.arpa
8.8.8.8:53

206.179.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

206.179.250.142.in-addr.arpa
8.8.8.8:53

195.23.217.172.in-addr.arpa

dns

73 B
171 B
1
1

DNS Request

195.23.217.172.in-addr.arpa
8.8.8.8:53

131.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

131.179.250.142.in-addr.arpa
8.8.8.8:53

play.google.com

dns

chrome.exe

61 B
77 B
1
1

DNS Request

play.google.com

DNS Response

142.251.36.14
142.251.36.14:443

play.google.com

https

chrome.exe

5.8kB
8.6kB
14
19
8.8.8.8:53

clients2.google.com

dns

chrome.exe

65 B
105 B
1
1

DNS Request

clients2.google.com

DNS Response

142.251.36.46
8.8.8.8:53

14.36.251.142.in-addr.arpa

dns

72 B
111 B
1
1

DNS Request

14.36.251.142.in-addr.arpa
224.0.0.251:5353

chrome.exe

204 B
3
8.8.8.8:53

46.36.251.142.in-addr.arpa

dns

72 B
111 B
1
1

DNS Request

46.36.251.142.in-addr.arpa
142.250.179.206:443

ogs.google.com

https

chrome.exe

2.8kB
22.1kB
13
21
8.8.8.8:53

krew.io

dns

chrome.exe

106 B
170 B
2
2

DNS Request

krew.io

DNS Request

krew.io

DNS Response

172.67.178.36

104.21.43.106

DNS Response

172.67.178.36

104.21.43.106
172.67.178.36:443

krew.io

https

chrome.exe

281.9kB
17.8MB
2006
15037
8.8.8.8:53

cdnjs.cloudflare.com

dns

chrome.exe

66 B
98 B
1
1

DNS Request

cdnjs.cloudflare.com

DNS Response

104.17.25.14

104.17.24.14
8.8.8.8:53

maxcdn.bootstrapcdn.com

dns

chrome.exe

69 B
101 B
1
1

DNS Request

maxcdn.bootstrapcdn.com

DNS Response

104.18.11.207

104.18.10.207
8.8.8.8:53

api.adinplay.com

dns

chrome.exe

62 B
94 B
1
1

DNS Request

api.adinplay.com

DNS Response

172.66.43.66

172.66.40.190
8.8.8.8:53

36.178.67.172.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

36.178.67.172.in-addr.arpa
8.8.8.8:53

14.25.17.104.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

14.25.17.104.in-addr.arpa
8.8.8.8:53

207.11.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

207.11.18.104.in-addr.arpa
8.8.8.8:53

66.43.66.172.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

66.43.66.172.in-addr.arpa
8.8.8.8:53

a.nel.cloudflare.com

dns

chrome.exe

66 B
82 B
1
1

DNS Request

a.nel.cloudflare.com

DNS Response

35.190.80.1
8.8.8.8:53

cdn.jsdelivr.net

dns

chrome.exe

62 B
160 B
1
1

DNS Request

cdn.jsdelivr.net

DNS Response

151.101.1.229

151.101.65.229

151.101.129.229

151.101.193.229
8.8.8.8:53

country.adinplay.workers.dev

dns

chrome.exe

74 B
106 B
1
1

DNS Request

country.adinplay.workers.dev

DNS Response

104.21.69.205

172.67.213.21
8.8.8.8:53

securepubads.g.doubleclick.net

dns

chrome.exe

76 B
121 B
1
1

DNS Request

securepubads.g.doubleclick.net

DNS Response

172.217.23.194
8.8.8.8:53

imasdk.googleapis.com

dns

chrome.exe

67 B
83 B
1
1

DNS Request

imasdk.googleapis.com

DNS Response

142.250.179.170
8.8.8.8:53

apps.identrust.com

dns

chrome.exe

64 B
165 B
1
1

DNS Request

apps.identrust.com

DNS Response

88.221.25.153

88.221.25.169
35.190.80.1:443

a.nel.cloudflare.com

