ac7bf1cf5d4b2ec6de9bc3e5f4402df6d9d7ebe089cdcbbcf7be8a8995a56f1a

Resubmissions

03/08/2024, 06:58 UTC

240803-hrrvnawdnp 3

03/08/2024, 06:57 UTC

240803-hqwr8awdml 3

03/08/2024, 06:54 UTC

240803-hpl7ds1apd 3

03/08/2024, 06:51 UTC

240803-hm1a8swcrn 4

03/08/2024, 06:50 UTC

240803-hl7nxswcnq 4

03/08/2024, 06:39 UTC

240803-hezdzawbmq 7

03/08/2024, 06:36 UTC

240803-hcza7azhje 7

Analysis

max time kernel
1799s
max time network
1801s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 06:39 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c-realV2.exe
Size

9.8MB
MD5

cf88f81270f9a6abb71bdfacb7c5fc96
SHA1

6a99eb6f3b0b266136f86f81070afe8df4622615
SHA256

ac7bf1cf5d4b2ec6de9bc3e5f4402df6d9d7ebe089cdcbbcf7be8a8995a56f1a
SHA512

6657b2eab3d2af4985d46ca7fc78c92d1cc9a3913b2bbb0182dcd13702e9e58abac7273727afca031bb826f8e9e99c2e881ff7cfe1b0bdd2b9e7b68a04ee9785
SSDEEP

196608:O2RuMeNj9iBqRsj41YWuJ8IcUeOYXOxfOsYk6dnvz16:0TUaYBJ8IcVO/xqdY

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 30 IoCs

pid	Process
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe
60	c-realV2.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023475-32.dat	upx
behavioral2/memory/60-36-0x00007FFACF4F0000-0x00007FFACFAD9000-memory.dmp	upx
behavioral2/files/0x0007000000023470-40.dat	upx
behavioral2/files/0x000700000002345b-39.dat	upx
behavioral2/files/0x000700000002345a-45.dat	upx
behavioral2/memory/60-43-0x00007FFAE49E0000-0x00007FFAE49EF000-memory.dmp	upx
behavioral2/memory/60-42-0x00007FFAE2280000-0x00007FFAE22A4000-memory.dmp	upx
behavioral2/files/0x000700000002345e-47.dat	upx
behavioral2/memory/60-49-0x00007FFADE7F0000-0x00007FFADE81D000-memory.dmp	upx
behavioral2/memory/60-48-0x00007FFAE4870000-0x00007FFAE4889000-memory.dmp	upx
behavioral2/files/0x0007000000023462-50.dat	upx
behavioral2/files/0x0007000000023476-54.dat	upx
behavioral2/memory/60-55-0x00007FFAE34B0000-0x00007FFAE34BD000-memory.dmp	upx
behavioral2/files/0x0007000000023474-57.dat	upx
behavioral2/memory/60-58-0x00007FFADE660000-0x00007FFADE695000-memory.dmp	upx
behavioral2/memory/60-53-0x00007FFAE2FC0000-0x00007FFAE2FD9000-memory.dmp	upx
behavioral2/files/0x0007000000023461-59.dat	upx
behavioral2/memory/60-61-0x00007FFAE3180000-0x00007FFAE318D000-memory.dmp	upx
behavioral2/files/0x0007000000023463-62.dat	upx
behavioral2/files/0x000700000002346f-64.dat	upx
behavioral2/memory/60-66-0x00007FFADE770000-0x00007FFADE79E000-memory.dmp	upx
behavioral2/files/0x0007000000023471-65.dat	upx
behavioral2/memory/60-68-0x00007FFADDC20000-0x00007FFADDCD8000-memory.dmp	upx
behavioral2/memory/60-72-0x00007FFACF170000-0x00007FFACF4E5000-memory.dmp	upx
behavioral2/files/0x0007000000023459-74.dat	upx
behavioral2/files/0x0007000000023473-79.dat	upx
behavioral2/files/0x0007000000023460-78.dat	upx
behavioral2/files/0x000700000002345d-81.dat	upx
behavioral2/memory/60-88-0x00007FFADDC00000-0x00007FFADDC14000-memory.dmp	upx
behavioral2/memory/60-87-0x00007FFADE620000-0x00007FFADE634000-memory.dmp	upx
behavioral2/memory/60-86-0x00007FFADE640000-0x00007FFADE652000-memory.dmp	upx
behavioral2/memory/60-85-0x00007FFAE49E0000-0x00007FFAE49EF000-memory.dmp	upx
behavioral2/memory/60-84-0x00007FFAE2280000-0x00007FFAE22A4000-memory.dmp	upx
behavioral2/memory/60-77-0x00007FFAE1FC0000-0x00007FFAE1FD5000-memory.dmp	upx
behavioral2/memory/60-76-0x00007FFACF4F0000-0x00007FFACFAD9000-memory.dmp	upx
behavioral2/files/0x0007000000023479-83.dat	upx
behavioral2/memory/60-94-0x00007FFADD060000-0x00007FFADD07B000-memory.dmp	upx
behavioral2/memory/60-93-0x00007FFACF050000-0x00007FFACF16C000-memory.dmp	upx
behavioral2/files/0x0007000000023466-96.dat	upx
behavioral2/files/0x0007000000023467-99.dat	upx
behavioral2/files/0x0007000000023469-103.dat	upx
behavioral2/files/0x0007000000023464-109.dat	upx
behavioral2/files/0x000700000002346e-114.dat	upx
behavioral2/memory/60-119-0x00007FFADA5C0000-0x00007FFADA5D6000-memory.dmp	upx
behavioral2/memory/60-118-0x00007FFAD8EE0000-0x00007FFAD8F04000-memory.dmp	upx
behavioral2/memory/60-117-0x00007FFAE1F10000-0x00007FFAE1F1B000-memory.dmp	upx
behavioral2/memory/60-116-0x00007FFAE1F60000-0x00007FFAE1F6A000-memory.dmp	upx
behavioral2/files/0x000700000002346c-113.dat	upx
behavioral2/files/0x000700000002346b-111.dat	upx
behavioral2/memory/60-108-0x00007FFAE2270000-0x00007FFAE227E000-memory.dmp	upx
behavioral2/memory/60-107-0x00007FFADA5E0000-0x00007FFADA61E000-memory.dmp	upx
behavioral2/memory/60-106-0x00007FFADA620000-0x00007FFADA635000-memory.dmp	upx
behavioral2/memory/60-105-0x00007FFADD040000-0x00007FFADD052000-memory.dmp	upx
behavioral2/memory/60-102-0x00007FFAE2FC0000-0x00007FFAE2FD9000-memory.dmp	upx
behavioral2/files/0x0007000000023468-98.dat	upx
behavioral2/memory/60-92-0x00007FFADE7F0000-0x00007FFADE81D000-memory.dmp	upx
behavioral2/files/0x000700000002347b-91.dat	upx
behavioral2/files/0x000700000002345c-120.dat	upx
behavioral2/memory/60-122-0x00007FFACF000000-0x00007FFACF043000-memory.dmp	upx
behavioral2/files/0x0007000000023478-123.dat	upx
behavioral2/memory/60-126-0x00007FFAD55C0000-0x00007FFAD55D2000-memory.dmp	upx
behavioral2/memory/60-125-0x00007FFADE770000-0x00007FFADE79E000-memory.dmp	upx
behavioral2/memory/60-127-0x00007FFADDC20000-0x00007FFADDCD8000-memory.dmp	upx
behavioral2/memory/60-129-0x00007FFACF170000-0x00007FFACF4E5000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
18	discord.com
16	discord.com
17	discord.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{E42B531A-4F5D-42A3-8098-7A3E13AC1121}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
572	chrome.exe
572	chrome.exe
344	chrome.exe
344	chrome.exe
344	chrome.exe
344	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 60	2516	c-realV2.exe	83
PID 2516 wrote to memory of 60	2516	c-realV2.exe	83
PID 60 wrote to memory of 4980	60	c-realV2.exe	87
PID 60 wrote to memory of 4980	60	c-realV2.exe	87
PID 572 wrote to memory of 4588	572	chrome.exe	98
PID 572 wrote to memory of 4588	572	chrome.exe	98
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 4420	572	chrome.exe	99
PID 572 wrote to memory of 5004	572	chrome.exe	100
PID 572 wrote to memory of 5004	572	chrome.exe	100
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101
PID 572 wrote to memory of 4444	572	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\c-realV2.exe
"C:\Users\Admin\AppData\Local\Temp\c-realV2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\c-realV2.exe
  "C:\Users\Admin\AppData\Local\Temp\c-realV2.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaddd9cc40,0x7ffaddd9cc4c,0x7ffaddd9cc58
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2184,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2252 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3296,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4632,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4908,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5036,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5224,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3180,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4088 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5516,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1524,i,16455567029954812923,2299026648248221900,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1560

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x52c 0x3e0
1⤵
PID:680

Network

DNS

0.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.159.190.20.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

19.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.229.111.52.in-addr.arpa

IN PTR

Response
DNS

discord.com

c-realV2.exe

Remote address:

8.8.8.8:53

Request

discord.com

IN A

Response

discord.com

IN A

162.159.128.233

discord.com

IN A

162.159.136.232

discord.com

IN A

162.159.137.232

discord.com

IN A

162.159.138.232

discord.com

IN A

162.159.135.232
DNS

233.128.159.162.in-addr.arpa

Remote address:

8.8.8.8:53

Request

233.128.159.162.in-addr.arpa

IN PTR

Response
DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.27.105

www.google.com

IN A

142.250.27.106

www.google.com

IN A

142.250.27.99

www.google.com

IN A

142.250.27.147

www.google.com

IN A

142.250.27.103

www.google.com

IN A

142.250.27.104
GET

https://www.google.com/async/ddljson?async=ntp:2

chrome.exe

Remote address:

142.250.27.105:443

Request

GET /async/ddljson?async=ntp:2 HTTP/2.0
host: www.google.com
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
DNS

chrome.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

chrome.google.com

IN A

Response

chrome.google.com

IN CNAME

www3.l.google.com

www3.l.google.com

IN A

142.250.27.138

www3.l.google.com

IN A

142.250.27.139

www3.l.google.com

IN A

142.250.27.102

www3.l.google.com

IN A

142.250.27.101

www3.l.google.com

IN A

142.250.27.100

www3.l.google.com

IN A

142.250.27.113
DNS

95.27.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.27.250.142.in-addr.arpa

IN PTR

Response

95.27.250.142.in-addr.arpa

IN PTR

ra-in-f951e100net
DNS

105.27.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

105.27.250.142.in-addr.arpa

IN PTR

Response

105.27.250.142.in-addr.arpa

IN PTR

ra-in-f1051e100net
DNS

94.27.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

94.27.250.142.in-addr.arpa

IN PTR

Response

94.27.250.142.in-addr.arpa

IN PTR

ra-in-f941e100net
DNS

138.27.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

138.27.250.142.in-addr.arpa

IN PTR

Response

138.27.250.142.in-addr.arpa

IN PTR

ra-in-f1381e100net
DNS

clients2.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

clients2.google.com

IN A

Response

clients2.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

142.250.102.113

clients.l.google.com

IN A

142.250.102.102

clients.l.google.com

IN A

142.250.102.101

clients.l.google.com

IN A

142.250.102.139

clients.l.google.com

IN A

142.250.102.100

clients.l.google.com

IN A

142.250.102.138
DNS

113.102.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

113.102.250.142.in-addr.arpa

IN PTR

Response

113.102.250.142.in-addr.arpa

IN PTR

rb-in-f1131e100net
DNS

now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

now.gg

IN A

Response

now.gg

IN A

18.244.114.96

now.gg

IN A

18.244.114.85

now.gg

IN A

18.244.114.51

now.gg

IN A

18.244.114.57
GET

https://now.gg/

chrome.exe

Remote address:

18.244.114.96:443

Request

GET / HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/html; charset=utf-8
server: CloudFront
date: Fri, 02 Aug 2024 12:18:14 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: max-age=604800
origin-trial: AnZYFOsfreeMD0ml/3zFaVI5Jh3B7kQia8/LotRxe/DUrBj57t+97KLIYGBHrfnhMwJ0PRVqdQdOJiqqhKphsQ0AAABweyJvcmlnaW4iOiJodHRwczovL25vdy5nZzo0NDMiLCJmZWF0dXJlIjoiVW5yZXN0cmljdGVkU2hhcmVkQXJyYXlCdWZmZXIiLCJleHBpcnkiOjE3Mzk5MjMxOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
etag: W/"49h076asd29kcv"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: f4La_xGz85cC2J9EaY6ETYy0WXgD_HX5lSssV6EPzn5w3AXCZH2AGQ==
age: 67361
GET

https://now.gg/3/play/assets/_next/static/media/black-bg.6fdd970d.jpg

chrome.exe

Remote address:

18.244.114.96:443

Request

GET /3/play/assets/_next/static/media/black-bg.6fdd970d.jpg HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/jpeg
content-length: 5956
date: Fri, 02 Aug 2024 12:14:56 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
last-modified: Fri, 02 Aug 2024 11:25:59 GMT
etag: W/"1744-19112d6e558"
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 2xcHMgBDNNlByA_Zv0nttz9ODCiQMGKCxte_ZX9Tc4PlN_jWKL5P1g==
age: 67559
GET

https://now.gg/3/play/assets/_next/static/css/styles.7933200532079b88.css

chrome.exe

Remote address:

18.244.114.96:443

Request

GET /3/play/assets/_next/static/css/styles.7933200532079b88.css HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/css; charset=UTF-8
date: Fri, 02 Aug 2024 12:15:08 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: public, max-age=31536000, immutable
last-modified: Fri, 02 Aug 2024 11:26:53 GMT
etag: W/"75fb-19112d7b848"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: JPBo2f8SLHN6lrpeOBj8mMhXV1f4Wp5DA52t5ytdE7zd5CToGC1PzA==
age: 67547
GET

https://now.gg/3/play/assets/_next/static/chunks/6268.fb5d7e6dd3c32816.js

chrome.exe

Remote address:

18.244.114.96:443

Request

GET /3/play/assets/_next/static/chunks/6268.fb5d7e6dd3c32816.js HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=UTF-8
date: Fri, 02 Aug 2024 12:15:15 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: public, max-age=31536000, immutable
last-modified: Fri, 02 Aug 2024 11:26:53 GMT
etag: W/"26d6-19112d7b848"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: So1EYWv4A4W_aoBYfR236rJBiz-6QVYYNh6AK9UfT_vYDwpkpEc4bg==
age: 67540
GET

https://now.gg/3/play/assets/_next/static/chunks/8548.06dc7014a53564fc.js

chrome.exe

Remote address:

18.244.114.96:443

Request

GET /3/play/assets/_next/static/chunks/8548.06dc7014a53564fc.js HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=UTF-8
date: Fri, 02 Aug 2024 12:15:15 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: public, max-age=31536000, immutable
last-modified: Fri, 02 Aug 2024 11:26:53 GMT
etag: W/"1f04-19112d7b848"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: f_UOztUxFXUAj30HkEfLvH81IVqOUIJ8yRc4TJwMQmurkwq5QRtyjg==
age: 67540
GET

https://now.gg/3/play/assets/_next/static/chunks/2850.1190c88965fb9d50.js

chrome.exe

Remote address:

18.244.114.96:443

Request

GET /3/play/assets/_next/static/chunks/2850.1190c88965fb9d50.js HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=UTF-8
date: Fri, 02 Aug 2024 12:15:47 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: public, max-age=31536000, immutable
last-modified: Fri, 02 Aug 2024 11:26:53 GMT
etag: W/"c3d-19112d7b848"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: mpaJ6a79vol_hvTfpwXOuV_420TadzW6JrruFsXd4kXyyfDxRdZDlQ==
age: 67508
GET

https://now.gg/3/play/assets/_next/static/chunks/webpack-3698ef9b81f29d93.js

chrome.exe

Remote address:

18.244.114.96:443

Request

GET /3/play/assets/_next/static/chunks/webpack-3698ef9b81f29d93.js HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=UTF-8
date: Fri, 02 Aug 2024 12:14:57 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: public, max-age=31536000, immutable
last-modified: Fri, 02 Aug 2024 11:26:53 GMT
etag: W/"17a5-19112d7b848"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: aik0tHaK1Srsyf6_SCxUbu82iQsuZyCUtwO5ctGdEoxKXWGfb4KMyQ==
age: 67558
GET

https://now.gg/3/play/assets/_next/static/chunks/main-dfef43da2d4fd3f3.js

chrome.exe

Remote address:

18.244.114.96:443

Request

GET /3/play/assets/_next/static/chunks/main-dfef43da2d4fd3f3.js HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=UTF-8
date: Fri, 02 Aug 2024 12:15:09 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: public, max-age=31536000, immutable
last-modified: Fri, 02 Aug 2024 11:26:53 GMT
etag: W/"40ccb-19112d7b848"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 8RUcBvhP_e0edGaRp9CgHxyatz0wlqdjoLhd-kmltFCGQV5F1vEDWg==
age: 67546
GET

https://now.gg/3/play/assets/_next/static/chunks/pages/_app-e072317cf5e05e4d.js

chrome.exe

Remote address:

18.244.114.96:443

Request

GET /3/play/assets/_next/static/chunks/pages/_app-e072317cf5e05e4d.js HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=UTF-8
date: Fri, 02 Aug 2024 12:14:57 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: public, max-age=31536000, immutable
last-modified: Fri, 02 Aug 2024 11:26:53 GMT
etag: W/"7bca3-19112d7b848"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: ZYDaOO_BGAAB5xR3WXWJq5EZaU30m4qjPpcxfrHWdkMjeCvN87MtyA==
age: 67558
GET

https://now.gg/3/play/assets/_next/static/chunks/pages/browse-9650215236fd3cac.js

chrome.exe

Remote address:

18.244.114.96:443

Request

GET /3/play/assets/_next/static/chunks/pages/browse-9650215236fd3cac.js HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=UTF-8
date: Fri, 02 Aug 2024 12:15:16 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: public, max-age=31536000, immutable
last-modified: Fri, 02 Aug 2024 11:26:53 GMT
etag: W/"c0e91-19112d7b848"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: fZbu3e3xeWHgp7mrwPJO9EqSXz6sJRbDJdepZlsOsJaieTKJ4z_MRA==
age: 67539
GET

https://now.gg/3/play/assets/_next/static/xx2ZqFjMNFpI9ABwUOmr9/_buildManifest.js

chrome.exe

Remote address:

18.244.114.96:443

Request

GET /3/play/assets/_next/static/xx2ZqFjMNFpI9ABwUOmr9/_buildManifest.js HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=UTF-8
date: Fri, 02 Aug 2024 12:14:57 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: public, max-age=31536000, immutable
last-modified: Fri, 02 Aug 2024 11:26:53 GMT
etag: W/"742-19112d7b848"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: HBUtcFDs8HQUXfp6tMcLopaRgfz170zFShGdsScCqvE6bhHghXx50Q==
age: 67558
GET

https://now.gg/3/play/assets/_next/static/xx2ZqFjMNFpI9ABwUOmr9/_ssgManifest.js

chrome.exe

Remote address:

18.244.114.96:443

Request

GET /3/play/assets/_next/static/xx2ZqFjMNFpI9ABwUOmr9/_ssgManifest.js HTTP/2.0
host: now.gg
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=UTF-8
content-length: 77
date: Fri, 02 Aug 2024 12:14:57 GMT
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
last-modified: Fri, 02 Aug 2024 11:26:53 GMT
etag: W/"4d-19112d7b848"
x-cache: Hit from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 5RMU1oiA9n3-DRhyVMZm54JuWiJFlcATewf8OYt62sKYHqhSVXXkxQ==
age: 67558
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:03:43 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: RaD6yXqcIi9CLvkY0CmzGQnsdGa5jh1dpGC7kXXHbU3H-ItYEOSX_w==
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:04:43 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: c6AzpnLMatsExlk_PzNHL5c4Y8mXdLiviAp3SUM5h7Y5hz_izEklPw==
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:05:13 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: sYBrlIzzsZHsAAgygVE_xVPMXjmN7txVVRYPT9BWQY2HDBZJqAbjqQ==
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:06:13 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: lWcHpZxS8bHFiRz8Btu-5xmRyFOaW6fqWQnxco5_3Dbb1sQ_Ee_QlQ==
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:06:43 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: VBSiqd6r_nl1REMhiEEKVDFe5QT4ied0H8DnW-272SWzwC8VNzeNZQ==
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:07:13 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: TfNAmJLaeN5Om2ogtsJY6R-K6QenWoPIz_4sHo7M0CKEXa2ljHb4Ow==
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:07:43 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: JvP9GaQB2KdzN08BfcKElxOP7hUcpwvJxzUWasGT9-OP-qIAKDp8xA==
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:08:13 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 3--JFpY_H4lWJ9aJdkfBnNA-51aT2uq4vHPwhj8zZRKnFOicPbSi8Q==
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:08:43 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 2H0QQbsGM1YlEU7coblgtivQ-lmpWiJvpSGM7i69PdBveHYuoxhYhA==
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:09:13 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 4v0dUM1i9qC5yN9aVFNULcKwo6RawE78l3XnXfy7EIQqS9xpofFl8Q==
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:09:43 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 0VgBJYlC5FWgYf_VLEjbkkPN0n8i5u41ma76vrl-BYFDoYnqX4zc9Q==
POST

https://now.gg/oapi/3/play/v1/reportEvent

chrome.exe

Remote address:

18.244.114.96:443

Request

POST /oapi/3/play/v1/reportEvent HTTP/2.0
host: now.gg
content-length: 1400
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
x-ngg-skip-evar-check: true
sec-ch-ua-mobile: ?0
x-ngg-fe-version: berlin-v1.34.410-arm.3
authorization: NowV2 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL25vdy5nZyIsInRva2VuSWQiOiI5ZWU0MDY0Yi1kNjE3LTRkNjktYTlhZS1mOWJkMjkzNmNmZDgiLCJhdWQiOiJ6QkMxTENzN3M3SXVaenhRUDlvTyQkMDFGTTlWWVdNU1dSNlNQNDJRNFM0NlowU1kiLCJzZXNzaW9uSWQiOiJzZEZYR3RYbTF0REhpYmN6c2UxM3UiLCJ1c2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImlzR3Vlc3RVc2VyIjp0cnVlLCJhdXRoUHJvdmlkZXJUeXBlIjoibm93Z2ciLCJzY29wZSI6ImVtYWlsLG5vd3BsYXkscHJvZmlsZSx2aWRlb3MiLCJpYXQiOjE3MjI2Njg0NzMsImV4cCI6MTcyMjY3OTI3M30.OH1J8qXHLx6nv7PHdmcLQLxPYXxnMTfu472eTTi-nsmGve6NJclSBvPr67fmQlA6T-xD61HQ53rWV7DRrSRD8ztvnN3TSa5904UmwqhAr6cX_VBRmyh7nrGRr-QaYs8vyeOd1RVN-0b8q6d4sGjxoLKIKKbUyvVZWlv8JFS3wY1FHtmqF7nLouqtqXDfzotTKsNKDYOiIUVNb69QHl4tJqp1RqoDqXbEtQxDSLcPVCd60repZcR2vSGM7CRHv-r0rXiMW12OOEACqm-YjzeEYuyylnPt3-ynqglulYuGTn8JZcMcAUBzfd2ImY6L5_0TEDA5sy7d_YpXZsVQV4aZc4af77hLQ4jdUTTq3z4kVYfsm-6VoLeewafybXFn7615PzF3P5z7QNBJBGRxZTj1XWHgKlPNFQvMMYRfsVI70zhcoN7B-rFkeim_6v_OheX88ZbK6o1kvL2rU4xr1qxjeEay1UrK4XGV1-gC8sLGEj7uCBsifOCDb3kCzDe86oDPCRsrIxHvDQ09581MkzTfqMlItbfjSn0RhF0dzlsi3yWfGGyYRj-kpiYSq7A67Pd4iNu_4VnkdDdLY9OfdsAtcCQrUwme80oZijUMBjSzRSZ_UtYY9J20OedAgyUT6-N9Pm40n45HEbnSZ0e36i2VM02g8aXFFsitXJr2Bs6_9MM
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
x-ngg-playuser-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGF5VXNlcklkIjoicGxheS11c2VyLXU4bFRjNjcyRzc1RVBHcjRRbGlBcyIsImF1dGhVc2VySWQiOiIwMUo0QkdONk0zRUg4QzQ2RDRYU1JFUUM4MCIsImF1dGhUeXBlIjoiTm93IiwidXNlclR5cGUiOiJHdWVzdCIsImlhdCI6MTcyMjY2ODQ3MywiZXhwIjoxNzU0MjI2MDczfQ.CCr3pAUabr3xB_WclZxeneD8LNO5CS7gTzhp6GCv9rk
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/apps/roblox-corporation/5349/roblox.html
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: usprivacy=1N--
cookie: euconsent-v2=CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA
cookie: addtl_consent=1~
cookie: _ga=GA1.1.1655543314.1722668459
cookie: cw-test-20231114-dynamic-floors-final=1.45
cookie: cw-test-20240725-basewrapper-test-10-90=test
cookie: cw-test-20231016-prebid-timeout=1000
cookie: cw-test-20240715-multiformat-25=control
cookie: cw-test-20240617-elemvieport-20=control
cookie: panoramaId_expiry=1722754906149
cookie: _hjSessionUser_848438=eyJpZCI6IjZmYTA5MWRmLWZmMzYtNTliNy05ZmZlLTE0NzUyYjg1NjAyNiIsImNyZWF0ZWQiOjE3MjI2Njg1MDU1ODQsImV4aXN0aW5nIjpmYWxzZX0=
cookie: _hjHasCachedUserAttributes=true
cookie: _hjSession_848438=eyJpZCI6IjJlNGNiMmZlLWQ0NjgtNDM0Ny05MjE3LWU4ZjU1YjhiZGFhMiIsImMiOjE3MjI2Njg1MDU1ODUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
cookie: _ga_8VVPTD9ZTY=GS1.1.1722668459.1.1.1722668524.0.0.0

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-length: 20
date: Sat, 03 Aug 2024 07:10:13 GMT
x-cache: Miss from cloudfront
via: 1.1 fcb7e2ea03344c5cbdb3ce71f1ffa1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: o0t6bHVv1yg6iP3IpvW6ehvLuRowk9l3JkvZ1hKeDTVV3a7NQuc_1A==
DNS

cdn.now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.now.gg

IN A

Response

cdn.now.gg

IN CNAME

cdn.now.gg.akamaized.net

cdn.now.gg.akamaized.net

IN CNAME

a1184.dscd.akamai.net

a1184.dscd.akamai.net

IN A

92.123.142.145

a1184.dscd.akamai.net

IN A

92.123.142.67
GET

https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.game.nfs14_row%2Ficon%2Fneed-for-speed-no-limits.png&w=128&q=90

chrome.exe

Remote address:

92.123.142.145:443

Request

GET /assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.game.nfs14_row%2Ficon%2Fneed-for-speed-no-limits.png&w=128&q=90 HTTP/1.1
Host: cdn.now.gg
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://now.gg/
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: image/webp
Content-Length: 5144
content-disposition: inline; filename="need-for-speed-no-limits.webp"
Content-Security-Policy: script-src 'none'; frame-src 'none'; sandbox;
ETag: n00GyuFLTQpqI9j-1ffmOVdrhj5bMPOPbNYtkQA9ej0=
x-nextjs-cache: MISS
cross-origin-resource-policy: cross-origin
Cache-Control: public, must-revalidate, max-age=745
Date: Sat, 03 Aug 2024 07:00:56 GMT
Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Connection: keep-alive
X-Forward-Proto: http
CDN-Origin-Protocol: HTTP
GET

https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.gp.fifamobile%2Ficon%2Fea-sports-fc-mobile-24-soccer.png&w=128&q=90

chrome.exe

Remote address:

92.123.142.145:443

Request

GET /assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.gp.fifamobile%2Ficon%2Fea-sports-fc-mobile-24-soccer.png&w=128&q=90 HTTP/1.1
Host: cdn.now.gg
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://now.gg/
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: image/webp
Content-Length: 5854
content-disposition: inline; filename="ea-sports-fc-mobile-24-soccer.webp"
Content-Security-Policy: script-src 'none'; frame-src 'none'; sandbox;
ETag: ogxTg-EJ9dHQ0P9PfR6n-lcoJmjdCscgIpaBb-35X80=
x-nextjs-cache: MISS
cross-origin-resource-policy: cross-origin
Cache-Control: public, must-revalidate, max-age=2791
Date: Sat, 03 Aug 2024 07:00:56 GMT
Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Connection: keep-alive
X-Forward-Proto: http
CDN-Origin-Protocol: HTTP
GET

https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.gp.maddennfl21mobile%2Ficon%2Fmadden-nfl-24-mobile-football.png&w=128&q=90

chrome.exe

Remote address:

92.123.142.145:443

Request

GET /assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.gp.maddennfl21mobile%2Ficon%2Fmadden-nfl-24-mobile-football.png&w=128&q=90 HTTP/1.1
Host: cdn.now.gg
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://now.gg/
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: image/webp
Content-Length: 6678
content-disposition: inline; filename="madden-nfl-24-mobile-football.webp"
Content-Security-Policy: script-src 'none'; frame-src 'none'; sandbox;
ETag: SlsyiwvyfCCe18GkuYIee8p5-lroMPU+kn5ECg4BtUo=
x-nextjs-cache: MISS
cross-origin-resource-policy: cross-origin
Cache-Control: public, must-revalidate, max-age=467
Date: Sat, 03 Aug 2024 07:00:56 GMT
Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Connection: keep-alive
X-Forward-Proto: http
CDN-Origin-Protocol: HTTP
GET

https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2F8823%2Ficon%2Fgrand-auto-sandbox.png&w=128&q=90

chrome.exe

Remote address:

92.123.142.145:443

Request

GET /assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2F8823%2Ficon%2Fgrand-auto-sandbox.png&w=128&q=90 HTTP/1.1
Host: cdn.now.gg
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://now.gg/
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: image/webp
Content-Length: 7120
content-disposition: inline; filename="grand-auto-sandbox.webp"
Content-Security-Policy: script-src 'none'; frame-src 'none'; sandbox;
ETag: bF-PpEpnOEn3Hmm5eOFGQNAJArborcH1ItYTY8sUZJA=
x-nextjs-cache: MISS
cross-origin-resource-policy: cross-origin
Cache-Control: public, must-revalidate, max-age=2626
Date: Sat, 03 Aug 2024 07:00:56 GMT
Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Connection: keep-alive
X-Forward-Proto: http
CDN-Origin-Protocol: HTTP
GET

https://cdn.now.gg/nowgg-static/social/tiktok.svg

chrome.exe

Remote address:

92.123.142.145:443

Request

GET /nowgg-static/social/tiktok.svg HTTP/1.1
Host: cdn.now.gg
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://now.gg/
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

x-amz-id-2: zRqavn9ANjxUlCsAmuTc63ZCMS2l575VgYAxUdUVEwG3iuXZ25ixB3Rx8YonyLtAIqTlgsY8gl0=
x-amz-request-id: Z91V9XGBR4JKTVT6
Last-Modified: Wed, 06 Sep 2023 11:32:48 GMT
ETag: "24987da44ef707b8b15f2f2a7969e11b"
x-amz-server-side-encryption: AES256
x-amz-version-id: GQQXYOSRnYi0X6zw9.w0XaxnrK5PqPK0
Accept-Ranges: bytes
Content-Type: image/svg+xml
Server: AmazonS3
Content-Length: 2395
cross-origin-resource-policy: cross-origin
Cache-Control: max-age=113757
Date: Sat, 03 Aug 2024 07:00:56 GMT
Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Connection: keep-alive
GET

https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.weaver.app.prod%2Ficon%2Ftalkie-soulful-ai.png&w=128&q=90

chrome.exe

Remote address:

92.123.142.145:443

Request

GET /assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.weaver.app.prod%2Ficon%2Ftalkie-soulful-ai.png&w=128&q=90 HTTP/1.1
Host: cdn.now.gg
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://now.gg/
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: image/webp
Content-Length: 7224
content-disposition: inline; filename="talkie-soulful-ai.webp"
Content-Security-Policy: script-src 'none'; frame-src 'none'; sandbox;
ETag: 1wQRlPm4Hj9JHYcr9Zylz1GGdwF-p9ZYgP5xPX28JLc=
x-nextjs-cache: MISS
cross-origin-resource-policy: cross-origin
Cache-Control: public, must-revalidate, max-age=2249
Date: Sat, 03 Aug 2024 07:00:56 GMT
Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Connection: keep-alive
X-Forward-Proto: http
CDN-Origin-Protocol: HTTP
DNS

cmp.inmobi.com

chrome.exe

Remote address:

8.8.8.8:53

Request

cmp.inmobi.com

IN A

Response

cmp.inmobi.com

IN CNAME

cmp-prod.inmobi-choice.io

cmp-prod.inmobi-choice.io

IN CNAME

d23sp3kzv1t6m5.cloudfront.net

d23sp3kzv1t6m5.cloudfront.net

IN A

18.244.114.102

d23sp3kzv1t6m5.cloudfront.net

IN A

18.244.114.32

d23sp3kzv1t6m5.cloudfront.net

IN A

18.244.114.118

d23sp3kzv1t6m5.cloudfront.net

IN A

18.244.114.17
DNS

sessions.bugsnag.com

chrome.exe

Remote address:

8.8.8.8:53

Request

sessions.bugsnag.com

IN A

Response

sessions.bugsnag.com

IN A

35.190.88.7
GET

https://cmp.inmobi.com/choice/mw9xJtqPQGFbC/now.gg/choice.js?tag_version=V3

chrome.exe

Remote address:

18.244.114.102:443

Request

GET /choice/mw9xJtqPQGFbC/now.gg/choice.js?tag_version=V3 HTTP/2.0
host: cmp.inmobi.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript
last-modified: Tue, 04 Jun 2024 07:31:58 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
cross-origin-resource-policy: cross-origin
content-encoding: br
cache-control: max-age=900
date: Sat, 03 Aug 2024 07:00:48 GMT
etag: W/"7830592fbbf1137cb83818d89af71c19"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 cd9d9141cd83dabdc9d0a421d1efe1aa.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
x-amz-cf-id: UKukLG9bPiuobRDS4VLyovexEJYRZ1gpngVzic5iXwlm43uxfU5KFg==
age: 9
GET

https://cmp.inmobi.com/tcfv2/53/cmp2.js?referer=now.gg

chrome.exe

Remote address:

18.244.114.102:443

Request

GET /tcfv2/53/cmp2.js?referer=now.gg HTTP/2.0
host: cmp.inmobi.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/javascript;charset=UTF-8
access-control-max-age: 86400
cache-control: max-age=172800
date: Thu, 01 Aug 2024 10:42:07 GMT
last-modified: Mon, 03 Jun 2024 09:45:41 GMT
etag: W/"db6c513b7a9d1bf38b36047c185655a2"
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-server-side-encryption: AES256
x-amz-meta-qc-ineu: True
server: AmazonS3
access-control-allow-origin: *
access-control-allow-methods: GET
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 cd9d9141cd83dabdc9d0a421d1efe1aa.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
x-amz-cf-id: eAQmFWR5XAfiyNGvdj71zF7Adx32G-Ayg1k0kuEYY6PnHTgVRW-Pjw==
age: 159530
GET

https://cmp.inmobi.com/tcfv2/53/cmp2ui-en.js

chrome.exe

Remote address:

18.244.114.102:443

Request

GET /tcfv2/53/cmp2ui-en.js HTTP/2.0
host: cmp.inmobi.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/javascript;charset=UTF-8
access-control-max-age: 86400
cache-control: max-age=172800
date: Thu, 01 Aug 2024 10:42:07 GMT
last-modified: Mon, 03 Jun 2024 09:45:44 GMT
etag: W/"991fbc793ffbdf15116c0458b5a2027a"
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-server-side-encryption: AES256
server: AmazonS3
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
access-control-allow-methods: GET
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 cd9d9141cd83dabdc9d0a421d1efe1aa.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
x-amz-cf-id: XO8x2-T7BxsL9U7XybxROlp2ZtuI1zXnYYybC_Y8gfPxjaGutjcATg==
age: 159531
OPTIONS

https://sessions.bugsnag.com/

chrome.exe

Remote address:

35.190.88.7:443

Request

OPTIONS / HTTP/2.0
host: sessions.bugsnag.com
accept: */*
access-control-request-method: POST
access-control-request-headers: bugsnag-api-key,bugsnag-payload-version,bugsnag-sent-at,content-type
origin: https://now.gg
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
OPTIONS

https://sessions.bugsnag.com/

chrome.exe

Remote address:

35.190.88.7:443

Request

OPTIONS / HTTP/2.0
host: sessions.bugsnag.com
accept: */*
access-control-request-method: POST
access-control-request-headers: bugsnag-api-key,bugsnag-payload-version,bugsnag-sent-at,content-type
origin: https://now.gg
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
POST

https://sessions.bugsnag.com/

chrome.exe

Remote address:

35.190.88.7:443

Request

POST / HTTP/2.0
host: sessions.bugsnag.com
content-length: 515
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
bugsnag-api-key: 5409ce593426cf95bd284a5b809c62c5
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
bugsnag-payload-version: 1
bugsnag-sent-at: 2024-08-03T07:00:55.511Z
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
POST

https://sessions.bugsnag.com/

chrome.exe

Remote address:

35.190.88.7:443

Request

POST / HTTP/2.0
host: sessions.bugsnag.com
content-length: 515
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
bugsnag-api-key: 5409ce593426cf95bd284a5b809c62c5
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
bugsnag-payload-version: 1
bugsnag-sent-at: 2024-08-03T07:00:55.452Z
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
POST

https://sessions.bugsnag.com/

chrome.exe

Remote address:

35.190.88.7:443

Request

POST / HTTP/2.0
host: sessions.bugsnag.com
content-length: 0
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
DNS

content-autofill.googleapis.com

chrome.exe

Remote address:

8.8.8.8:53

Request

content-autofill.googleapis.com

IN A

Response

content-autofill.googleapis.com

IN A

142.250.102.95

content-autofill.googleapis.com

IN A

142.250.27.95
GET

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTIzLjAuNjMxMi4xMjMSGQkF4z3jqyy9UxIFDYS_YqQhpCXilIMByqk=?alt=proto

chrome.exe

Remote address:

142.250.102.95:443

Request

GET /v1/pages/ChVDaHJvbWUvMTIzLjAuNjMxMi4xMjMSGQkF4z3jqyy9UxIFDYS_YqQhpCXilIMByqk=?alt=proto HTTP/2.0
host: content-autofill.googleapis.com
x-goog-encode-response-if-executable: base64
x-goog-api-key: AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
x-client-data: CPCRywE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
GET

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTIzLjAuNjMxMi4xMjMSIAloo5A3dKdbOxIFDYS_YqQSBQ09BEhDITuWry7XPY8B?alt=proto

chrome.exe

Remote address:

142.250.102.95:443

Request

GET /v1/pages/ChVDaHJvbWUvMTIzLjAuNjMxMi4xMjMSIAloo5A3dKdbOxIFDYS_YqQSBQ09BEhDITuWry7XPY8B?alt=proto HTTP/2.0
host: content-autofill.googleapis.com
x-goog-encode-response-if-executable: base64
x-goog-api-key: AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
x-client-data: CPCRywE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
GET

https://cmp.inmobi.com/geoip

chrome.exe

Remote address:

18.244.114.102:443

Request

GET /geoip HTTP/2.0
host: cmp.inmobi.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept: application/json, text/plain, */*
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

server: CloudFront
date: Sat, 03 Aug 2024 07:00:56 GMT
content-type: application/json
content-length: 48
x-cache: FunctionGeneratedResponse from cloudfront
via: 1.1 941eeb52a9594aec5cf3464efa0a3b66.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
x-amz-cf-id: mXKg3jjMRzPJyzsZWvGFBIKc3EHB4EJCXANCMArzMumZt-mPdUxWfQ==
access-control-allow-origin: *
access-control-expose-headers: *
GET

https://cmp.inmobi.com/GVL-v2/cmp-list.json

chrome.exe

Remote address:

18.244.114.102:443

Request

GET /GVL-v2/cmp-list.json HTTP/2.0
host: cmp.inmobi.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept: application/json, text/plain, */*
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json
access-control-max-age: 3000
cache-control: max-age=172800
date: Sat, 03 Aug 2024 03:00:44 GMT
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-allow-credentials: true
last-modified: Sat, 03 Aug 2024 03:00:42 GMT
etag: W/"5f919c965dcc74eed3bb3290a78e3d6d"
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: br
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
x-cache: Hit from cloudfront
via: 1.1 941eeb52a9594aec5cf3464efa0a3b66.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
x-amz-cf-id: 75JitYrstNlj4X77WyEv1eebOg0V6DdjWKn5l3XHC992phqEwhGncw==
age: 14413
GET

https://cmp.inmobi.com/GVL-v3/vendor-list-trimmed-v1.json

chrome.exe

Remote address:

18.244.114.102:443

Request

GET /GVL-v3/vendor-list-trimmed-v1.json HTTP/2.0
host: cmp.inmobi.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json
access-control-max-age: 3000
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-allow-credentials: true
last-modified: Thu, 01 Aug 2024 23:59:21 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: br
cache-control: max-age=86400
date: Fri, 02 Aug 2024 23:59:24 GMT
etag: W/"4d39f93d0ea73c8f70e0902b2678e3ef"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 941eeb52a9594aec5cf3464efa0a3b66.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
x-amz-cf-id: J4SXCujnSew0vzmY6c3qI4PAjRQjOe5lBmRUFKckMrRlTv634LqiUA==
age: 25294
GET

https://cmp.inmobi.com/tcfv2/google-atp-list.json

chrome.exe

Remote address:

18.244.114.102:443

Request

GET /tcfv2/google-atp-list.json HTTP/2.0
host: cmp.inmobi.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept: application/json, text/plain, */*
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json
access-control-max-age: 3000
cache-control: max-age=172800
date: Sat, 03 Aug 2024 03:00:26 GMT
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-allow-credentials: true
last-modified: Sat, 03 Aug 2024 03:00:24 GMT
etag: W/"45346bb3fc2021d7a15bcb9f57659288"
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: br
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
x-cache: Hit from cloudfront
via: 1.1 941eeb52a9594aec5cf3464efa0a3b66.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
x-amz-cf-id: eSb27Dgf2aDk7cJwJZqNx8AxQ0fVuozpMNhEseO5slJtYku7YHYzYQ==
age: 14432
GET

https://cmp.inmobi.com/geoip

chrome.exe

Remote address:

18.244.114.102:443

Request

GET /geoip HTTP/2.0
host: cmp.inmobi.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept: application/json, text/plain, */*
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

server: CloudFront
date: Sat, 03 Aug 2024 07:00:57 GMT
content-type: application/json
content-length: 48
x-cache: FunctionGeneratedResponse from cloudfront
via: 1.1 941eeb52a9594aec5cf3464efa0a3b66.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
x-amz-cf-id: EdRZa31OufbAdPsk6ZKh8-mZN_nl3IWROzVsbF82RT8_8tWBMW182Q==
access-control-allow-origin: *
access-control-expose-headers: *
GET

https://cmp.inmobi.com/geoip

chrome.exe

Remote address:

18.244.114.102:443

Request

GET /geoip HTTP/2.0
host: cmp.inmobi.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept: application/json, text/plain, */*
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

server: CloudFront
date: Sat, 03 Aug 2024 07:01:13 GMT
content-type: application/json
content-length: 48
x-cache: FunctionGeneratedResponse from cloudfront
via: 1.1 941eeb52a9594aec5cf3464efa0a3b66.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P6
x-amz-cf-id: 32TbY57UP2eUgR6rlnLu-dl0_YLsLbNuq91F38788i7OKsf-cbxdUA==
access-control-allow-origin: *
access-control-expose-headers: *
DNS

96.114.244.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

96.114.244.18.in-addr.arpa

IN PTR

Response

96.114.244.18.in-addr.arpa

IN PTR

server-18-244-114-96lhr50r cloudfrontnet
DNS

145.142.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

145.142.123.92.in-addr.arpa

IN PTR

Response

145.142.123.92.in-addr.arpa

IN PTR

a92-123-142-145deploystaticakamaitechnologiescom
DNS

94.102.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

94.102.250.142.in-addr.arpa

IN PTR

Response

94.102.250.142.in-addr.arpa

IN PTR

rb-in-f941e100net
DNS

102.114.244.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

102.114.244.18.in-addr.arpa

IN PTR

Response

102.114.244.18.in-addr.arpa

IN PTR

server-18-244-114-102lhr50r cloudfrontnet
DNS

7.88.190.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

7.88.190.35.in-addr.arpa

IN PTR

Response

7.88.190.35.in-addr.arpa

IN PTR

78819035bcgoogleusercontentcom
DNS

95.102.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.102.250.142.in-addr.arpa

IN PTR

Response

95.102.250.142.in-addr.arpa

IN PTR

rb-in-f951e100net
DNS

api.cmp.inmobi.com

chrome.exe

Remote address:

8.8.8.8:53

Request

api.cmp.inmobi.com

IN A

Response

api.cmp.inmobi.com

IN CNAME

cmp-api-prod.inmobi-choice.io

cmp-api-prod.inmobi-choice.io

IN CNAME

choice-apis-prod-2120274730.eu-central-1.elb.amazonaws.com

choice-apis-prod-2120274730.eu-central-1.elb.amazonaws.com

IN A

3.78.104.71

choice-apis-prod-2120274730.eu-central-1.elb.amazonaws.com

IN A

52.57.223.191

choice-apis-prod-2120274730.eu-central-1.elb.amazonaws.com

IN A

3.127.100.137
GET

https://api.cmp.inmobi.com/?log=%7B%22accountId%22%3A%22mw9xJtqPQGFbC%22%2C%22domain%22%3A%22now.gg%22%2C%22publisher%22%3A%22now.gg%22%2C%22cmpId%22%3A10%2C%22cmpVersion%22%3A%222.53%22%2C%22displayType%22%3A%22tcfui%3Amandatory%22%2C%22configurationHashCode%22%3A%225Q58yPiqWzJ%2B%2BZWOMHrdIw%22%2C%22tagVersion%22%3A%22V3%22%2C%22gvlVersion%22%3A3%2C%22clientTimestamp%22%3A1722668456518%2C%22operationType%22%3A%22init%22%2C%22sessionId%22%3A%22GDPR-mu2k57jhovys56d23zuf%22%7D

chrome.exe

Remote address:

3.78.104.71:443

Request

GET /?log=%7B%22accountId%22%3A%22mw9xJtqPQGFbC%22%2C%22domain%22%3A%22now.gg%22%2C%22publisher%22%3A%22now.gg%22%2C%22cmpId%22%3A10%2C%22cmpVersion%22%3A%222.53%22%2C%22displayType%22%3A%22tcfui%3Amandatory%22%2C%22configurationHashCode%22%3A%225Q58yPiqWzJ%2B%2BZWOMHrdIw%22%2C%22tagVersion%22%3A%22V3%22%2C%22gvlVersion%22%3A3%2C%22clientTimestamp%22%3A1722668456518%2C%22operationType%22%3A%22init%22%2C%22sessionId%22%3A%22GDPR-mu2k57jhovys56d23zuf%22%7D HTTP/2.0
host: api.cmp.inmobi.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept: application/json, text/plain, */*
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:00:57 GMT
content-type: text/plain; charset=utf-8
content-length: 2
access-control-allow-origin: *
GET

https://api.cmp.inmobi.com/?log=%7B%22userEvents%22%3A%5B%7B%22clientTimestamp%22%3A1722668456518%2C%22event%22%3A%22startOnPage%3AGDPR_0%22%7D%2C%7B%22clientTimestamp%22%3A1722668458858%2C%22event%22%3A%22rejectAll%3Aclick%22%7D%5D%2C%22acceptanceState%22%3A%22Reject%22%2C%22objectionState%22%3A%22None%22%2C%22tcData%22%3A%22CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA%22%2C%22nonIabConsentData%22%3A%22%22%2C%22clientTimestamp%22%3A1722668458858%2C%22operationType%22%3A%22done%22%2C%22sessionId%22%3A%22GDPR-mu2k57jhovys56d23zuf%22%7D

chrome.exe

Remote address:

3.78.104.71:443

Request

GET /?log=%7B%22userEvents%22%3A%5B%7B%22clientTimestamp%22%3A1722668456518%2C%22event%22%3A%22startOnPage%3AGDPR_0%22%7D%2C%7B%22clientTimestamp%22%3A1722668458858%2C%22event%22%3A%22rejectAll%3Aclick%22%7D%5D%2C%22acceptanceState%22%3A%22Reject%22%2C%22objectionState%22%3A%22None%22%2C%22tcData%22%3A%22CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA%22%2C%22nonIabConsentData%22%3A%22%22%2C%22clientTimestamp%22%3A1722668458858%2C%22operationType%22%3A%22done%22%2C%22sessionId%22%3A%22GDPR-mu2k57jhovys56d23zuf%22%7D HTTP/2.0
host: api.cmp.inmobi.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept: application/json, text/plain, */*
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:00:59 GMT
content-type: text/plain; charset=utf-8
content-length: 2
access-control-allow-origin: *
DNS

accounts.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

accounts.google.com

IN A

Response

accounts.google.com

IN A

142.250.102.84
GET

https://accounts.google.com/gsi/client

chrome.exe

Remote address:

142.250.102.84:443

Request

GET /gsi/client HTTP/2.0
host: accounts.google.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
x-client-data: CPCRywE=
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
GET

https://accounts.google.com/gsi/style

chrome.exe

Remote address:

142.250.102.84:443

Request

GET /gsi/style HTTP/2.0
host: accounts.google.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: text/css,*/*;q=0.1
x-client-data: CPCRywE=
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
GET

https://accounts.google.com/gsi/status?client_id=543291291905-vss63ln3o2hklepv16rbdrddrp81ibju.apps.googleusercontent.com&as=30%2F0voJHVXZzZ%2FCP0Ge%2FGw&has_opted_out_fedcm=true

chrome.exe

Remote address:

142.250.102.84:443

Request

GET /gsi/status?client_id=543291291905-vss63ln3o2hklepv16rbdrddrp81ibju.apps.googleusercontent.com&as=30%2F0voJHVXZzZ%2FCP0Ge%2FGw&has_opted_out_fedcm=true HTTP/2.0
host: accounts.google.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
x-client-data: CPCRywE=
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
DNS

84.102.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

84.102.250.142.in-addr.arpa

IN PTR

Response

84.102.250.142.in-addr.arpa

IN PTR

rb-in-f841e100net
DNS

71.104.78.3.in-addr.arpa

Remote address:

8.8.8.8:53

Request

71.104.78.3.in-addr.arpa

IN PTR

Response

71.104.78.3.in-addr.arpa

IN PTR

ec2-3-78-104-71eu-central-1compute amazonawscom
DNS

97.27.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.27.250.142.in-addr.arpa

IN PTR

Response

97.27.250.142.in-addr.arpa

IN PTR

ra-in-f971e100net
DNS

region1.google-analytics.com

chrome.exe

Remote address:

8.8.8.8:53

Request

region1.google-analytics.com

IN A

Response

region1.google-analytics.com

IN A

216.239.34.36

region1.google-analytics.com

IN A

216.239.32.36
POST

https://region1.google-analytics.com/g/collect?v=2&tid=G-8VVPTD9ZTY&gtm=45je47v0v883457966za200&_p=1722668459165&gcs=G10-&gcd=13m3l3m3m5&npa=1&dma_cps=-&dma=1&tcfd=10a56&tag_exp=95250753&cid=1655543314.1722668459&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.123%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.123&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&frm=0&pscdl=denied&_s=1&sid=1722668459&sct=1&seg=0&dl=https%3A%2F%2Fnow.gg%2F&dt=Play%20Online%20Games%20for%20Free%20%7C%20now.gg%20Mobile%20Cloud&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=4138

chrome.exe

Remote address:

216.239.34.36:443

Request

POST /g/collect?v=2&tid=G-8VVPTD9ZTY&gtm=45je47v0v883457966za200&_p=1722668459165&gcs=G10-&gcd=13m3l3m3m5&npa=1&dma_cps=-&dma=1&tcfd=10a56&tag_exp=95250753&cid=1655543314.1722668459&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.123%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.123&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&frm=0&pscdl=denied&_s=1&sid=1722668459&sct=1&seg=0&dl=https%3A%2F%2Fnow.gg%2F&dt=Play%20Online%20Games%20for%20Free%20%7C%20now.gg%20Mobile%20Cloud&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=4138 HTTP/2.0
host: region1.google-analytics.com
content-length: 0
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
POST

https://region1.google-analytics.com/g/collect?v=2&tid=G-8VVPTD9ZTY&gtm=45je47v0v883457966za200&_p=1722668459165&gcs=G10-&gcd=13m3l3m3m5&npa=1&dma_cps=-&dma=1&tcfd=10a56&tag_exp=95250753&cid=1655543314.1722668459&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.123%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.123&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&frm=0&pscdl=denied&_eu=AEA&_s=2&sid=1722668459&sct=1&seg=0&dl=https%3A%2F%2Fnow.gg%2F&dt=Play%20Online%20Games%20for%20Free%20%7C%20now.gg%20Mobile%20Cloud&en=scroll&epn.percent_scrolled=90&_et=20&tfd=9166

chrome.exe

Remote address:

216.239.34.36:443

Request

POST /g/collect?v=2&tid=G-8VVPTD9ZTY&gtm=45je47v0v883457966za200&_p=1722668459165&gcs=G10-&gcd=13m3l3m3m5&npa=1&dma_cps=-&dma=1&tcfd=10a56&tag_exp=95250753&cid=1655543314.1722668459&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.123%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.123&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&frm=0&pscdl=denied&_eu=AEA&_s=2&sid=1722668459&sct=1&seg=0&dl=https%3A%2F%2Fnow.gg%2F&dt=Play%20Online%20Games%20for%20Free%20%7C%20now.gg%20Mobile%20Cloud&en=scroll&epn.percent_scrolled=90&_et=20&tfd=9166 HTTP/2.0
host: region1.google-analytics.com
content-length: 0
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
DNS

36.34.239.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.34.239.216.in-addr.arpa

IN PTR

Response
DNS

42.131.233.140.in-addr.arpa

Remote address:

8.8.8.8:53

Request

42.131.233.140.in-addr.arpa

IN PTR

Response
DNS

cloud.bluestacks.com

chrome.exe

Remote address:

8.8.8.8:53

Request

cloud.bluestacks.com

IN A

Response

cloud.bluestacks.com

IN A

34.160.86.181
GET

https://cloud.bluestacks.com/get_cfg_info?package_name=com.roblox.client_imgd&parser_version=17

chrome.exe

Remote address:

34.160.86.181:443

Request

GET /get_cfg_info?package_name=com.roblox.client_imgd&parser_version=17 HTTP/2.0
host: cloud.bluestacks.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
GET

https://cloud.bluestacks.com/get_cfg_info?package_name=gg.now.client.android_imgd&parser_version=17

chrome.exe

Remote address:

34.160.86.181:443

Request

GET /get_cfg_info?package_name=gg.now.client.android_imgd&parser_version=17 HTTP/2.0
host: cloud.bluestacks.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
DNS

eb.bluestacks.com

chrome.exe

Remote address:

8.8.8.8:53

Request

eb.bluestacks.com

IN A

Response

eb.bluestacks.com

IN CNAME

contentkeymap-prod.us-west-1.elasticbeanstalk.com

contentkeymap-prod.us-west-1.elasticbeanstalk.com

IN A

52.8.8.59

contentkeymap-prod.us-west-1.elasticbeanstalk.com

IN A

52.52.115.199
GET

https://eb.bluestacks.com/content_keymap/com.roblox.client_imgd.cfg?parserver=17&cache=True

chrome.exe

Remote address:

52.8.8.59:443

Request

GET /content_keymap/com.roblox.client_imgd.cfg?parserver=17&cache=True HTTP/2.0
host: eb.bluestacks.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:33 GMT
content-type: text/plain
content-length: 4423
server: nginx
x-path: public/appsettings/imap/V17/com.roblox.client_imgd.cfg
x-cache: Hit
content-encoding: gzip
access-control-allow-origin: https://now.gg
vary: Origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
DNS

181.86.160.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

181.86.160.34.in-addr.arpa

IN PTR

Response

181.86.160.34.in-addr.arpa

IN PTR

1818616034bcgoogleusercontentcom
DNS

59.8.8.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

59.8.8.52.in-addr.arpa

IN PTR

Response

59.8.8.52.in-addr.arpa

IN PTR

ec2-52-8-8-59 us-west-1compute amazonawscom
DNS

static.hotjar.com

chrome.exe

Remote address:

8.8.8.8:53

Request

static.hotjar.com

IN A

Response

static.hotjar.com

IN CNAME

static-cdn.hotjar.com

static-cdn.hotjar.com

IN A

13.224.245.27

static-cdn.hotjar.com

IN A

13.224.245.89

static-cdn.hotjar.com

IN A

13.224.245.61

static-cdn.hotjar.com

IN A

13.224.245.87
DNS

dn0qt3r0xannq.cloudfront.net

chrome.exe

Remote address:

8.8.8.8:53

Request

dn0qt3r0xannq.cloudfront.net

IN A

Response

dn0qt3r0xannq.cloudfront.net

IN A

18.244.140.75

dn0qt3r0xannq.cloudfront.net

IN A

18.244.140.65

dn0qt3r0xannq.cloudfront.net

IN A

18.244.140.67

dn0qt3r0xannq.cloudfront.net

IN A

18.244.140.95
DNS

dn0qt3r0xannq.cloudfront.net

chrome.exe

Remote address:

8.8.8.8:53

Request

dn0qt3r0xannq.cloudfront.net

IN A
DNS

dn0qt3r0xannq.cloudfront.net

chrome.exe

Remote address:

8.8.8.8:53

Request

dn0qt3r0xannq.cloudfront.net

IN A
DNS

dn0qt3r0xannq.cloudfront.net

chrome.exe

Remote address:

8.8.8.8:53

Request

dn0qt3r0xannq.cloudfront.net

IN A
GET

https://static.hotjar.com/c/hotjar-848438.js?sv=6

chrome.exe

Remote address:

13.224.245.27:443

Request

GET /c/hotjar-848438.js?sv=6 HTTP/2.0
host: static.hotjar.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
date: Sat, 03 Aug 2024 07:00:54 GMT
cache-control: max-age=60
etag: W/ef4d5d495e852b8c9bf5089fda98cb15
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 7945124cc4b7caf5a8180cc1189567ee.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR62-C3
x-amz-cf-id: _nPnOU9r88eOuA8LQYE1uFVNyx-lb8Ycuw2ePMsMwvmuaujI46wyng==
age: 51
DNS

27.245.224.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

27.245.224.13.in-addr.arpa

IN PTR

Response

27.245.224.13.in-addr.arpa

IN PTR

server-13-224-245-27lhr62r cloudfrontnet
GET

https://dn0qt3r0xannq.cloudfront.net/nowgg-IZQznjkQaj/nowgg-default/prebid-load.js

chrome.exe

Remote address:

18.244.140.75:443

Request

GET /nowgg-IZQznjkQaj/nowgg-default/prebid-load.js HTTP/2.0
host: dn0qt3r0xannq.cloudfront.net
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript
last-modified: Fri, 02 Aug 2024 20:52:15 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: WwTPj9a8fYjmHk35k7pMz69wLBMxA8Wz
server: AmazonS3
content-encoding: br
date: Sat, 03 Aug 2024 06:08:09 GMT
cache-control: max-age=3600
etag: W/"c57e6a831ee532bfd8589c6280bbb961"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c35168d6765ec616de06013427e871a2.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P7
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: YRe90YjF8GlSy9_v6FAhOPXRbbzTkge8i980KmhZ3rQ6EoRHCaGo5Q==
age: 3218
GET

https://dn0qt3r0xannq.cloudfront.net/nowgg-IZQznjkQaj/nowgg-default/prebid-wrapper.js

chrome.exe

Remote address:

18.244.140.75:443

Request

GET /nowgg-IZQznjkQaj/nowgg-default/prebid-wrapper.js HTTP/2.0
host: dn0qt3r0xannq.cloudfront.net
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript
last-modified: Fri, 02 Aug 2024 20:52:15 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: taKLzhT8bBT_OHqGHh1EkA_JWclO5Vgw
server: AmazonS3
content-encoding: br
date: Sat, 03 Aug 2024 06:08:14 GMT
cache-control: max-age=3600
etag: W/"3389f2fa1b94448178a36f80df964dc4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c35168d6765ec616de06013427e871a2.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P7
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: PceylmoAERHAnupfVnydIQIQl6ifi49pg3tL68pCRnCJ7vZPcZQCrw==
age: 3211
DNS

beacons.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

142.250.69.3
DNS

raven-edge.aditude.io

chrome.exe

Remote address:

8.8.8.8:53

Request

raven-edge.aditude.io

IN A

Response

raven-edge.aditude.io

IN A

172.67.10.132

raven-edge.aditude.io

IN A

104.22.60.119

raven-edge.aditude.io

IN A

104.22.61.119
DNS

edge.aditude.io

chrome.exe

Remote address:

8.8.8.8:53

Request

edge.aditude.io

IN A

Response

edge.aditude.io

IN A

104.22.60.119

edge.aditude.io

IN A

172.67.10.132

edge.aditude.io

IN A

104.22.61.119
DNS

cadmus.script.ac

chrome.exe

Remote address:

8.8.8.8:53

Request

cadmus.script.ac

IN A

Response

cadmus.script.ac

IN A

104.18.23.145

cadmus.script.ac

IN A

104.18.22.145
DNS

pub.doubleverify.com

chrome.exe

Remote address:

8.8.8.8:53

Request

pub.doubleverify.com

IN A

Response

pub.doubleverify.com

IN CNAME

pub.doubleverify.com.cdn.cloudflare.net

pub.doubleverify.com.cdn.cloudflare.net

IN A

104.18.167.224

pub.doubleverify.com.cdn.cloudflare.net

IN A

104.18.166.224
DNS

pub.doubleverify.com

chrome.exe

Remote address:

8.8.8.8:53

Request

pub.doubleverify.com

IN A

Response

pub.doubleverify.com

IN CNAME

pub.doubleverify.com.cdn.cloudflare.net

pub.doubleverify.com.cdn.cloudflare.net

IN A

104.18.167.224

pub.doubleverify.com.cdn.cloudflare.net

IN A

104.18.166.224
DNS

static.kueezrtb.com

chrome.exe

Remote address:

8.8.8.8:53

Request

static.kueezrtb.com

IN A

Response

static.kueezrtb.com

IN A

104.22.34.123

static.kueezrtb.com

IN A

172.67.21.232

static.kueezrtb.com

IN A

104.22.35.123
DNS

static.kueezrtb.com

chrome.exe

Remote address:

8.8.8.8:53

Request

static.kueezrtb.com

IN A

Response

static.kueezrtb.com

IN A

104.22.34.123

static.kueezrtb.com

IN A

172.67.21.232

static.kueezrtb.com

IN A

104.22.35.123
DNS

www.googletagservices.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.googletagservices.com

IN A

Response

www.googletagservices.com

IN A

142.250.27.155

www.googletagservices.com

IN A

142.250.27.156

www.googletagservices.com

IN A

142.250.27.154

www.googletagservices.com

IN A

142.250.27.157
DNS

www.googletagservices.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.googletagservices.com

IN A

Response

www.googletagservices.com

IN A

142.250.27.155

www.googletagservices.com

IN A

142.250.27.157

www.googletagservices.com

IN A

142.250.27.154

www.googletagservices.com

IN A

142.250.27.156
DNS

static.vidazoo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

static.vidazoo.com

IN A

Response

static.vidazoo.com

IN CNAME

static.vidazoo.com.cdn.cloudflare.net

static.vidazoo.com.cdn.cloudflare.net

IN A

104.18.28.64

static.vidazoo.com.cdn.cloudflare.net

IN A

104.18.29.64
DNS

static.vidazoo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

static.vidazoo.com

IN A

Response

static.vidazoo.com

IN CNAME

static.vidazoo.com.cdn.cloudflare.net

static.vidazoo.com.cdn.cloudflare.net

IN A

104.18.29.64

static.vidazoo.com.cdn.cloudflare.net

IN A

104.18.28.64
POST

https://beacons.gcp.gvt2.com/domainreliability/upload

chrome.exe

Remote address:

142.250.69.3:443

Request

POST /domainreliability/upload HTTP/2.0
host: beacons.gcp.gvt2.com
content-length: 786
content-type: application/json; charset=utf-8
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
POST

https://beacons.gcp.gvt2.com/domainreliability/upload

chrome.exe

Remote address:

142.250.69.3:443

Request

POST /domainreliability/upload HTTP/2.0
host: beacons.gcp.gvt2.com
content-length: 335
content-type: application/json; charset=utf-8
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
GET

https://raven-edge.aditude.io/raven/nowgg-main-TcY9v/library.js

chrome.exe

Remote address:

172.67.10.132:443

Request

GET /raven/nowgg-main-TcY9v/library.js HTTP/2.0
host: raven-edge.aditude.io
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: text/javascript; charset=UTF-8
access-control-allow-methods: GET, HEAD, OPTIONS
access-control-allow-origin: *
age: 205
cache-control: public, max-age=3600, stale-while-revalidate=7200, stale-if-error=7200
cdn-cache-control: public, max-age=1800, stale-while-revalidate=7200
etag: W/"12d6-2dOmzVMuX/ZZ3JlYviag2Cjh3Tg"
strict-transport-security: max-age=63072000
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
x-dns-prefetch-control: on
x-matched-path: /raven/[propertyId]/library.js
x-vercel-cache: HIT
x-vercel-execution-region: iad1
x-vercel-id: lhr1::iad1::5sdlz-1722370968244-4a5dff59f8a8
cf-cache-status: HIT
server: cloudflare
cf-ray: 8ad4702cd89c9469-LHR
content-encoding: br
GET

https://raven-static.aditude.io/prod/1.1.18/raven.js

chrome.exe

Remote address:

172.67.10.132:443

Request

GET /prod/1.1.18/raven.js HTTP/2.0
host: raven-static.aditude.io
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: application/javascript
x-amz-id-2: 6YxNMlELvSgwC4g1DsyalI71s/AU9WkVSpFBSSJEW3P1B+TO/AVoieE7jwpu39Eyx+QOh9Yi3OU=
x-amz-request-id: 8ECA9RGKM6B74W8B
last-modified: Tue, 30 Jul 2024 19:57:59 GMT
etag: W/"8cdf727edde02bda1371743db3109135"
x-amz-server-side-encryption: AES256
cache-control: max-age=300
cf-cache-status: HIT
age: 3435
vary: Accept-Encoding
server: cloudflare
cf-ray: 8ad4702db96b9469-LHR
content-encoding: br
GET

https://cadmus.script.ac/d1ag38bbwvwx1z/script.js

chrome.exe

Remote address:

104.18.23.145:443

Request

GET /d1ag38bbwvwx1z/script.js HTTP/2.0
host: cadmus.script.ac
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: application/javascript
age: 0
cache-control: public,max-age=600,stale-while-revalidate=3600,stale-if-error=86400
etag: W/"9670016057deb0b8f4d4003b702d5cdd72c7787b"
last-modified: Fri, 02 Aug 2024 21:42:53 GMT
vary: Accept-Encoding
server: cloudflare
cf-ray: 8ad4702cd8a2cd2d-LHR
content-encoding: gzip
GET

https://edge.aditude.io/prebid/8.31.0.js?v=0560d1800daafc044be92e455261780d&modules=WyIzM2Fjcm9zc0JpZEFkYXB0ZXIiLCIzM2Fjcm9zc0lkU3lzdGVtIiwiYWRhZ2lvQmlkQWRhcHRlciIsImFkaXR1ZGUiLCJhZHBvZCIsImFteEJpZEFkYXB0ZXIiLCJhcHBuZXh1c0JpZEFkYXB0ZXIiLCJjb25zZW50TWFuYWdlbWVudCIsImNvbnNlbnRNYW5hZ2VtZW50VXNwIiwiY3Btc3RhckN1c3RvbUJpZEFkYXB0ZXIiLCJjcml0ZW9CaWRBZGFwdGVyIiwiY3JpdGVvSWRTeXN0ZW0iLCJjdXJyZW5jeSIsImRmcEFkU2VydmVyVmlkZW8iLCJlbnJpY2htZW50RnBkTW9kdWxlIiwiZmFicmlja0lkU3lzdGVtIiwiZ2RwckVuZm9yY2VtZW50IiwiZ3B0UHJlQXVjdGlvbiIsImd1bWd1bUJpZEFkYXB0ZXIiLCJpZDVJZFN5c3RlbSIsImluc3RpY2F0b3JCaWRBZGFwdGVyIiwiaW5zdHJlYW1UcmFja2luZyIsIml4QmlkQWRhcHRlciIsImt1ZWV6UnRiQmlkQWRhcHRlciIsImxpbWVsaWdodERpZ2l0YWxCaWRBZGFwdGVyIiwibHVuYW1lZGlhaGJCaWRBZGFwdGVyIiwibWludXRlbWVkaWFCaWRBZGFwdGVyIiwib25ldGFnQmlkQWRhcHRlciIsInByZWJpZFNlcnZlckJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1YlByb3ZpZGVkSWRTeXN0ZW0iLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2hhcmVkSWRTeXN0ZW0iLCJzaGFyZXRocm91Z2hCaWRBZGFwdGVyIiwic21hcnRhZHNlcnZlckJpZEFkYXB0ZXIiLCJzbWlsZXdhbnRlZEJpZEFkYXB0ZXIiLCJzb3ZybkJpZEFkYXB0ZXIiLCJ0cmlwbGVsaWZ0QmlkQWRhcHRlciIsInVuaWZpZWRJZFN5c3RlbSIsInZhbGlkYXRpb25GcGRNb2R1bGUiLCJ2aWRhem9vQmlkQWRhcHRlciIsInZpZGVvTW9kdWxlIiwiemV0YV9nbG9iYWxfc3NwQmlkQWRhcHRlciJd

chrome.exe

Remote address:

104.22.60.119:443

Request

GET /prebid/8.31.0.js?v=0560d1800daafc044be92e455261780d&modules=WyIzM2Fjcm9zc0JpZEFkYXB0ZXIiLCIzM2Fjcm9zc0lkU3lzdGVtIiwiYWRhZ2lvQmlkQWRhcHRlciIsImFkaXR1ZGUiLCJhZHBvZCIsImFteEJpZEFkYXB0ZXIiLCJhcHBuZXh1c0JpZEFkYXB0ZXIiLCJjb25zZW50TWFuYWdlbWVudCIsImNvbnNlbnRNYW5hZ2VtZW50VXNwIiwiY3Btc3RhckN1c3RvbUJpZEFkYXB0ZXIiLCJjcml0ZW9CaWRBZGFwdGVyIiwiY3JpdGVvSWRTeXN0ZW0iLCJjdXJyZW5jeSIsImRmcEFkU2VydmVyVmlkZW8iLCJlbnJpY2htZW50RnBkTW9kdWxlIiwiZmFicmlja0lkU3lzdGVtIiwiZ2RwckVuZm9yY2VtZW50IiwiZ3B0UHJlQXVjdGlvbiIsImd1bWd1bUJpZEFkYXB0ZXIiLCJpZDVJZFN5c3RlbSIsImluc3RpY2F0b3JCaWRBZGFwdGVyIiwiaW5zdHJlYW1UcmFja2luZyIsIml4QmlkQWRhcHRlciIsImt1ZWV6UnRiQmlkQWRhcHRlciIsImxpbWVsaWdodERpZ2l0YWxCaWRBZGFwdGVyIiwibHVuYW1lZGlhaGJCaWRBZGFwdGVyIiwibWludXRlbWVkaWFCaWRBZGFwdGVyIiwib25ldGFnQmlkQWRhcHRlciIsInByZWJpZFNlcnZlckJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1YlByb3ZpZGVkSWRTeXN0ZW0iLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2hhcmVkSWRTeXN0ZW0iLCJzaGFyZXRocm91Z2hCaWRBZGFwdGVyIiwic21hcnRhZHNlcnZlckJpZEFkYXB0ZXIiLCJzbWlsZXdhbnRlZEJpZEFkYXB0ZXIiLCJzb3ZybkJpZEFkYXB0ZXIiLCJ0cmlwbGVsaWZ0QmlkQWRhcHRlciIsInVuaWZpZWRJZFN5c3RlbSIsInZhbGlkYXRpb25GcGRNb2R1bGUiLCJ2aWRhem9vQmlkQWRhcHRlciIsInZpZGVvTW9kdWxlIiwiemV0YV9nbG9iYWxfc3NwQmlkQWRhcHRlciJd HTTP/2.0
host: edge.aditude.io
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: application/javascript; charset=UTF-8
age: 118416
cache-control: public, max-age=2678400
etag: W/"8bdfb-mkGon3LQis98Fi4pWKIdg4Jlix0"
strict-transport-security: max-age=63072000
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
x-matched-path: /prebid/[version]
x-vercel-cache: MISS
x-vercel-execution-region: cle1
x-vercel-id: lhr1::cle1::8jghc-1722550089278-7ccf97e48597
cf-cache-status: HIT
server: cloudflare
cf-ray: 8ad4702cdb2d943c-LHR
content-encoding: br
GET

https://static.kueezrtb.com/latest.js

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /latest.js HTTP/2.0
host: static.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: application/javascript
x-amz-id-2: bHJmurSsX0Es1TjpAsS+3cJlRsKJYXf1JVx8zRSrvcnUd0pYsSVWD+l/7RgBNetXvbbFmjG9zgg=
x-amz-request-id: CSFT60SWMBQY7EBR
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
access-control-expose-headers: x-amz-meta-access-control-allow-origin, x-amz-meta-access-control-allow-methods
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Thu, 18 Jul 2024 15:10:23 GMT
etag: W/"60128bab10c65f0c6f24fff61243d4e7"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 233175
server: cloudflare
cf-ray: 8ad4702cdf006430-LHR
content-encoding: br
GET

https://static.kueezrtb.com/js/latest.js?_=1722668504429

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /js/latest.js?_=1722668504429 HTTP/2.0
host: static.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: application/javascript
x-amz-id-2: cr2BIsqJiCt7YhBuQ/ZUqv54u+z8TvtTc6m4rh8y9JoaRWQkTdIwBMKbh+klLYE1PP/4Am+AJpw=
x-amz-request-id: CSFTKQWP8FZJSTH1
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
access-control-expose-headers: x-amz-meta-access-control-allow-origin, x-amz-meta-access-control-allow-methods
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Thu, 25 Jul 2024 10:31:42 GMT
etag: W/"c8389a50b3bdda01c90884702952a2d4"
cf-cache-status: HIT
age: 233175
server: cloudflare
cf-ray: 8ad4702d4f946430-LHR
content-encoding: br
POST

https://track.kueezrtb.com/dye?_=1722668504428&type=latest:boot&ac=2&acm=g3l&h=now.gg&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&beacon=1

chrome.exe

Remote address:

104.22.34.123:443

Request

POST /dye?_=1722668504428&type=latest:boot&ac=2&acm=g3l&h=now.gg&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&beacon=1 HTTP/2.0
host: track.kueezrtb.com
content-length: 0
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://now.gg
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702db8036430-LHR
POST

https://gtrack.kueezrtb.com/dye?_=1722668504428&type=latest:boot&ac=2&acm=g3l&h=now.gg&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&beacon=1

chrome.exe

Remote address:

104.22.34.123:443

Request

POST /dye?_=1722668504428&type=latest:boot&ac=2&acm=g3l&h=now.gg&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&beacon=1 HTTP/2.0
host: gtrack.kueezrtb.com
content-length: 0
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://now.gg
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702db80a6430-LHR
GET

https://track.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:preinit&_=1722668504676

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:preinit&_=1722668504676 HTTP/2.0
host: track.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702f197a6430-LHR
GET

https://gtrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:preinit&_=1722668504676

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:preinit&_=1722668504676 HTTP/2.0
host: gtrack.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702f19776430-LHR
GET

https://track.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:init&_=1722668504689

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:init&_=1722668504689 HTTP/2.0
host: track.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702f197b6430-LHR
GET

https://gtrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:init&_=1722668504689

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:init&_=1722668504689 HTTP/2.0
host: gtrack.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702f197f6430-LHR
GET

https://track.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdr&_=1722668504690

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdr&_=1722668504690 HTTP/2.0
host: track.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702f19786430-LHR
GET

https://gtrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdr&_=1722668504690

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdr&_=1722668504690 HTTP/2.0
host: gtrack.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702f49c96430-LHR
GET

https://u.kueezrtb.com/fpd?_=1722668504690&yv=161cad2&h=now.gg

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /fpd?_=1722668504690&yv=161cad2&h=now.gg HTTP/2.0
host: u.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-length: 310
access-control-allow-credentials: true
access-control-allow-origin: https://now.gg
set-cookie: kuid=cf29230c324fd6bf; Max-Age=7776000; Expires=Fri, 01 Nov 2024 07:01:45 GMT; Path=/; Domain=.kueezrtb.com; Secure; HTTPOnly; SameSite=None
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702f49c56430-LHR
GET

https://otrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:init&_=1722668504689

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:init&_=1722668504689 HTTP/2.0
host: otrack.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702f49ca6430-LHR
GET

https://otrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:preinit&_=1722668504676

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:preinit&_=1722668504676 HTTP/2.0
host: otrack.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702f8a196430-LHR
GET

https://otrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdr&_=1722668504690

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdr&_=1722668504690 HTTP/2.0
host: otrack.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad4702f197e6430-LHR
GET

https://track.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdrd&_=1722668504897

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdrd&_=1722668504897 HTTP/2.0
host: track.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: kuid=cf29230c324fd6bf

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad470301abf6430-LHR
GET

https://gtrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdrd&_=1722668504897

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdrd&_=1722668504897 HTTP/2.0
host: gtrack.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: kuid=cf29230c324fd6bf

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad470301abc6430-LHR
GET

https://otrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdrd&_=1722668504897

chrome.exe

Remote address:

104.22.34.123:443

Request

GET /dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdrd&_=1722668504897 HTTP/2.0
host: otrack.kueezrtb.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: kuid=cf29230c324fd6bf

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad470301abd6430-LHR
GET

https://static.vidazoo.com/basev/vwpt.js

chrome.exe

Remote address:

104.18.28.64:443

Request

GET /basev/vwpt.js HTTP/2.0
host: static.vidazoo.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: application/javascript
content-length: 44464
x-amz-id-2: 9gIvPyrPH6haHzqdk+QAgnZGqtqqkDrZcrSS/x5yoTbBgxJ1t5NDawrPfQUV1Tshoj3jK+OoMlE=
x-amz-request-id: W9F0ZEA96AXKXWQ0
last-modified: Thu, 27 Jun 2024 07:14:43 GMT
etag: "12e4ed0037217bcfbefee69c5e08b013"
x-amz-server-side-encryption: AES256
content-encoding: gzip
cf-cache-status: HIT
age: 85585
expires: Sun, 04 Aug 2024 07:01:45 GMT
cache-control: public, max-age=86400
accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
access-control-allow-methods: GET, OPTIONS, HEAD
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
server: cloudflare
cf-ray: 8ad4702cdf6b4188-LHR
GET

https://static.vidazoo.com/basev/cmp/1.0.1/cmp.js

chrome.exe

Remote address:

104.18.28.64:443

Request

GET /basev/cmp/1.0.1/cmp.js HTTP/2.0
host: static.vidazoo.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: application/javascript
content-length: 1399
x-amz-id-2: sdhdiWqjBu2Vu53jt3tYoWIMz/UoVT1+M9iGOdlOI8u4ren5p5/SPj4r9wWYnSZR5itytvGu3XQ=
x-amz-request-id: PWTGVX6QD3SZCJVT
last-modified: Tue, 12 Mar 2024 16:34:24 GMT
etag: "537d031a09119574ca284f3fe36dd61b"
x-amz-server-side-encryption: AES256
content-encoding: gzip
cf-cache-status: HIT
age: 38100
expires: Sun, 04 Aug 2024 07:01:45 GMT
cache-control: public, max-age=86400
accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
access-control-allow-methods: GET, OPTIONS, HEAD
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
server: cloudflare
cf-ray: 8ad4702d78334188-LHR
GET

https://static.vidazoo.com/basev/tcf/1.0.3/tcf.js

chrome.exe

Remote address:

104.18.28.64:443

Request

GET /basev/tcf/1.0.3/tcf.js HTTP/2.0
host: static.vidazoo.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: application/javascript
content-length: 5047
x-amz-id-2: hWx93ZmGo/cIQG0+bOngINEpYLuOvL3hRMhirzmVD5d/iAiwgaG2foXd324av7lL6OjsVM1h0jc=
x-amz-request-id: AASKSZ6MCWGVJ3X0
last-modified: Mon, 08 Jan 2024 10:40:28 GMT
etag: "c754706f000335ac7007603f04f43f2d"
x-amz-server-side-encryption: AES256
content-encoding: gzip
cf-cache-status: HIT
age: 53429
expires: Sun, 04 Aug 2024 07:01:45 GMT
cache-control: public, max-age=86400
accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
access-control-allow-methods: GET, OPTIONS, HEAD
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
server: cloudflare
cf-ray: 8ad4702d78364188-LHR
GET

https://pub.doubleverify.com/signals/pub.js

chrome.exe

Remote address:

104.18.167.224:443

Request

GET /signals/pub.js HTTP/2.0
host: pub.doubleverify.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=14400, stale-while-revalidate=345600, stale-if-error=345600
access-control-allow-credentials: true
access-control-expose-headers: Server-Timing, Cf-Ray
timing-allow-origin: *
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors 'self'
x-frame-options: SAMEORIGIN
server: cloudflare
cf-ray: 8ad4702cf85493f8-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://www.googletagservices.com/tag/js/gpt.js

chrome.exe

Remote address:

142.250.27.155:443

Request

GET /tag/js/gpt.js HTTP/2.0
host: www.googletagservices.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
GET

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202407300101/pubads_impl.js

chrome.exe

Remote address:

142.250.27.155:443

Request

GET /pagead/managed/js/gpt/m202407300101/pubads_impl.js HTTP/2.0
host: securepubads.g.doubleclick.net
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
x-client-data: CPCRywE=
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
DNS

raven-static.aditude.io

chrome.exe

Remote address:

8.8.8.8:53

Request

raven-static.aditude.io

IN A

Response

raven-static.aditude.io

IN A

104.22.61.119

raven-static.aditude.io

IN A

172.67.10.132

raven-static.aditude.io

IN A

104.22.60.119
DNS

raven-static.aditude.io

chrome.exe

Remote address:

8.8.8.8:53

Request

raven-static.aditude.io

IN A

Response

raven-static.aditude.io

IN A

104.22.60.119

raven-static.aditude.io

IN A

104.22.61.119

raven-static.aditude.io

IN A

172.67.10.132
DNS

track.kueezrtb.com

chrome.exe

Remote address:

8.8.8.8:53

Request

track.kueezrtb.com

IN A

Response

track.kueezrtb.com

IN A

172.67.21.232

track.kueezrtb.com

IN A

104.22.34.123

track.kueezrtb.com

IN A

104.22.35.123
DNS

track.kueezrtb.com

chrome.exe

Remote address:

8.8.8.8:53

Request

track.kueezrtb.com

IN A

Response

track.kueezrtb.com

IN A

104.22.35.123

track.kueezrtb.com

IN A

104.22.34.123

track.kueezrtb.com

IN A

172.67.21.232
DNS

gtrack.kueezrtb.com

chrome.exe

Remote address:

8.8.8.8:53

Request

gtrack.kueezrtb.com

IN A

Response

gtrack.kueezrtb.com

IN A

104.22.35.123

gtrack.kueezrtb.com

IN A

104.22.34.123

gtrack.kueezrtb.com

IN A

172.67.21.232
DNS

gtrack.kueezrtb.com

chrome.exe

Remote address:

8.8.8.8:53

Request

gtrack.kueezrtb.com

IN A

Response

gtrack.kueezrtb.com

IN A

104.22.35.123

gtrack.kueezrtb.com

IN A

172.67.21.232

gtrack.kueezrtb.com

IN A

104.22.34.123
DNS

75.140.244.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

75.140.244.18.in-addr.arpa

IN PTR

Response

75.140.244.18.in-addr.arpa

IN PTR

server-18-244-140-75lhr50r cloudfrontnet
DNS

75.140.244.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

75.140.244.18.in-addr.arpa

IN PTR

Response

75.140.244.18.in-addr.arpa

IN PTR

server-18-244-140-75lhr50r cloudfrontnet
DNS

132.10.67.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

132.10.67.172.in-addr.arpa

IN PTR

Response
DNS

132.10.67.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

132.10.67.172.in-addr.arpa

IN PTR

Response
DNS

145.23.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

145.23.18.104.in-addr.arpa

IN PTR

Response
DNS

145.23.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

145.23.18.104.in-addr.arpa

IN PTR

Response
DNS

119.60.22.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

119.60.22.104.in-addr.arpa

IN PTR

Response
DNS

119.60.22.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

119.60.22.104.in-addr.arpa

IN PTR

Response
DNS

123.34.22.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

123.34.22.104.in-addr.arpa

IN PTR

Response
DNS

123.34.22.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

123.34.22.104.in-addr.arpa

IN PTR

Response
DNS

64.28.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

64.28.18.104.in-addr.arpa

IN PTR

Response
DNS

64.28.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

64.28.18.104.in-addr.arpa

IN PTR

Response
DNS

224.167.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

224.167.18.104.in-addr.arpa

IN PTR

Response
DNS

224.167.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

224.167.18.104.in-addr.arpa

IN PTR

Response
DNS

155.27.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

155.27.250.142.in-addr.arpa

IN PTR

Response

155.27.250.142.in-addr.arpa

IN PTR

ra-in-f1551e100net
DNS

155.27.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

155.27.250.142.in-addr.arpa

IN PTR

Response

155.27.250.142.in-addr.arpa

IN PTR

ra-in-f1551e100net
DNS

i.clean.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

i.clean.gg

IN A

Response

i.clean.gg

IN A

34.95.69.49
DNS

i.clean.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

i.clean.gg

IN A

Response

i.clean.gg

IN A

34.95.69.49
OPTIONS

https://i.clean.gg/1a

chrome.exe

Remote address:

34.95.69.49:443

Request

OPTIONS /1a HTTP/2.0
host: i.clean.gg
accept: */*
access-control-request-method: POST
access-control-request-headers: content-type
origin: https://now.gg
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
POST

https://i.clean.gg/1a

chrome.exe

Remote address:

34.95.69.49:443

Request

POST /1a HTTP/2.0
host: i.clean.gg
content-length: 648
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
DNS

geo-location.prebid.cloud

chrome.exe

Remote address:

8.8.8.8:53

Request

geo-location.prebid.cloud

IN A

Response

geo-location.prebid.cloud

IN A

18.172.153.127

geo-location.prebid.cloud

IN A

18.172.153.113

geo-location.prebid.cloud

IN A

18.172.153.15

geo-location.prebid.cloud

IN A

18.172.153.63
DNS

geo-location.prebid.cloud

chrome.exe

Remote address:

8.8.8.8:53

Request

geo-location.prebid.cloud

IN A

Response

geo-location.prebid.cloud

IN A

18.172.153.63

geo-location.prebid.cloud

IN A

18.172.153.127

geo-location.prebid.cloud

IN A

18.172.153.15

geo-location.prebid.cloud

IN A

18.172.153.113
GET

https://geo-location.prebid.cloud/v1/geo

chrome.exe

Remote address:

18.172.153.127:443

Request

GET /v1/geo HTTP/2.0
host: geo-location.prebid.cloud
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept: application/json
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json
content-length: 87
date: Sat, 03 Aug 2024 00:33:49 GMT
x-amzn-requestid: 686ab1d5-8fe7-41c1-889e-7c7ec456ce05
x-amz-apigw-id: b6AlIFlHoAMEaeg=
x-cache: Hit from cloudfront
via: 1.1 4aaf4116b04a91c2bdea1c5937b0ec2a.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P5
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: nWO3IiVvAXVW4QljS4cjGJS0H11mpagzj2q_O1bAZYTHWNDP6KZUeQ==
age: 23276
x-frame-options: SAMEORIGIN
access-control-allow-origin: *
DNS

securepubads.g.doubleclick.net

chrome.exe

Remote address:

8.8.8.8:53

Request

securepubads.g.doubleclick.net

IN A

Response

securepubads.g.doubleclick.net

IN A

142.250.27.155

securepubads.g.doubleclick.net

IN A

142.250.27.157

securepubads.g.doubleclick.net

IN A

142.250.27.154

securepubads.g.doubleclick.net

IN A

142.250.27.156
DNS

securepubads.g.doubleclick.net

chrome.exe

Remote address:

8.8.8.8:53

Request

securepubads.g.doubleclick.net

IN A

Response

securepubads.g.doubleclick.net

IN A

142.250.27.155

securepubads.g.doubleclick.net

IN A

142.250.27.154

securepubads.g.doubleclick.net

IN A

142.250.27.156

securepubads.g.doubleclick.net

IN A

142.250.27.157
DNS

u.kueezrtb.com

chrome.exe

Remote address:

8.8.8.8:53

Request

u.kueezrtb.com

IN A

Response

u.kueezrtb.com

IN A

104.22.35.123

u.kueezrtb.com

IN A

104.22.34.123

u.kueezrtb.com

IN A

172.67.21.232
DNS

otrack.kueezrtb.com

chrome.exe

Remote address:

8.8.8.8:53

Request

otrack.kueezrtb.com

IN A

Response

otrack.kueezrtb.com

IN A

104.22.34.123

otrack.kueezrtb.com

IN A

104.22.35.123

otrack.kueezrtb.com

IN A

172.67.21.232
DNS

production-raven.infra.aditude.cloud

chrome.exe

Remote address:

8.8.8.8:53

Request

production-raven.infra.aditude.cloud

IN A

Response

production-raven.infra.aditude.cloud

IN A

18.165.201.18

production-raven.infra.aditude.cloud

IN A

18.165.201.71

production-raven.infra.aditude.cloud

IN A

18.165.201.2

production-raven.infra.aditude.cloud

IN A

18.165.201.64
DNS

cdn.jsdelivr.net

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.jsdelivr.net

IN A

Response

cdn.jsdelivr.net

IN CNAME

jsdelivr.map.fastly.net

jsdelivr.map.fastly.net

IN A

151.101.129.229

jsdelivr.map.fastly.net

IN A

151.101.1.229

jsdelivr.map.fastly.net

IN A

151.101.193.229

jsdelivr.map.fastly.net

IN A

151.101.65.229
GET

https://production-raven.infra.aditude.cloud/geo

chrome.exe

Remote address:

18.165.201.18:443

Request

GET /geo HTTP/2.0
host: production-raven.infra.aditude.cloud
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json
content-length: 214
date: Sat, 03 Aug 2024 07:01:45 GMT
x-amzn-requestid: 3c13dc9e-70ee-45ce-ba12-862af85600cf
access-control-allow-origin: https://now.gg
access-control-allow-headers: Origin, Accept, X-Requested-With, Content-Type, X-Amz-Date, Authorization, X-Api-Key
vary: Origin
cache-control: public, max-age=86400
access-control-allow-methods: GET,OPTIONS,PUT,HEAD
x-amzn-trace-id: root=1-66add5d9-434e657a3aadd52f3fe1396b;parent=0a3927f95065cf98;sampled=0;lineage=2cff10c0:0
access-control-max-age: 86400
x-cache: Miss from cloudfront
via: 1.1 096e5ecae9d1cd03edf8411ad106b092.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P3
x-amz-cf-id: joE5nmBpoVXW9tizD9oE5SQBteCvh4fiwMMBJ6xg3vA2ENda51TwOw==
GET

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20240803

chrome.exe

Remote address:

151.101.129.229:443

Request

GET /gh/prebid/currency-file@1/latest.json?date=20240803 HTTP/2.0
host: cdn.jsdelivr.net
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: text/plain
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json; charset=utf-8
x-jsd-version: 1.0.2136
x-jsd-version-type: version
etag: W/"63b-hEsLzI8MPEilqEcs8DTIaXQOvs4"
content-encoding: br
accept-ranges: bytes
date: Sat, 03 Aug 2024 07:01:45 GMT
age: 10851
x-served-by: cache-fra-eddf8230103-FRA, cache-lcy-eglc8600050-LCY
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 726
DNS

c.amazon-adsystem.com

chrome.exe

Remote address:

8.8.8.8:53

Request

c.amazon-adsystem.com

IN A

Response

c.amazon-adsystem.com

IN CNAME

d1ykf07e75w7ss.cloudfront.net

d1ykf07e75w7ss.cloudfront.net

IN A

13.224.223.9
DNS

c.amazon-adsystem.com

chrome.exe

Remote address:

8.8.8.8:53

Request

c.amazon-adsystem.com

IN A

Response

c.amazon-adsystem.com

IN CNAME

d1ykf07e75w7ss.cloudfront.net

d1ykf07e75w7ss.cloudfront.net

IN A

13.224.223.9
GET

https://c.amazon-adsystem.com/aax2/apstag.js

chrome.exe

Remote address:

13.224.223.9:443

Request

GET /aax2/apstag.js HTTP/2.0
host: c.amazon-adsystem.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript
date: Sat, 03 Aug 2024 06:39:48 GMT
last-modified: Wed, 24 Jul 2024 20:39:02 GMT
x-amz-server-side-encryption: AES256
cache-control: max-age=3600
server: AmazonS3
content-encoding: gzip
via: 1.1 1f0b2edf1d5c127c320be20441fdb062.cloudfront.net (CloudFront), 1.1 340acc109468df693ec024a66dbb0f1e.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR62-C4
etag: W/"f3827e9e649a0910d70a775d66bf75b1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-cf-pop: LHR61-C2
x-amz-cf-id: RbuPrDC115upFy0bcTKERPnAjZHnJuk2m6_Fdbsxqs9fntVwsbAsmg==
age: 1318
GET

https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fnow.gg&pubid=763aebd8-5c09-4e7c-8035-dd824f7f190b

chrome.exe

Remote address:

13.224.223.9:443

Request

GET /cdn/prod/config?src=600&u=https%3A%2F%2Fnow.gg&pubid=763aebd8-5c09-4e7c-8035-dd824f7f190b HTTP/2.0
host: c.amazon-adsystem.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json;charset=UTF-8
content-length: 1544
access-control-allow-origin: https://now.gg
access-control-allow-credentials: true
cache-control: max-age=21550, s-maxage=21600
date: Sat, 03 Aug 2024 02:18:12 GMT
server: Server
x-cache: Hit from cloudfront
via: 1.1 340acc109468df693ec024a66dbb0f1e.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-C2
x-amz-cf-id: jGcv1L4ZpElN-dbqcZM4RZhmZ8d6RukgT9dTdlFTyXPNsfOOa9YVkw==
age: 17013
DNS

config.aps.amazon-adsystem.com

chrome.exe

Remote address:

8.8.8.8:53

Request

config.aps.amazon-adsystem.com

IN A

Response

config.aps.amazon-adsystem.com

IN A

52.84.90.106

config.aps.amazon-adsystem.com

IN A

52.84.90.126

config.aps.amazon-adsystem.com

IN A

52.84.90.86

config.aps.amazon-adsystem.com

IN A

52.84.90.40
GET

https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js

chrome.exe

Remote address:

13.224.223.9:443

Request

GET /bao-csm/aps-comm/aps_csm.js HTTP/2.0
host: c.amazon-adsystem.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
server: AmazonS3
content-encoding: gzip
date: Sat, 03 Aug 2024 01:26:40 GMT
cache-control: public, max-age=86400
etag: W/"a4d296427fc806b21335359e398c025c"
vary: Accept-Encoding,Origin
x-cache: Hit from cloudfront
via: 1.1 323b4a7971a31c96655a9c4fcac2b9ce.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-C2
x-amz-cf-id: qvzq4oR5KVq_it52IBovh3C9HewrLdSymB-Kb0qWLjxLBExFVdmQ9w==
age: 20106
GET

https://config.aps.amazon-adsystem.com/configs/763aebd8-5c09-4e7c-8035-dd824f7f190b

chrome.exe

Remote address:

52.84.90.106:443

Request

GET /configs/763aebd8-5c09-4e7c-8035-dd824f7f190b HTTP/2.0
host: config.aps.amazon-adsystem.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript
content-length: 563
server: CloudFront
date: Sat, 03 Aug 2024 06:13:30 GMT
cache-control: max-age=3600
x-cache: Hit from cloudfront
via: 1.1 541a8e92039ccf40eff671406e456e36.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR62-C4
x-amz-cf-id: wybmTnhQ5uS1q5BMOjgd6fNRUvaKPieoJbnmDRVtnA-fJHiemthC5w==
age: 2895
DNS

secure.cdn.fastclick.net

chrome.exe

Remote address:

8.8.8.8:53

Request

secure.cdn.fastclick.net

IN A

Response

secure.cdn.fastclick.net

IN CNAME

secure2.cdn.fastclick.net.edgekey.net

secure2.cdn.fastclick.net.edgekey.net

IN CNAME

e4536.g.akamaiedge.net

e4536.g.akamaiedge.net

IN A

23.49.161.153
DNS

secure.cdn.fastclick.net

chrome.exe

Remote address:

8.8.8.8:53

Request

secure.cdn.fastclick.net

IN A

Response

secure.cdn.fastclick.net

IN CNAME

secure2.cdn.fastclick.net.edgekey.net

secure2.cdn.fastclick.net.edgekey.net

IN CNAME

e4536.g.akamaiedge.net

e4536.g.akamaiedge.net

IN A

23.49.161.153
DNS

tags.crwdcntrl.net

chrome.exe

Remote address:

8.8.8.8:53

Request

tags.crwdcntrl.net

IN A

Response

tags.crwdcntrl.net

IN A

18.245.143.83

tags.crwdcntrl.net

IN A

18.245.143.58

tags.crwdcntrl.net

IN A

18.245.143.118

tags.crwdcntrl.net

IN A

18.245.143.100
DNS

tags.crwdcntrl.net

chrome.exe

Remote address:

8.8.8.8:53

Request

tags.crwdcntrl.net

IN A

Response

tags.crwdcntrl.net

IN A

18.245.143.118

tags.crwdcntrl.net

IN A

18.245.143.100

tags.crwdcntrl.net

IN A

18.245.143.83

tags.crwdcntrl.net

IN A

18.245.143.58
DNS

cdn.id5-sync.com

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.id5-sync.com

IN A

Response

cdn.id5-sync.com

IN A

104.22.53.86

cdn.id5-sync.com

IN A

172.67.38.106

cdn.id5-sync.com

IN A

104.22.52.86
DNS

cdn.id5-sync.com

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.id5-sync.com

IN A

Response

cdn.id5-sync.com

IN A

104.22.53.86

cdn.id5-sync.com

IN A

172.67.38.106

cdn.id5-sync.com

IN A

104.22.52.86
GET

https://raven-edge.aditude.io/api/v1/ravenconfig?ppid=nowgg-main-TcY9v&geo=GB

chrome.exe

Remote address:

172.67.10.132:443

Request

GET /api/v1/ravenconfig?ppid=nowgg-main-TcY9v&geo=GB HTTP/2.0
host: raven-edge.aditude.io
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
age: 318
cache-control: public, max-age=120, stale-while-revalidate=240, stale-if-error=3600
cdn-cache-control: public, max-age=300, stale-while-revalidate=240
etag: W/"42f-o7L/RhqlKvlSPWbLQDonjwVKRMo"
strict-transport-security: max-age=63072000
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
x-matched-path: /api/v1/ravenconfig
x-vercel-cache: HIT
x-vercel-execution-region: iad1
x-vercel-id: lhr1::iad1::cbx5k-1722278061467-d66b9af1f107
cf-cache-status: HIT
server: cloudflare
cf-ray: 8ad47031cbba6543-LHR
content-encoding: br
GET

https://tags.crwdcntrl.net/lt/c/16576/sync.min.js

chrome.exe

Remote address:

18.245.143.83:443

Request

GET /lt/c/16576/sync.min.js HTTP/2.0
host: tags.crwdcntrl.net
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/javascript
last-modified: Tue, 30 Jul 2024 19:29:19 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
date: Fri, 02 Aug 2024 20:00:10 GMT
cache-control: public, max-age=86400
etag: W/"7bcc18dc921f9b135e294dc9ebbac75f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 063bfb014e66ef670fc62ff044660cf2.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR5-P1
x-amz-cf-id: my-PanHrjF-CIZRkaKFzPN34azRj5kQTxswp4ga1bvX74CD4ujptEQ==
age: 39696
GET

https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js

chrome.exe

Remote address:

23.49.161.153:443

Request

GET /js/pubcid/latest/pubcid.min.js HTTP/2.0
host: secure.cdn.fastclick.net
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

server: Apache
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
etag: "d734-5f2f3919e751f-gzip"
accept-ranges: bytes
content-encoding: gzip
content-length: 17407
content-type: application/javascript
cache-control: max-age=900
expires: Sat, 03 Aug 2024 07:16:45 GMT
date: Sat, 03 Aug 2024 07:01:45 GMT
vary: Accept-Encoding
GET

https://cdn.id5-sync.com/api/1.0/id5-api.js

chrome.exe

Remote address:

104.22.53.86:443

Request

GET /api/1.0/id5-api.js HTTP/2.0
host: cdn.id5-sync.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:45 GMT
content-type: text/javascript;charset=utf-8
x-amz-id-2: 4NYxZkRwd2mqr9eLfdQQtAgqoFVvv1+Vc7KWH14UmMpb9a6b+MGpodlHb63Dl/POJ2V3JaePcZR7fCwze8eomZd4zk/HjS3QaGgtAyCuAcM=
x-amz-request-id: QY9KM1BASNJBMAKB
last-modified: Wed, 19 Jun 2024 08:15:00 GMT
etag: W/"7549ecdacdd2ca9502744f648799d58a"
x-amz-server-side-encryption: AES256
cache-control: public, max-age=3600
cf-cache-status: HIT
age: 11
expires: Sat, 03 Aug 2024 08:01:45 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
server: cloudflare
cf-ray: 8ad47031e9d648ce-LHR
content-encoding: br
DNS

bcp.crwdcntrl.net

chrome.exe

Remote address:

8.8.8.8:53

Request

bcp.crwdcntrl.net

IN A

Response

bcp.crwdcntrl.net

IN A

63.33.40.35

bcp.crwdcntrl.net

IN A

34.254.23.94

bcp.crwdcntrl.net

IN A

54.171.9.108

bcp.crwdcntrl.net

IN A

54.154.220.125

bcp.crwdcntrl.net

IN A

52.214.219.236

bcp.crwdcntrl.net

IN A

34.242.213.176

bcp.crwdcntrl.net

IN A

54.73.93.8

bcp.crwdcntrl.net

IN A

52.215.197.131
DNS

bcp.crwdcntrl.net

chrome.exe

Remote address:

8.8.8.8:53

Request

bcp.crwdcntrl.net

IN A

Response

bcp.crwdcntrl.net

IN A

52.215.197.131

bcp.crwdcntrl.net

IN A

52.214.219.236

bcp.crwdcntrl.net

IN A

34.242.213.176

bcp.crwdcntrl.net

IN A

34.254.23.94

bcp.crwdcntrl.net

IN A

54.154.220.125

bcp.crwdcntrl.net

IN A

63.33.40.35

bcp.crwdcntrl.net

IN A

54.171.9.108

bcp.crwdcntrl.net

IN A

54.73.93.8
DNS

script.hotjar.com

chrome.exe

Remote address:

8.8.8.8:53

Request

script.hotjar.com

IN A

Response

script.hotjar.com

IN A

18.245.253.22

script.hotjar.com

IN A

18.245.253.99

script.hotjar.com

IN A

18.245.253.48

script.hotjar.com

IN A

18.245.253.79
POST

https://bcp.crwdcntrl.net/6/map

chrome.exe

Remote address:

63.33.40.35:443

Request

POST /6/map HTTP/2.0
host: bcp.crwdcntrl.net
content-length: 770
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: text/plain;charset=UTF-8
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:46 GMT
content-type: application/json;charset=utf-8
content-length: 61
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
cache-control: no-cache
pragma: no-cache
expires: 0
x-server: 10.45.27.6
access-control-allow-credentials: true
access-control-allow-origin: https://now.gg
x-consent: absent
server: Jetty(9.4.38.v20210224)
GET

https://script.hotjar.com/modules.8da33a8f469c3b5ffcec.js

chrome.exe

Remote address:

18.245.253.22:443

Request

GET /modules.8da33a8f469c3b5ffcec.js HTTP/2.0
host: script.hotjar.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=utf-8
content-length: 56385
date: Tue, 30 Jul 2024 14:23:06 GMT
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=31536000
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: "0728625a147ca79276a1790b9cf3175d"
last-modified: Tue, 30 Jul 2024 14:22:40 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2f1f2b9dead1700acb398fe109f37844.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR5-P5
x-amz-cf-id: PpO9uZq8tTX9s2306usY0zlvFHvG0Wa1EltEn0clxNxkk5gJClS7bQ==
age: 319120
GET

https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js

chrome.exe

Remote address:

18.245.253.22:443

Request

GET /browser-perf.8417c6bba72228fa2e29.js HTTP/2.0
host: script.hotjar.com
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript; charset=utf-8
content-length: 1782
date: Mon, 13 May 2024 11:02:28 GMT
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=31536000
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: "b83b61bc5871e9a23a0434e2c539f4f3"
last-modified: Fri, 10 May 2024 11:34:52 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2f1f2b9dead1700acb398fe109f37844.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR5-P5
x-amz-cf-id: vmE1U9TuGG1sESBvm1I-CUhdJQ9YvIqvafMY5ZUyxP2d9Ym921ZfXg==
age: 7070358
DNS

3.69.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.69.250.142.in-addr.arpa

IN PTR

Response

3.69.250.142.in-addr.arpa

IN PTR

qro02s18-in-f31e100net

3.69.250.142.in-addr.arpa

IN PTR

lcphxq-aa-in-f3�F
DNS

49.69.95.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

49.69.95.34.in-addr.arpa

IN PTR

Response

49.69.95.34.in-addr.arpa

IN PTR

49699534bcgoogleusercontentcom
DNS

49.69.95.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

49.69.95.34.in-addr.arpa

IN PTR

Response

49.69.95.34.in-addr.arpa

IN PTR

49699534bcgoogleusercontentcom
DNS

127.153.172.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

127.153.172.18.in-addr.arpa

IN PTR

Response

127.153.172.18.in-addr.arpa

IN PTR

server-18-172-153-127lhr50r cloudfrontnet
DNS

18.201.165.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.201.165.18.in-addr.arpa

IN PTR

Response

18.201.165.18.in-addr.arpa

IN PTR

server-18-165-201-18lhr50r cloudfrontnet
DNS

9.223.224.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

9.223.224.13.in-addr.arpa

IN PTR

Response

9.223.224.13.in-addr.arpa

IN PTR

server-13-224-223-9lhr61r cloudfrontnet
DNS

229.129.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

229.129.101.151.in-addr.arpa

IN PTR

Response
DNS

106.90.84.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

106.90.84.52.in-addr.arpa

IN PTR

Response

106.90.84.52.in-addr.arpa

IN PTR

server-52-84-90-106lhr62r cloudfrontnet
DNS

83.143.245.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

83.143.245.18.in-addr.arpa

IN PTR

Response

83.143.245.18.in-addr.arpa

IN PTR

server-18-245-143-83lhr5r cloudfrontnet
DNS

153.161.49.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

153.161.49.23.in-addr.arpa

IN PTR

Response

153.161.49.23.in-addr.arpa

IN PTR

a23-49-161-153deploystaticakamaitechnologiescom
DNS

86.53.22.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.53.22.104.in-addr.arpa

IN PTR

Response
DNS

35.40.33.63.in-addr.arpa

Remote address:

8.8.8.8:53

Request

35.40.33.63.in-addr.arpa

IN PTR

Response

35.40.33.63.in-addr.arpa

IN PTR

ec2-63-33-40-35 eu-west-1compute amazonawscom
DNS

vc.hotjar.io

chrome.exe

Remote address:

8.8.8.8:53

Request

vc.hotjar.io

IN A

Response

vc.hotjar.io

IN CNAME

vc-live-cf.hotjar.io

vc-live-cf.hotjar.io

IN A

99.84.9.16

vc-live-cf.hotjar.io

IN A

99.84.9.52

vc-live-cf.hotjar.io

IN A

99.84.9.26

vc-live-cf.hotjar.io

IN A

99.84.9.107
GET

https://vc.hotjar.io/sessions/848438?s=0.25&r=0.1124561975686873

chrome.exe

Remote address:

99.84.9.16:443

Request

GET /sessions/848438?s=0.25&r=0.1124561975686873 HTTP/2.0
host: vc.hotjar.io
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

access-control-allow-origin: *
cache-control: no-store
date: Sat, 03 Aug 2024 07:01:46 GMT
x-cache: Miss from cloudfront
via: 1.1 dd9044f778a0203632be1c1b84d73ba8.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR62-C2
x-amz-cf-id: HuNcst712XxKHLdso1f0QOVQCGapj5IPUqSydyUpOg5Rl1Wm7IAlKw==
DNS

mp.4dex.io

chrome.exe

Remote address:

8.8.8.8:53

Request

mp.4dex.io

IN A

Response

mp.4dex.io

IN A

104.18.11.176

mp.4dex.io

IN A

104.18.10.176
POST

https://mp.4dex.io/prebid

chrome.exe

Remote address:

104.18.11.176:443

Request

POST /prebid HTTP/2.0
host: mp.4dex.io
content-length: 0
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:47 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://now.gg
cache-control: no-cache, no-store, must-revalidate
expires: 0
pragma: no-cache
vary: Origin
vary: Accept-Encoding
x-err: Parsing the Prebid Request. parseadrequest failed to parse body
x-version: 3.0.0-gcp-ams
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ad470396b674911-LHR
DNS

16.9.84.99.in-addr.arpa

Remote address:

8.8.8.8:53

Request

16.9.84.99.in-addr.arpa

IN PTR

Response

16.9.84.99.in-addr.arpa

IN PTR

server-99-84-9-16lhr62r cloudfrontnet
DNS

22.253.245.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.253.245.18.in-addr.arpa

IN PTR

Response

22.253.245.18.in-addr.arpa

IN PTR

server-18-245-253-22lhr5r cloudfrontnet
DNS

176.11.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

176.11.18.104.in-addr.arpa

IN PTR

Response
DNS

metrics.hotjar.io

chrome.exe

Remote address:

8.8.8.8:53

Request

metrics.hotjar.io

IN A

Response

metrics.hotjar.io

IN CNAME

pacman-metrics-live.live.eks.hotjar.com

pacman-metrics-live.live.eks.hotjar.com

IN A

34.247.98.43

pacman-metrics-live.live.eks.hotjar.com

IN A

34.253.170.23

pacman-metrics-live.live.eks.hotjar.com

IN A

52.48.14.101
DNS

metrics.hotjar.io

chrome.exe

Remote address:

8.8.8.8:53

Request

metrics.hotjar.io

IN A

Response

metrics.hotjar.io

IN CNAME

pacman-metrics-live.live.eks.hotjar.com

pacman-metrics-live.live.eks.hotjar.com

IN A

52.48.14.101

pacman-metrics-live.live.eks.hotjar.com

IN A

34.247.98.43

pacman-metrics-live.live.eks.hotjar.com

IN A

34.253.170.23
POST

https://metrics.hotjar.io/?v=6&site_id=848438

chrome.exe

Remote address:

34.247.98.43:443

Request

POST /?v=6&site_id=848438 HTTP/2.0
host: metrics.hotjar.io
content-length: 100
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: text/plain;charset=UTF-8
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:49 GMT
access-control-allow-origin: *
access-control-max-age: 86400
DNS

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

chrome.exe

Remote address:

8.8.8.8:53

Request

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

IN A

Response

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

IN A

52.3.66.223

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

IN A

3.215.252.162

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

IN A

3.219.165.175

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

IN A

44.193.232.66

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

IN A

34.194.89.143

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

IN A

34.233.140.175

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

IN A

54.91.104.212

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

IN A

52.1.31.221
DNS

event-ingestor.judy.pnap.aditude.cloud

chrome.exe

Remote address:

8.8.8.8:53

Request

event-ingestor.judy.pnap.aditude.cloud

IN A

Response

event-ingestor.judy.pnap.aditude.cloud

IN A

131.153.232.246

event-ingestor.judy.pnap.aditude.cloud

IN A

131.153.232.242

event-ingestor.judy.pnap.aditude.cloud

IN A

131.153.232.244

event-ingestor.judy.pnap.aditude.cloud

IN A

131.153.232.243

event-ingestor.judy.pnap.aditude.cloud

IN A

131.153.232.245

event-ingestor.judy.pnap.aditude.cloud

IN A

131.153.232.247

event-ingestor.judy.pnap.aditude.cloud

IN A

131.153.232.248
OPTIONS

https://lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws/

chrome.exe

Remote address:

52.3.66.223:443

Request

OPTIONS / HTTP/1.1
Host: lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws
Connection: keep-alive
Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://now.gg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Sec-Fetch-Dest: empty
Referer: https://now.gg/
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Sat, 03 Aug 2024 07:01:50 GMT
Content-Type: application/json
Content-Length: 0
Connection: keep-alive
x-amzn-RequestId: d1bafa6c-cdaa-495b-a641-f8f047818667
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: origin,accept,x-amz-date,x-requested-with,content-type
Access-Control-Allow-Methods: *
POST

https://lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws/

chrome.exe

Remote address:

52.3.66.223:443

Request

POST / HTTP/1.1
Host: lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws
Connection: keep-alive
Content-Length: 4362
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json
Accept: */*
Origin: https://now.gg
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://now.gg/
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Sat, 03 Aug 2024 07:01:50 GMT
Content-Type: application/json
Content-Length: 497
Connection: keep-alive
x-amzn-RequestId: 84ebb69a-8922-42b8-b850-803558c2ccee
Access-Control-Allow-Origin: *
access-control-allow-headers: Origin, Accept, X-Requested-With, Content-Type, X-Amz-Date, Authorization, X-Api-Key
access-control-allow-methods: OPTIONS,PUT,HEAD,POST
X-Amzn-Trace-Id: root=1-66add5de-5c1dec7e315997d0346c4c2f;parent=105ad7bb45b04126;sampled=0;lineage=27337487:0
OPTIONS

https://event-ingestor.judy.pnap.aditude.cloud/v1/

chrome.exe

Remote address:

131.153.232.246:443

Request

OPTIONS /v1/ HTTP/2.0
host: event-ingestor.judy.pnap.aditude.cloud
accept: */*
access-control-request-method: POST
access-control-request-headers: content-type
origin: https://now.gg
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 204

date: Sat, 03 Aug 2024 07:01:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: PUT, GET, POST, OPTIONS
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-max-age: 1728000
content-length: 0
POST

https://event-ingestor.judy.pnap.aditude.cloud/v1/

chrome.exe

Remote address:

131.153.232.246:443

Request

POST /v1/ HTTP/2.0
host: event-ingestor.judy.pnap.aditude.cloud
content-length: 4362
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 03 Aug 2024 07:01:50 GMT
content-type: text/plain; charset=utf-8
content-length: 927
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: PUT, GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-credentials: true
DNS

43.98.247.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

43.98.247.34.in-addr.arpa

IN PTR

Response

43.98.247.34.in-addr.arpa

IN PTR

ec2-34-247-98-43 eu-west-1compute amazonawscom
DNS

246.232.153.131.in-addr.arpa

Remote address:

8.8.8.8:53

Request

246.232.153.131.in-addr.arpa

IN PTR

Response
DNS

246.232.153.131.in-addr.arpa

Remote address:

8.8.8.8:53

Request

246.232.153.131.in-addr.arpa

IN PTR

Response
DNS

223.66.3.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

223.66.3.52.in-addr.arpa

IN PTR

Response

223.66.3.52.in-addr.arpa

IN PTR

ec2-52-3-66-223 compute-1 amazonawscom
DNS

now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

now.gg

IN A

Response

now.gg

IN A

18.244.114.57

now.gg

IN A

18.244.114.85

now.gg

IN A

18.244.114.96

now.gg

IN A

18.244.114.51
DNS

now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

now.gg

IN A

Response

now.gg

IN A

18.244.114.85

now.gg

IN A

18.244.114.51

now.gg

IN A

18.244.114.96

now.gg

IN A

18.244.114.57
DNS

cdn.now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.now.gg

IN A

Response

cdn.now.gg

IN CNAME

cdn.now.gg.akamaized.net

cdn.now.gg.akamaized.net

IN CNAME

a1184.dscd.akamai.net

a1184.dscd.akamai.net

IN A

92.123.142.145

a1184.dscd.akamai.net

IN A

92.123.142.67
DNS

cdn.now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.now.gg

IN A

Response

cdn.now.gg

IN CNAME

cdn.now.gg.akamaized.net

cdn.now.gg.akamaized.net

IN CNAME

a1184.dscd.akamai.net

a1184.dscd.akamai.net

IN A

92.123.142.67

a1184.dscd.akamai.net

IN A

92.123.142.145
DNS

57.114.244.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.114.244.18.in-addr.arpa

IN PTR

Response

57.114.244.18.in-addr.arpa

IN PTR

server-18-244-114-57lhr50r cloudfrontnet
DNS

57.114.244.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.114.244.18.in-addr.arpa

IN PTR

Response

57.114.244.18.in-addr.arpa

IN PTR

server-18-244-114-57lhr50r cloudfrontnet
DNS

region1.google-analytics.com

chrome.exe

Remote address:

8.8.8.8:53

Request

region1.google-analytics.com

IN A

Response

region1.google-analytics.com

IN A

216.239.34.36

region1.google-analytics.com

IN A

216.239.32.36
DNS

region1.google-analytics.com

chrome.exe

Remote address:

8.8.8.8:53

Request

region1.google-analytics.com

IN A

Response

region1.google-analytics.com

IN A

216.239.32.36

region1.google-analytics.com

IN A

216.239.34.36
DNS

beacons.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gvt2.com

IN A

Response

beacons.gvt2.com

IN A

142.250.68.227
DNS

beacons.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gvt2.com

IN A

Response

beacons.gvt2.com

IN A

142.250.68.227
OPTIONS

https://beacons.gvt2.com/domainreliability/upload-nel

chrome.exe

Remote address:

142.250.68.227:443

Request

OPTIONS /domainreliability/upload-nel HTTP/2.0
host: beacons.gvt2.com
origin: https://beacons.gcp.gvt2.com
access-control-request-method: POST
access-control-request-headers: content-type
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
POST

https://beacons.gvt2.com/domainreliability/upload-nel

chrome.exe

Remote address:

142.250.68.227:443

Request

POST /domainreliability/upload-nel HTTP/2.0
host: beacons.gvt2.com
content-length: 404
content-type: application/reports+json
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
DNS

227.68.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

227.68.250.142.in-addr.arpa

IN PTR

Response

227.68.250.142.in-addr.arpa

IN PTR

lcphxq-ab-in-f31e100net
DNS

now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

now.gg

IN A

Response

now.gg

IN A

18.244.114.57

now.gg

IN A

18.244.114.96

now.gg

IN A

18.244.114.85

now.gg

IN A

18.244.114.51
DNS

3.5.168.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.5.168.192.in-addr.arpa

IN PTR

Response
DNS

now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

now.gg

IN A

Response

now.gg

IN A

18.244.114.96

now.gg

IN A

18.244.114.51

now.gg

IN A

18.244.114.57

now.gg

IN A

18.244.114.85
DNS

now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

now.gg

IN A

Response

now.gg

IN A

18.244.114.57

now.gg

IN A

18.244.114.96

now.gg

IN A

18.244.114.51

now.gg

IN A

18.244.114.85
DNS

notify.bugsnag.com

chrome.exe

Remote address:

8.8.8.8:53

Request

notify.bugsnag.com

IN A

Response

notify.bugsnag.com

IN A

35.186.205.6
OPTIONS

https://notify.bugsnag.com/

chrome.exe

Remote address:

35.186.205.6:443

Request

OPTIONS / HTTP/2.0
host: notify.bugsnag.com
accept: */*
access-control-request-method: POST
access-control-request-headers: bugsnag-api-key,bugsnag-payload-version,bugsnag-sent-at,content-type
origin: https://now.gg
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
POST

https://notify.bugsnag.com/

chrome.exe

Remote address:

35.186.205.6:443

Request

POST / HTTP/2.0
host: notify.bugsnag.com
content-length: 9338
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
bugsnag-api-key: 5409ce593426cf95bd284a5b809c62c5
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json
bugsnag-payload-version: 4
bugsnag-sent-at: 2024-08-03T07:05:42.677Z
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://now.gg
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://now.gg/
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
DNS

6.205.186.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

6.205.186.35.in-addr.arpa

IN PTR

Response

6.205.186.35.in-addr.arpa

IN PTR

620518635bcgoogleusercontentcom
DNS

6.205.186.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

6.205.186.35.in-addr.arpa

IN PTR

Response

6.205.186.35.in-addr.arpa

IN PTR

620518635bcgoogleusercontentcom
DNS

now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

now.gg

IN A

Response

now.gg

IN A

18.244.114.96

now.gg

IN A

18.244.114.85

now.gg

IN A

18.244.114.57

now.gg

IN A

18.244.114.51
DNS

now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

now.gg

IN A

Response

now.gg

IN A

18.244.114.96

now.gg

IN A

18.244.114.85

now.gg

IN A

18.244.114.51

now.gg

IN A

18.244.114.57
DNS

now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

now.gg

IN A

Response

now.gg

IN A

18.244.114.85

now.gg

IN A

18.244.114.96

now.gg

IN A

18.244.114.51

now.gg

IN A

18.244.114.57
DNS

now.gg

chrome.exe

Remote address:

8.8.8.8:53

Request

now.gg

IN A

Response

now.gg

IN A

18.244.114.57

now.gg

IN A

18.244.114.51

now.gg

IN A

18.244.114.85

now.gg

IN A

18.244.114.96

162.159.128.233:443

discord.com

tls

c-realV2.exe

1.3kB
5.1kB
10
10
162.159.128.233:443

discord.com

tls

c-realV2.exe

1.2kB
5.0kB
9
9
142.250.27.105:443

https://www.google.com/async/ddljson?async=ntp:2

tls, http2

chrome.exe

1.9kB
7.7kB
20
23

HTTP Request

GET https://www.google.com/async/ddljson?async=ntp:2
142.250.27.138:443

chrome.google.com

tls, http2

chrome.exe

1.1kB
8.1kB
10
9
18.244.114.96:443

now.gg

tls

chrome.exe

1.1kB
6.5kB
9
10
18.244.114.96:443

https://now.gg/oapi/3/play/v1/reportEvent

tls, http2

chrome.exe

49.0kB
445.9kB
300
432

HTTP Request

GET https://now.gg/

HTTP Response

200

HTTP Request

GET https://now.gg/3/play/assets/_next/static/media/black-bg.6fdd970d.jpg

HTTP Request

GET https://now.gg/3/play/assets/_next/static/css/styles.7933200532079b88.css

HTTP Request

GET https://now.gg/3/play/assets/_next/static/chunks/6268.fb5d7e6dd3c32816.js

HTTP Request

GET https://now.gg/3/play/assets/_next/static/chunks/8548.06dc7014a53564fc.js

HTTP Request

GET https://now.gg/3/play/assets/_next/static/chunks/2850.1190c88965fb9d50.js

HTTP Request

GET https://now.gg/3/play/assets/_next/static/chunks/webpack-3698ef9b81f29d93.js

HTTP Request

GET https://now.gg/3/play/assets/_next/static/chunks/main-dfef43da2d4fd3f3.js

HTTP Request

GET https://now.gg/3/play/assets/_next/static/chunks/pages/_app-e072317cf5e05e4d.js

HTTP Request

GET https://now.gg/3/play/assets/_next/static/chunks/pages/browse-9650215236fd3cac.js

HTTP Request

GET https://now.gg/3/play/assets/_next/static/xx2ZqFjMNFpI9ABwUOmr9/_buildManifest.js

HTTP Request

GET https://now.gg/3/play/assets/_next/static/xx2ZqFjMNFpI9ABwUOmr9/_ssgManifest.js

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200

HTTP Request

POST https://now.gg/oapi/3/play/v1/reportEvent

HTTP Response

200
92.123.142.145:443

https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.game.nfs14_row%2Ficon%2Fneed-for-speed-no-limits.png&w=128&q=90

tls, http

chrome.exe

2.3kB
10.9kB
19
21

HTTP Request

GET https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.game.nfs14_row%2Ficon%2Fneed-for-speed-no-limits.png&w=128&q=90

HTTP Response

200
92.123.142.145:443

https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.gp.fifamobile%2Ficon%2Fea-sports-fc-mobile-24-soccer.png&w=128&q=90

tls, http

chrome.exe

2.2kB
11.7kB
19
22

HTTP Request

GET https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.gp.fifamobile%2Ficon%2Fea-sports-fc-mobile-24-soccer.png&w=128&q=90

HTTP Response

200
92.123.142.145:443

https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.gp.maddennfl21mobile%2Ficon%2Fmadden-nfl-24-mobile-football.png&w=128&q=90

tls, http

chrome.exe

2.2kB
12.5kB
19
22

HTTP Request

GET https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.ea.gp.maddennfl21mobile%2Ficon%2Fmadden-nfl-24-mobile-football.png&w=128&q=90

HTTP Response

200
92.123.142.145:443

https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2F8823%2Ficon%2Fgrand-auto-sandbox.png&w=128&q=90

tls, http

chrome.exe

2.3kB
13.0kB
20
23

HTTP Request

GET https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2F8823%2Ficon%2Fgrand-auto-sandbox.png&w=128&q=90

HTTP Response

200
92.123.142.145:443

https://cdn.now.gg/nowgg-static/social/tiktok.svg

tls, http

chrome.exe

2.0kB
8.1kB
18
19

HTTP Request

GET https://cdn.now.gg/nowgg-static/social/tiktok.svg

HTTP Response

200
92.123.142.145:443

https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.weaver.app.prod%2Ficon%2Ftalkie-soulful-ai.png&w=128&q=90

tls, http

chrome.exe

2.2kB
13.0kB
19
22

HTTP Request

GET https://cdn.now.gg/assets-opt/_next/image?url=https%3A%2F%2Fcdn.now.gg%2Fapps-content%2Fcom.weaver.app.prod%2Ficon%2Ftalkie-soulful-ai.png&w=128&q=90

HTTP Response

200
18.244.114.102:443

https://cmp.inmobi.com/tcfv2/53/cmp2ui-en.js

tls, http2

chrome.exe

4.3kB
130.8kB
66
110

HTTP Request

GET https://cmp.inmobi.com/choice/mw9xJtqPQGFbC/now.gg/choice.js?tag_version=V3

HTTP Response

200

HTTP Request

GET https://cmp.inmobi.com/tcfv2/53/cmp2.js?referer=now.gg

HTTP Response

200

HTTP Request

GET https://cmp.inmobi.com/tcfv2/53/cmp2ui-en.js

HTTP Response

200
35.190.88.7:443

https://sessions.bugsnag.com/

tls, http2

chrome.exe

4.5kB
6.8kB
38
38

HTTP Request

OPTIONS https://sessions.bugsnag.com/

HTTP Request

OPTIONS https://sessions.bugsnag.com/

HTTP Request

POST https://sessions.bugsnag.com/

HTTP Request

POST https://sessions.bugsnag.com/

HTTP Request

POST https://sessions.bugsnag.com/
35.190.88.7:443

sessions.bugsnag.com

chrome.exe

190 B
92 B
4
2
142.250.102.95:443

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTIzLjAuNjMxMi4xMjMSIAloo5A3dKdbOxIFDYS_YqQSBQ09BEhDITuWry7XPY8B?alt=proto

tls, http2

chrome.exe

3.0kB
7.6kB
31
27

HTTP Request

GET https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTIzLjAuNjMxMi4xMjMSGQkF4z3jqyy9UxIFDYS_YqQhpCXilIMByqk=?alt=proto