https

chrome.exe

2.6kB
5.2kB
8
9
8.8.8.8:53

fastlane.rubiconproject.com

dns

chrome.exe

73 B
206 B
1
1

DNS Request

fastlane.rubiconproject.com

DNS Response

69.173.144.140

213.19.162.41

213.19.162.51

213.19.162.31

213.19.162.21
8.8.8.8:53

ib.adnxs.com

dns

chrome.exe

58 B
251 B
1
1

DNS Request

ib.adnxs.com

DNS Response

37.252.171.53

37.252.171.85

37.252.171.52

37.252.171.149

37.252.172.123

37.252.171.22

37.252.173.215

37.252.171.21

37.252.171.84
8.8.8.8:53

onetag-sys.com

dns

chrome.exe

60 B
156 B
1
1

DNS Request

onetag-sys.com

DNS Response

51.75.86.98

51.89.9.251

51.38.120.206

51.89.9.252

51.89.9.253

51.89.9.254
8.8.8.8:53

server.cpmstar.com

dns

chrome.exe

64 B
160 B
1
1

DNS Request

server.cpmstar.com

DNS Response

198.24.170.28

23.235.251.213

23.235.251.211

198.24.162.123

198.24.170.52

198.24.170.51
8.8.8.8:53

content-autofill.googleapis.com

dns

chrome.exe

77 B
221 B
1
1

DNS Request

content-autofill.googleapis.com

DNS Response

142.250.179.170

142.250.179.202

142.251.36.10

142.251.39.106

172.217.23.202

216.58.208.106

216.58.214.10

142.250.179.138

142.251.36.42
8.8.8.8:53

1.80.190.35.in-addr.arpa

dns

70 B
120 B
1
1

DNS Request

1.80.190.35.in-addr.arpa
8.8.8.8:53

229.1.101.151.in-addr.arpa

dns

144 B
264 B
2
2

DNS Request

229.1.101.151.in-addr.arpa

DNS Request

229.1.101.151.in-addr.arpa
8.8.8.8:53

194.23.217.172.in-addr.arpa

dns

73 B
171 B
1
1

DNS Request

194.23.217.172.in-addr.arpa
8.8.8.8:53

170.179.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

170.179.250.142.in-addr.arpa
8.8.8.8:53

205.69.21.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

205.69.21.104.in-addr.arpa
8.8.8.8:53

153.25.221.88.in-addr.arpa

dns

144 B
274 B
2
2

DNS Request

153.25.221.88.in-addr.arpa

DNS Request

153.25.221.88.in-addr.arpa
8.8.8.8:53

226.21.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

226.21.18.104.in-addr.arpa
8.8.8.8:53

140.144.173.69.in-addr.arpa

dns

73 B
127 B
1
1

DNS Request

140.144.173.69.in-addr.arpa
8.8.8.8:53

53.171.252.37.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

53.171.252.37.in-addr.arpa
8.8.8.8:53

98.86.75.51.in-addr.arpa

dns

70 B
103 B
1
1

DNS Request

98.86.75.51.in-addr.arpa
8.8.8.8:53

28.170.24.198.in-addr.arpa

dns

144 B
290 B
2
2

DNS Request

28.170.24.198.in-addr.arpa

DNS Request

28.170.24.198.in-addr.arpa
8.8.8.8:53

559395a8d5bb271a0e6c0ca3f8eb67fd.safeframe.googlesyndication.com

dns

chrome.exe

110 B
169 B
1
1

DNS Request

559395a8d5bb271a0e6c0ca3f8eb67fd.safeframe.googlesyndication.com

DNS Response

142.250.179.161
8.8.8.8:53

194.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

194.179.250.142.in-addr.arpa
8.8.8.8:53

161.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

161.179.250.142.in-addr.arpa
8.8.8.8:53

eus.rubiconproject.com

dns

chrome.exe

68 B
165 B
1
1

DNS Request

eus.rubiconproject.com

DNS Response

23.52.56.137
8.8.8.8:53

acdn.adnxs.com

dns

chrome.exe

60 B
166 B
1
1

DNS Request

acdn.adnxs.com

DNS Response

151.101.1.108

151.101.65.108

151.101.129.108

151.101.193.108
8.8.8.8:53

oa.openxcdn.net

dns

chrome.exe

61 B
77 B
1
1

DNS Request

oa.openxcdn.net

DNS Response

34.102.146.192
8.8.8.8:53

static.criteo.net

dns

chrome.exe

63 B
113 B
1
1

DNS Request

static.criteo.net

DNS Response

178.250.1.3
151.101.1.229:443

cdn.jsdelivr.net

https

chrome.exe

2.5kB
5.4kB
10
9
8.8.8.8:53

cdn.id5-sync.com

dns

chrome.exe

62 B
110 B
1
1

DNS Request

cdn.id5-sync.com

DNS Response

104.22.53.86

172.67.38.106

104.22.52.86
8.8.8.8:53

invstatic101.creativecdn.com

dns

chrome.exe

74 B
90 B
1
1

DNS Request

invstatic101.creativecdn.com

DNS Response

34.96.70.87
8.8.8.8:53

tags.crwdcntrl.net

dns

chrome.exe

64 B
128 B
1
1

DNS Request

tags.crwdcntrl.net

DNS Response

52.222.139.7

52.222.139.35

52.222.139.100

52.222.139.112
8.8.8.8:53

cdn.prod.uidapi.com

dns

chrome.exe

65 B
124 B
1
1

DNS Request

cdn.prod.uidapi.com

DNS Response

52.222.141.36
8.8.8.8:53

cdn.ampproject.org

dns

chrome.exe

64 B
106 B
1
1

DNS Request

cdn.ampproject.org

DNS Response

142.250.179.161
8.8.8.8:53

sync.mathtag.com

dns

chrome.exe

62 B
153 B
1
1

DNS Request

sync.mathtag.com

DNS Response

185.29.132.245

185.29.132.241

185.29.134.248

185.29.134.244
8.8.8.8:53

pixel-eu.rubiconproject.com

dns

chrome.exe

73 B
157 B
1
1

DNS Request

pixel-eu.rubiconproject.com

DNS Response

213.19.162.90

213.19.162.80
8.8.8.8:53

id.rlcdn.com

dns

chrome.exe

58 B
74 B
1
1

DNS Request

id.rlcdn.com

DNS Response

35.190.60.146
8.8.8.8:53

match.adsrvr.org

dns

chrome.exe

124 B
252 B
2
2

DNS Request

match.adsrvr.org

DNS Response

52.223.40.198

35.71.131.137

15.197.193.217

3.33.220.150

DNS Request

match.adsrvr.org

DNS Response

52.223.40.198

35.71.131.137

15.197.193.217

3.33.220.150
8.8.8.8:53

ssbsync-global.smartadserver.com

dns

chrome.exe

78 B
263 B
1
1

DNS Request

ssbsync-global.smartadserver.com

DNS Response

185.86.139.94

185.86.139.102

185.86.139.93

185.86.139.104

185.86.139.101

185.86.139.103
8.8.8.8:53

ups.analytics.yahoo.com

dns

chrome.exe

69 B
254 B
1
1

DNS Request

ups.analytics.yahoo.com

DNS Response

3.75.62.37

3.71.149.231
8.8.8.8:53

pixel.rubiconproject.com

dns

chrome.exe

140 B
302 B
2
2

DNS Request

pixel.rubiconproject.com

DNS Response

213.19.162.80

213.19.162.90

DNS Request

pixel.rubiconproject.com

DNS Response

213.19.162.90

213.19.162.80
8.8.8.8:53

image8.pubmatic.com

dns

chrome.exe

65 B
143 B
1
1

DNS Request

image8.pubmatic.com

DNS Response

207.65.33.79
8.8.8.8:53

cm.g.doubleclick.net

dns

chrome.exe

66 B
82 B
1
1

DNS Request

cm.g.doubleclick.net

DNS Response

142.250.179.162
8.8.8.8:53

tpc.googlesyndication.com

dns

chrome.exe

71 B
87 B
1
1

DNS Request

tpc.googlesyndication.com

DNS Response

142.250.179.193
8.8.8.8:53

esp.rtbhouse.com

dns

chrome.exe

62 B
78 B
1
1

DNS Request

esp.rtbhouse.com

DNS Response

35.190.39.111
8.8.8.8:53

id5-sync.com

dns

chrome.exe

58 B
218 B
1
1

DNS Request

id5-sync.com

DNS Response

141.95.98.65

141.95.98.64

162.19.138.119

162.19.138.120

141.95.33.111

162.19.138.118

162.19.138.117

162.19.138.82

162.19.138.83

162.19.138.116
8.8.8.8:53

x.bidswitch.net

dns

chrome.exe

61 B
262 B
1
1

DNS Request

x.bidswitch.net

DNS Response

18.185.28.161

18.196.152.216

3.68.180.113

3.64.44.143

18.185.196.61

18.198.83.202

3.65.79.246

18.195.11.242
8.8.8.8:53

108.1.101.151.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

108.1.101.151.in-addr.arpa
8.8.8.8:53

137.56.52.23.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

137.56.52.23.in-addr.arpa
8.8.8.8:53

192.146.102.34.in-addr.arpa

dns

73 B
126 B
1
1

DNS Request

192.146.102.34.in-addr.arpa
8.8.8.8:53

3.1.250.178.in-addr.arpa

dns

70 B
124 B
1
1

DNS Request

3.1.250.178.in-addr.arpa
8.8.8.8:53

87.70.96.34.in-addr.arpa

dns

70 B
120 B
1
1

DNS Request

87.70.96.34.in-addr.arpa
8.8.8.8:53

86.53.22.104.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

86.53.22.104.in-addr.arpa
8.8.8.8:53

36.141.222.52.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

36.141.222.52.in-addr.arpa
8.8.8.8:53

90.162.19.213.in-addr.arpa

dns

72 B
72 B
1
1

DNS Request

90.162.19.213.in-addr.arpa
8.8.8.8:53

7.139.222.52.in-addr.arpa

dns

71 B
127 B
1
1

DNS Request

7.139.222.52.in-addr.arpa
8.8.8.8:53

245.132.29.185.in-addr.arpa

dns

73 B
133 B
1
1

DNS Request

245.132.29.185.in-addr.arpa
8.8.8.8:53

162.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

162.179.250.142.in-addr.arpa
8.8.8.8:53

146.60.190.35.in-addr.arpa

dns

72 B
124 B
1
1

DNS Request

146.60.190.35.in-addr.arpa
8.8.8.8:53

198.40.223.52.in-addr.arpa

dns

72 B
128 B
1
1

DNS Request

198.40.223.52.in-addr.arpa
8.8.8.8:53

94.139.86.185.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

94.139.86.185.in-addr.arpa
8.8.8.8:53

37.62.75.3.in-addr.arpa

dns

69 B
132 B
1
1

DNS Request

37.62.75.3.in-addr.arpa
8.8.8.8:53

80.162.19.213.in-addr.arpa

dns

72 B
72 B
1
1

DNS Request

80.162.19.213.in-addr.arpa
8.8.8.8:53

193.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

193.179.250.142.in-addr.arpa
142.250.179.162:443

cm.g.doubleclick.net

https

chrome.exe

4.1kB
9.8kB
27
36
35.190.60.146:443

id.rlcdn.com

https

chrome.exe

3.8kB
6.8kB
12
13
8.8.8.8:53

79.33.65.207.in-addr.arpa

dns

355 B
5

DNS Request

79.33.65.207.in-addr.arpa

DNS Request

79.33.65.207.in-addr.arpa

DNS Request

79.33.65.207.in-addr.arpa

DNS Request

79.33.65.207.in-addr.arpa

DNS Request

79.33.65.207.in-addr.arpa
8.8.8.8:53

oajs.openx.net

dns

chrome.exe

60 B
92 B
1
1

DNS Request

oajs.openx.net

DNS Response

34.120.135.53

34.120.107.143
142.250.179.193:443

tpc.googlesyndication.com

https

chrome.exe

4.7kB
21.1kB
25
29
8.8.8.8:53

gumi.criteo.com

dns

chrome.exe

61 B
108 B
1
1

DNS Request

gumi.criteo.com

DNS Response

182.161.73.136
8.8.8.8:53

pbs.cpmstar.com

dns

chrome.exe

122 B
154 B
2
2

DNS Request

pbs.cpmstar.com

DNS Request

pbs.cpmstar.com

DNS Response

198.24.171.50

DNS Response

198.24.171.50
35.190.39.111:443

esp.rtbhouse.com

https

chrome.exe

3.5kB
5.6kB
8
9
8.8.8.8:53

googleads.g.doubleclick.net

dns

chrome.exe

73 B
89 B
1
1

DNS Request

googleads.g.doubleclick.net

DNS Response

172.217.168.226
34.120.135.53:443

oajs.openx.net

https

chrome.exe

2.2kB
4.2kB
7
8
8.8.8.8:53

s.amazon-adsystem.com

dns

chrome.exe

67 B
83 B
1
1

DNS Request

s.amazon-adsystem.com

DNS Response

209.54.182.161
8.8.8.8:53

17.211.227.13.in-addr.arpa

dns

144 B
258 B
2
2

DNS Request

17.211.227.13.in-addr.arpa

DNS Request

17.211.227.13.in-addr.arpa
8.8.8.8:53

111.39.190.35.in-addr.arpa

dns

72 B
124 B
1
1

DNS Request

111.39.190.35.in-addr.arpa
8.8.8.8:53

161.28.185.18.in-addr.arpa

dns

72 B
138 B
1
1

DNS Request

161.28.185.18.in-addr.arpa
8.8.8.8:53

53.135.120.34.in-addr.arpa

dns

72 B
124 B
1
1

DNS Request

53.135.120.34.in-addr.arpa
8.8.8.8:53

65.98.95.141.in-addr.arpa

dns

71 B
110 B
1
1

DNS Request

65.98.95.141.in-addr.arpa
8.8.8.8:53

bcp.crwdcntrl.net

dns

chrome.exe

63 B
191 B
1
1

DNS Request

bcp.crwdcntrl.net

DNS Response

3.1.234.252

52.76.53.82

54.255.71.233

52.77.132.121

52.76.1.43

54.179.8.241

52.76.10.75

54.254.94.149
8.8.8.8:53

226.168.217.172.in-addr.arpa

dns

148 B
224 B
2
2

DNS Request

226.168.217.172.in-addr.arpa

DNS Request

226.168.217.172.in-addr.arpa
8.8.8.8:53

50.171.24.198.in-addr.arpa

dns

144 B
290 B
2
2

DNS Request

50.171.24.198.in-addr.arpa

DNS Request

50.171.24.198.in-addr.arpa
8.8.8.8:53

136.73.161.182.in-addr.arpa

dns

73 B
127 B
1
1

DNS Request

136.73.161.182.in-addr.arpa
8.8.8.8:53

aax-eu.amazon-adsystem.com

dns

chrome.exe

72 B
88 B
1
1

DNS Request

aax-eu.amazon-adsystem.com

DNS Response

52.95.122.74
8.8.8.8:53

token.rubiconproject.com

dns

chrome.exe

70 B
151 B
1
1

DNS Request

token.rubiconproject.com

DNS Response

213.19.162.80

213.19.162.90
8.8.8.8:53

1.77.109.52.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

1.77.109.52.in-addr.arpa
8.8.8.8:53

161.182.54.209.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

161.182.54.209.in-addr.arpa
8.8.8.8:53

252.234.1.3.in-addr.arpa

dns

70 B
136 B
1
1

DNS Request

252.234.1.3.in-addr.arpa
8.8.8.8:53

pr-bh.ybp.yahoo.com

dns

chrome.exe

65 B
173 B
1
1

DNS Request

pr-bh.ybp.yahoo.com

DNS Response

54.229.197.230

54.77.208.59

54.194.166.94

54.247.46.239
8.8.8.8:53

px.ads.linkedin.com

dns

chrome.exe

65 B
163 B
1
1

DNS Request

px.ads.linkedin.com

DNS Response

13.107.42.14
8.8.8.8:53

google-bidout-d.openx.net

dns

chrome.exe

71 B
103 B
1
1

DNS Request

google-bidout-d.openx.net

DNS Response

35.244.159.8

34.98.64.218
8.8.8.8:53

74.122.95.52.in-addr.arpa

dns

71 B
142 B
1
1

DNS Request

74.122.95.52.in-addr.arpa
8.8.8.8:53

14.42.107.13.in-addr.arpa

dns

142 B
314 B
2
2

DNS Request

14.42.107.13.in-addr.arpa

DNS Request

14.42.107.13.in-addr.arpa
8.8.8.8:53

230.197.229.54.in-addr.arpa

dns

73 B
137 B
1
1

DNS Request

230.197.229.54.in-addr.arpa
8.8.8.8:53

8.159.244.35.in-addr.arpa

dns

142 B
244 B
2
2

DNS Request

8.159.244.35.in-addr.arpa

DNS Request

8.159.244.35.in-addr.arpa
8.8.8.8:53

cms.quantserve.com

dns

chrome.exe

64 B
190 B
1
1

DNS Request

cms.quantserve.com

DNS Response

103.229.10.171

103.229.10.192

103.229.10.247

103.229.10.211

103.229.10.180
8.8.8.8:53

c1.adform.net

dns

chrome.exe

59 B
144 B
1
1

DNS Request

c1.adform.net

DNS Response

37.157.5.84

37.157.5.133

37.157.5.132
8.8.8.8:53

us-u.openx.net

dns

chrome.exe

60 B
92 B
1
1

DNS Request

us-u.openx.net

DNS Response

34.98.64.218

35.244.159.8
8.8.8.8:53

eu-u.openx.net

dns

chrome.exe

60 B
92 B
1
1

DNS Request

eu-u.openx.net

DNS Response

35.244.159.8

34.98.64.218
8.8.8.8:53

84.5.157.37.in-addr.arpa

dns

70 B
142 B
1
1

DNS Request

84.5.157.37.in-addr.arpa
8.8.8.8:53

171.10.229.103.in-addr.arpa

dns

73 B
161 B
1
1

DNS Request

171.10.229.103.in-addr.arpa
34.98.64.218:443

eu-u.openx.net

https

chrome.exe

2.4kB
4.2kB
9
9
8.8.8.8:53

218.64.98.34.in-addr.arpa

dns

71 B
122 B
1
1

DNS Request

218.64.98.34.in-addr.arpa
35.190.80.1:443

a.nel.cloudflare.com

https

chrome.exe

8.1kB
2.6kB
13
11
8.8.8.8:53

beacons.gcp.gvt2.com

dns

chrome.exe

66 B
112 B
1
1

DNS Request

beacons.gcp.gvt2.com

DNS Response

216.58.214.3
8.8.8.8:53

e2c28.gcp.gvt2.com

dns

chrome.exe

64 B
80 B
1
1

DNS Request

e2c28.gcp.gvt2.com

DNS Response

34.94.232.12
8.8.8.8:53

3.214.58.216.in-addr.arpa

dns

71 B
152 B
1
1

DNS Request

3.214.58.216.in-addr.arpa
8.8.8.8:53

12.232.94.34.in-addr.arpa

dns

71 B
122 B
1
1

DNS Request

12.232.94.34.in-addr.arpa
8.8.8.8:53

beacons.gvt2.com

dns

chrome.exe

62 B
78 B
1
1

DNS Request

beacons.gvt2.com

DNS Response

142.250.179.131
8.8.8.8:53

56.126.166.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

56.126.166.20.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

2.36.159.162.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

2.36.159.162.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

183.59.114.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

183.59.114.20.in-addr.arpa
8.8.8.8:53

7.173.189.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

7.173.189.20.in-addr.arpa
8.8.8.8:53

beacons.gcp.gvt2.com

dns

chrome.exe

66 B
112 B
1
1

DNS Request

beacons.gcp.gvt2.com

DNS Response

216.58.214.3
216.58.214.3:443

beacons.gcp.gvt2.com

https

chrome.exe

3.6kB
7.8kB
12
19
8.8.8.8:53

beacons.gcp.gvt2.com

dns

chrome.exe

66 B
112 B
1
1

DNS Request

beacons.gcp.gvt2.com

DNS Response

216.58.214.3
216.58.214.3:443

beacons.gcp.gvt2.com

https

chrome.exe

2.8kB
3.7kB
10
12
8.8.8.8:53

beacons.gcp.gvt2.com

dns

chrome.exe

66 B
112 B
1
1

DNS Request

beacons.gcp.gvt2.com

DNS Response

216.58.214.3
216.58.214.3:443

beacons.gcp.gvt2.com

https

chrome.exe

3.6kB
3.6kB
9
9
8.8.8.8:53

beacons.gcp.gvt2.com

dns

chrome.exe

66 B
112 B
1
1

DNS Request

beacons.gcp.gvt2.com

DNS Response

216.58.214.3
216.58.214.3:443

beacons.gcp.gvt2.com

https

chrome.exe

2.3kB
3.6kB
8
9
8.8.8.8:53

14.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

14.160.190.20.in-addr.arpa
8.8.8.8:53

47.125.24.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

47.125.24.20.in-addr.arpa
8.8.8.8:53

76.38.195.152.in-addr.arpa

dns

72 B
143 B
1
1

DNS Request

76.38.195.152.in-addr.arpa
8.8.8.8:53

191.94.239.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

191.94.239.20.in-addr.arpa
8.8.8.8:53

234.14.97.104.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

234.14.97.104.in-addr.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
144335f0965ff761e7a2defeed1a8a59

SHA1
6ec775e40f66b2c8520f2a39967a6cb1ef2321d3

SHA256
b96e3e4f61804f99f9924fd096b6e77445ed82675da23ad1c77c692a43e3b041

SHA512
f308b81d72b48875b1f22d994bf9f6f43999807983b667143abe572d041831c3dd1a14e50a25036799bde787a615bb8a0d9fa3fc3420c0b48c11e1c90f133d5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
6b37ceb4b771f1e21a199c00389e8b4a

SHA1
d1794ce0f97052eb213f37e3d08913804dcac063

SHA256
d9af3598df234f06bd550e4aa658e3c928e0236eb0ce59abaca06d306bfa2966

SHA512
aedaab1943741e14c836526fa1a97f402c41a34271865e6cc46f86930fcbe35898cb9ca85c0e786f5462244a363b495fb78b3ea1e806b9966161ec329ce492a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030

Filesize
162KB

MD5
475f3b2f4b6829f089f959d8291c69ab

SHA1
10cfe4b0bad5e7fc4c1bd4c4f79f9cc32ed93c99

SHA256
4f40a7d3b7ddf8e77c9b9556b37cdbc062bda1e20757b4c709adcd3ee624b219

SHA512
fb2b2fb4b86dac393e35c42e66e327af699fa1c6baefdeb4ce9f95298990faed0ad556475d16ba6ad31868412f6179d996cff7c15329f4ef92778be592e9d712

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c516bb146ee6d16a90c900afbc5177f1

SHA1
d4cfcef2101c75f7d1e74f28437b559020dd279a

SHA256
a7fcf4da3836561f2c354fdcbe5fd6ce976c76fbc7763514bcbd0a2649fb9f12

SHA512
6a4de206f0c334f8982ba067aefd578df408a9b5cd13b260f96cb81a72dc634adc443627981c95cdc473a0dc957bc836f7277560b71169f22ae3e69d37b28bbe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
f9edd6b5a159355b2fc1ace268061621

SHA1
db37bb3c269953a47848d16b28dd6d0cb8f7f01d

SHA256
b47f30e03945b3bb192505482c685746f60f8021c56032ce380c97eb11673bdf

SHA512
1416cc2a899f04078c3dfb8d03a6b4ec7db6ab029ea3fd27431a666ffa08276bd9b309d894f2685a8c76546131fb3e6acb29ed95a86c1388ead3362110e7ef83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
b7df38118157a2581efbb109da222edd

SHA1
4cf08d0f18ce401e5ea06f3ffafd009b26477787

SHA256
c7b44f7b8f30f4ec2ba7455bb0e2523162192376a9d7216133dc0d4076b768b1

SHA512
c3e1d590424ceed0d07eab4f1285908c4299b15b37ef56f86f8a2d3ae80a77a7f16358a3bce13f36e2300bb0a62e8d736333251f94c71bce3b95eb52406d703c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d2d7afa2b49fca7234f276224479651d

SHA1
2bb0c1c8010bed09803f5c69440e391690fd198e

SHA256
91dff388f8f0f747903fed4788d65551745c507a66316fcc52825d379b45109f

SHA512
af0c1865c9d237717cb1da479f31d0807e51e3722861d097aa59255754c267021394a071aef7ae0bb8364515ac14750cd13c8860ab8089431e12c3a151a80f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8596549401f0634f55333d5d89694164

SHA1
e9c86575449e7060598a1886a9c5668ef714d3a6

SHA256
fcc80cb33cbb097677695e5c1e4c2c667f86351278c4c8e8bff932727b4a2665

SHA512
fd45a957a26452cda8f0ed50b9265820635fb62732934cd78651b96895a19e8b0ee4e2c40f2bf7c2dfb8e920b8a4784b65b74cf9c1366a52789b3c403be9e747

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
89489be48f90d658e70cff77844703f7

SHA1
54eca5e7148df99dba6bd8d4dccd7e44549dc988

SHA256
0817f66fd98b1cf1adbdf674cad3323f91cdf9c2e9b09f08fca4e762e02c2e02

SHA512
2cc8e856a8f9a9976cbe102f0701e2a2d876461ab95eca03aa4bf60eedbb6407cac7ff292f12f46b60791152a83cbc345d5fb5a2ed9ad8cc8970d8c10b4fb2a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
bf99090403eff12e2880a92eb56640cc

SHA1
9c5cb5b9adab1126d1f5b2c65b1c19e71a419c00

SHA256
601054c0de9a93ce8a493b389ccd64eb21d124c9cbbc55ad6be1a7a30a0baa07

SHA512
03450f81c4b710b2097a6dbf853b436b73771321a31f2afb8a98c8a6bb7b10b07df707022f56da3f9789b769bd292e376060a379af36f277170a72e972f93ba8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
151KB

MD5
9422a6c356c69cb3c228f08efda72444

SHA1
d631455c3481fee1e3246a1b1afaaac6474492f5

SHA256
56dcbe214227dba2449157813ff8d88f8d40e52343cae7daeeeebbd6d5ad2f7a

SHA512
c3f05093dded670780c9f6d140b8e278dc6c613242b4cf01fd00c1802c5c3bb734e3342b9c7ab30c3f685e763754665bed778106a0be3f6c1918d3eff77b72c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
6ecb8d6a661715db27ecc010132de274

SHA1
69edea36631c56ff0f76825260e3f2af23ac1947

SHA256
c4aa1033ae22863a71761350894d87dadba5e8b830b2a2a5823f443526aac6c1

SHA512
e8587665e734c811f8649d90972fb8a204fca73dbe936ec4f374becd95b521a218aef242a9346ecff5acf3a846748ae68166e6e48ff0ced47bcbd86d4c8c94dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5766b9.TMP

Filesize
96KB

MD5
0e3ddcdd796909d642aa669de947ac1e

SHA1
3db2afae6a9ae3de9ea9124bccbfd4ba7ab4aae0

SHA256
baf13bd27cec48a1dc22469d554b2760e89dc6ba52237b8a5ec7c8671afb51ab

SHA512
050112d4254f45f6838be0cee2caf081bd1ab89e2dc7376d33624884d16ed1f7f37303a8e91bf9aa784a212d156b3e2f441b2615acc0ce677e6d67db2a06128a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF12BB719B0AF51F38.TMP

Filesize
16KB

MD5
fa7673eb717699644e04ec8d18a19d88

SHA1
4d26615b1185e167480fbbca0c98b88712b9dbe1

SHA256
2d13ce779c856ba5d0c27bbe097bed6ebc0712d7cdffa790df9633dfbd56ed3d

SHA512
28f5d8dd79fd56332fc7cdbeebf329ef114cf70d597b232d47dbe7308335a86f0885a260f67b24d40a6c077a17961c2bfbe0e986365737c7ed4e4ab12193cf80

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response