HTTP Request

GET https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTIzLjAuNjMxMi4xMjMSIAloo5A3dKdbOxIFDYS_YqQSBQ09BEhDITuWry7XPY8B?alt=proto
18.244.114.102:443

https://cmp.inmobi.com/geoip

tls, http2

chrome.exe

4.8kB
117.8kB
73
105

HTTP Request

GET https://cmp.inmobi.com/geoip

HTTP Response

200

HTTP Request

GET https://cmp.inmobi.com/GVL-v2/cmp-list.json

HTTP Response

200

HTTP Request

GET https://cmp.inmobi.com/GVL-v3/vendor-list-trimmed-v1.json

HTTP Request

GET https://cmp.inmobi.com/tcfv2/google-atp-list.json

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://cmp.inmobi.com/geoip

HTTP Response

200

HTTP Request

GET https://cmp.inmobi.com/geoip

HTTP Response

200
3.78.104.71:443

https://api.cmp.inmobi.com/?log=%7B%22userEvents%22%3A%5B%7B%22clientTimestamp%22%3A1722668456518%2C%22event%22%3A%22startOnPage%3AGDPR_0%22%7D%2C%7B%22clientTimestamp%22%3A1722668458858%2C%22event%22%3A%22rejectAll%3Aclick%22%7D%5D%2C%22acceptanceState%22%3A%22Reject%22%2C%22objectionState%22%3A%22None%22%2C%22tcData%22%3A%22CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA%22%2C%22nonIabConsentData%22%3A%22%22%2C%22clientTimestamp%22%3A1722668458858%2C%22operationType%22%3A%22done%22%2C%22sessionId%22%3A%22GDPR-mu2k57jhovys56d23zuf%22%7D

tls, http2

chrome.exe

2.8kB
6.4kB
16
21

HTTP Request

GET https://api.cmp.inmobi.com/?log=%7B%22accountId%22%3A%22mw9xJtqPQGFbC%22%2C%22domain%22%3A%22now.gg%22%2C%22publisher%22%3A%22now.gg%22%2C%22cmpId%22%3A10%2C%22cmpVersion%22%3A%222.53%22%2C%22displayType%22%3A%22tcfui%3Amandatory%22%2C%22configurationHashCode%22%3A%225Q58yPiqWzJ%2B%2BZWOMHrdIw%22%2C%22tagVersion%22%3A%22V3%22%2C%22gvlVersion%22%3A3%2C%22clientTimestamp%22%3A1722668456518%2C%22operationType%22%3A%22init%22%2C%22sessionId%22%3A%22GDPR-mu2k57jhovys56d23zuf%22%7D

HTTP Response

200

HTTP Request

GET https://api.cmp.inmobi.com/?log=%7B%22userEvents%22%3A%5B%7B%22clientTimestamp%22%3A1722668456518%2C%22event%22%3A%22startOnPage%3AGDPR_0%22%7D%2C%7B%22clientTimestamp%22%3A1722668458858%2C%22event%22%3A%22rejectAll%3Aclick%22%7D%5D%2C%22acceptanceState%22%3A%22Reject%22%2C%22objectionState%22%3A%22None%22%2C%22tcData%22%3A%22CQCxn4AQCxn4AAKA1AENBAFgAAAAAEPgACiQAAAUvAJMNCogDLIkJCDQMIIEAKgrCAigQAAAAkDRAQAmDAp2BgEusJEAIAUAAwQAgABRkACAAASABCIAIACgQAAQCBQABgAQDAQAMDAAGACwEAgABAdAhTAggUCwASMyIhTAhCASCAlsqEEgCBBXCEIs8CCAREwUAAAJABWAAICwWBxJICViQQJcQbQAAEACAQQAVCKTswBBAGbLVXiybRlaQFo-YLntMAwAAAAA.YAAAAAAAAAAA%22%2C%22nonIabConsentData%22%3A%22%22%2C%22clientTimestamp%22%3A1722668458858%2C%22operationType%22%3A%22done%22%2C%22sessionId%22%3A%22GDPR-mu2k57jhovys56d23zuf%22%7D

HTTP Response

200
142.250.102.84:443

https://accounts.google.com/gsi/status?client_id=543291291905-vss63ln3o2hklepv16rbdrddrp81ibju.apps.googleusercontent.com&as=30%2F0voJHVXZzZ%2FCP0Ge%2FGw&has_opted_out_fedcm=true

tls, http2

chrome.exe

4.2kB
100.5kB
59
99

HTTP Request

GET https://accounts.google.com/gsi/client

HTTP Request

GET https://accounts.google.com/gsi/style

HTTP Request

GET https://accounts.google.com/gsi/status?client_id=543291291905-vss63ln3o2hklepv16rbdrddrp81ibju.apps.googleusercontent.com&as=30%2F0voJHVXZzZ%2FCP0Ge%2FGw&has_opted_out_fedcm=true
216.239.34.36:443

https://region1.google-analytics.com/g/collect?v=2&tid=G-8VVPTD9ZTY&gtm=45je47v0v883457966za200&_p=1722668459165&gcs=G10-&gcd=13m3l3m3m5&npa=1&dma_cps=-&dma=1&tcfd=10a56&tag_exp=95250753&cid=1655543314.1722668459&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.123%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.123&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&frm=0&pscdl=denied&_eu=AEA&_s=2&sid=1722668459&sct=1&seg=0&dl=https%3A%2F%2Fnow.gg%2F&dt=Play%20Online%20Games%20for%20Free%20%7C%20now.gg%20Mobile%20Cloud&en=scroll&epn.percent_scrolled=90&_et=20&tfd=9166

tls, http2

chrome.exe

3.0kB
7.5kB
22
24

HTTP Request

POST https://region1.google-analytics.com/g/collect?v=2&tid=G-8VVPTD9ZTY&gtm=45je47v0v883457966za200&_p=1722668459165&gcs=G10-&gcd=13m3l3m3m5&npa=1&dma_cps=-&dma=1&tcfd=10a56&tag_exp=95250753&cid=1655543314.1722668459&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.123%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.123&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&frm=0&pscdl=denied&_s=1&sid=1722668459&sct=1&seg=0&dl=https%3A%2F%2Fnow.gg%2F&dt=Play%20Online%20Games%20for%20Free%20%7C%20now.gg%20Mobile%20Cloud&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=4138

HTTP Request

POST https://region1.google-analytics.com/g/collect?v=2&tid=G-8VVPTD9ZTY&gtm=45je47v0v883457966za200&_p=1722668459165&gcs=G10-&gcd=13m3l3m3m5&npa=1&dma_cps=-&dma=1&tcfd=10a56&tag_exp=95250753&cid=1655543314.1722668459&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.123%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.123&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&frm=0&pscdl=denied&_eu=AEA&_s=2&sid=1722668459&sct=1&seg=0&dl=https%3A%2F%2Fnow.gg%2F&dt=Play%20Online%20Games%20for%20Free%20%7C%20now.gg%20Mobile%20Cloud&en=scroll&epn.percent_scrolled=90&_et=20&tfd=9166
34.160.86.181:443

https://cloud.bluestacks.com/get_cfg_info?package_name=gg.now.client.android_imgd&parser_version=17

tls, http2

chrome.exe

2.9kB
6.1kB
31
28

HTTP Request

GET https://cloud.bluestacks.com/get_cfg_info?package_name=com.roblox.client_imgd&parser_version=17

HTTP Request

GET https://cloud.bluestacks.com/get_cfg_info?package_name=gg.now.client.android_imgd&parser_version=17
52.8.8.59:443

https://eb.bluestacks.com/content_keymap/com.roblox.client_imgd.cfg?parserver=17&cache=True

tls, http2

chrome.exe

2.8kB
14.0kB
21
19

HTTP Request

GET https://eb.bluestacks.com/content_keymap/com.roblox.client_imgd.cfg?parserver=17&cache=True

HTTP Response

200
13.224.245.27:443

https://static.hotjar.com/c/hotjar-848438.js?sv=6

tls, http2

chrome.exe

2.5kB
12.4kB
20
25

HTTP Request

GET https://static.hotjar.com/c/hotjar-848438.js?sv=6

HTTP Response

200
13.224.245.27:443

static.hotjar.com

tls, http2

chrome.exe

1.2kB
6.7kB
13
12
18.244.140.75:443

https://dn0qt3r0xannq.cloudfront.net/nowgg-IZQznjkQaj/nowgg-default/prebid-wrapper.js

tls, http2

chrome.exe

3.1kB
127.3kB
43
106

HTTP Request

GET https://dn0qt3r0xannq.cloudfront.net/nowgg-IZQznjkQaj/nowgg-default/prebid-load.js

HTTP Response

200

HTTP Request

GET https://dn0qt3r0xannq.cloudfront.net/nowgg-IZQznjkQaj/nowgg-default/prebid-wrapper.js

HTTP Response

200
142.250.69.3:443

https://beacons.gcp.gvt2.com/domainreliability/upload

tls, http2

chrome.exe

3.6kB
7.8kB
28
31

HTTP Request

POST https://beacons.gcp.gvt2.com/domainreliability/upload

HTTP Request

POST https://beacons.gcp.gvt2.com/domainreliability/upload
172.67.10.132:443

https://raven-static.aditude.io/prod/1.1.18/raven.js

tls, http2

chrome.exe

2.3kB
42.7kB
24
52

HTTP Request

GET https://raven-edge.aditude.io/raven/nowgg-main-TcY9v/library.js

HTTP Response

200

HTTP Request

GET https://raven-static.aditude.io/prod/1.1.18/raven.js

HTTP Response

200
104.18.23.145:443

https://cadmus.script.ac/d1ag38bbwvwx1z/script.js

tls, http2

chrome.exe

2.4kB
62.1kB
29
83

HTTP Request

GET https://cadmus.script.ac/d1ag38bbwvwx1z/script.js

HTTP Response

200
104.22.60.119:443

https://edge.aditude.io/prebid/8.31.0.js?v=0560d1800daafc044be92e455261780d&modules=WyIzM2Fjcm9zc0JpZEFkYXB0ZXIiLCIzM2Fjcm9zc0lkU3lzdGVtIiwiYWRhZ2lvQmlkQWRhcHRlciIsImFkaXR1ZGUiLCJhZHBvZCIsImFteEJpZEFkYXB0ZXIiLCJhcHBuZXh1c0JpZEFkYXB0ZXIiLCJjb25zZW50TWFuYWdlbWVudCIsImNvbnNlbnRNYW5hZ2VtZW50VXNwIiwiY3Btc3RhckN1c3RvbUJpZEFkYXB0ZXIiLCJjcml0ZW9CaWRBZGFwdGVyIiwiY3JpdGVvSWRTeXN0ZW0iLCJjdXJyZW5jeSIsImRmcEFkU2VydmVyVmlkZW8iLCJlbnJpY2htZW50RnBkTW9kdWxlIiwiZmFicmlja0lkU3lzdGVtIiwiZ2RwckVuZm9yY2VtZW50IiwiZ3B0UHJlQXVjdGlvbiIsImd1bWd1bUJpZEFkYXB0ZXIiLCJpZDVJZFN5c3RlbSIsImluc3RpY2F0b3JCaWRBZGFwdGVyIiwiaW5zdHJlYW1UcmFja2luZyIsIml4QmlkQWRhcHRlciIsImt1ZWV6UnRiQmlkQWRhcHRlciIsImxpbWVsaWdodERpZ2l0YWxCaWRBZGFwdGVyIiwibHVuYW1lZGlhaGJCaWRBZGFwdGVyIiwibWludXRlbWVkaWFCaWRBZGFwdGVyIiwib25ldGFnQmlkQWRhcHRlciIsInByZWJpZFNlcnZlckJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1YlByb3ZpZGVkSWRTeXN0ZW0iLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2hhcmVkSWRTeXN0ZW0iLCJzaGFyZXRocm91Z2hCaWRBZGFwdGVyIiwic21hcnRhZHNlcnZlckJpZEFkYXB0ZXIiLCJzbWlsZXdhbnRlZEJpZEFkYXB0ZXIiLCJzb3ZybkJpZEFkYXB0ZXIiLCJ0cmlwbGVsaWZ0QmlkQWRhcHRlciIsInVuaWZpZWRJZFN5c3RlbSIsInZhbGlkYXRpb25GcGRNb2R1bGUiLCJ2aWRhem9vQmlkQWRhcHRlciIsInZpZGVvTW9kdWxlIiwiemV0YV9nbG9iYWxfc3NwQmlkQWRhcHRlciJd

tls, http2

chrome.exe

4.0kB
181.4kB
41
149

HTTP Request

GET https://edge.aditude.io/prebid/8.31.0.js?v=0560d1800daafc044be92e455261780d&modules=WyIzM2Fjcm9zc0JpZEFkYXB0ZXIiLCIzM2Fjcm9zc0lkU3lzdGVtIiwiYWRhZ2lvQmlkQWRhcHRlciIsImFkaXR1ZGUiLCJhZHBvZCIsImFteEJpZEFkYXB0ZXIiLCJhcHBuZXh1c0JpZEFkYXB0ZXIiLCJjb25zZW50TWFuYWdlbWVudCIsImNvbnNlbnRNYW5hZ2VtZW50VXNwIiwiY3Btc3RhckN1c3RvbUJpZEFkYXB0ZXIiLCJjcml0ZW9CaWRBZGFwdGVyIiwiY3JpdGVvSWRTeXN0ZW0iLCJjdXJyZW5jeSIsImRmcEFkU2VydmVyVmlkZW8iLCJlbnJpY2htZW50RnBkTW9kdWxlIiwiZmFicmlja0lkU3lzdGVtIiwiZ2RwckVuZm9yY2VtZW50IiwiZ3B0UHJlQXVjdGlvbiIsImd1bWd1bUJpZEFkYXB0ZXIiLCJpZDVJZFN5c3RlbSIsImluc3RpY2F0b3JCaWRBZGFwdGVyIiwiaW5zdHJlYW1UcmFja2luZyIsIml4QmlkQWRhcHRlciIsImt1ZWV6UnRiQmlkQWRhcHRlciIsImxpbWVsaWdodERpZ2l0YWxCaWRBZGFwdGVyIiwibHVuYW1lZGlhaGJCaWRBZGFwdGVyIiwibWludXRlbWVkaWFCaWRBZGFwdGVyIiwib25ldGFnQmlkQWRhcHRlciIsInByZWJpZFNlcnZlckJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1YlByb3ZpZGVkSWRTeXN0ZW0iLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2hhcmVkSWRTeXN0ZW0iLCJzaGFyZXRocm91Z2hCaWRBZGFwdGVyIiwic21hcnRhZHNlcnZlckJpZEFkYXB0ZXIiLCJzbWlsZXdhbnRlZEJpZEFkYXB0ZXIiLCJzb3ZybkJpZEFkYXB0ZXIiLCJ0cmlwbGVsaWZ0QmlkQWRhcHRlciIsInVuaWZpZWRJZFN5c3RlbSIsInZhbGlkYXRpb25GcGRNb2R1bGUiLCJ2aWRhem9vQmlkQWRhcHRlciIsInZpZGVvTW9kdWxlIiwiemV0YV9nbG9iYWxfc3NwQmlkQWRhcHRlciJd

HTTP Response

200
104.22.34.123:443

https://otrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdrd&_=1722668504897

tls, http2

chrome.exe

7.3kB
39.5kB
47
73

HTTP Request

GET https://static.kueezrtb.com/latest.js

HTTP Response

200

HTTP Request

GET https://static.kueezrtb.com/js/latest.js?_=1722668504429

HTTP Response

200

HTTP Request

POST https://track.kueezrtb.com/dye?_=1722668504428&type=latest:boot&ac=2&acm=g3l&h=now.gg&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&beacon=1

HTTP Request

POST https://gtrack.kueezrtb.com/dye?_=1722668504428&type=latest:boot&ac=2&acm=g3l&h=now.gg&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&beacon=1

HTTP Response

204

HTTP Response

204

HTTP Request

GET https://track.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:preinit&_=1722668504676

HTTP Request

GET https://gtrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:preinit&_=1722668504676

HTTP Request

GET https://track.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:init&_=1722668504689

HTTP Request

GET https://gtrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:init&_=1722668504689

HTTP Request

GET https://track.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdr&_=1722668504690

HTTP Request

GET https://gtrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdr&_=1722668504690

HTTP Request

GET https://u.kueezrtb.com/fpd?_=1722668504690&yv=161cad2&h=now.gg

HTTP Request

GET https://otrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:init&_=1722668504689

HTTP Request

GET https://otrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:preinit&_=1722668504676

HTTP Request

GET https://otrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdr&_=1722668504690

HTTP Response

204

HTTP Response

204

HTTP Response

204

HTTP Response

204

HTTP Response

204

HTTP Response

204

HTTP Response

200

HTTP Response

204

HTTP Request

GET https://track.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdrd&_=1722668504897

HTTP Request

GET https://gtrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdrd&_=1722668504897

HTTP Request

GET https://otrack.kueezrtb.com/dye?ac=2&acm=G3L&uid=971e88a8e11889f5&sid=f4e83f0c1e78182&pvi=d37c802ee6a9399&h=now.gg&wh=1280x593&b=Chrome&bv=123.0.0.0&dev=&os=Windows%2010&p=&uri=%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&furl=https%3A%2F%2Fnow.gg%2Fapps%2Froblox-corporation%2F5349%2Froblox.html&sr=1280x720&type=latest:fpdrd&_=1722668504897

HTTP Response

204

HTTP Response

204

HTTP Response

204

HTTP Response

204

HTTP Response

204
104.18.28.64:443

https://static.vidazoo.com/basev/tcf/1.0.3/tcf.js

tls, http2

chrome.exe

2.5kB
58.9kB
27
69

HTTP Request

GET https://static.vidazoo.com/basev/vwpt.js

HTTP Response

200

HTTP Request

GET https://static.vidazoo.com/basev/cmp/1.0.1/cmp.js

HTTP Request

GET https://static.vidazoo.com/basev/tcf/1.0.3/tcf.js

HTTP Response

200

HTTP Response

200
104.18.167.224:443

https://pub.doubleverify.com/signals/pub.js

tls, http2

chrome.exe

2.0kB
16.8kB
20
31

HTTP Request

GET https://pub.doubleverify.com/signals/pub.js

HTTP Response

200
142.250.27.155:443

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202407300101/pubads_impl.js

tls, http2

chrome.exe

4.1kB
199.4kB
62
160

HTTP Request

GET https://www.googletagservices.com/tag/js/gpt.js

HTTP Request

GET https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202407300101/pubads_impl.js
34.95.69.49:443

https://i.clean.gg/1a

tls, http2

chrome.exe

3.1kB
6.8kB
24
26

HTTP Request

OPTIONS https://i.clean.gg/1a

HTTP Request

POST https://i.clean.gg/1a
18.172.153.127:443

https://geo-location.prebid.cloud/v1/geo

tls, http2

chrome.exe

1.8kB
7.6kB
16
20

HTTP Request

GET https://geo-location.prebid.cloud/v1/geo

HTTP Response

200
18.165.201.18:443

https://production-raven.infra.aditude.cloud/geo

tls, http2

chrome.exe

1.9kB
8.0kB
17
22

HTTP Request

GET https://production-raven.infra.aditude.cloud/geo

HTTP Response

200
151.101.129.229:443

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20240803

tls, http2

chrome.exe

2.0kB
7.5kB
20
24

HTTP Request

GET https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20240803

HTTP Response

200
13.224.223.9:443

https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fnow.gg&pubid=763aebd8-5c09-4e7c-8035-dd824f7f190b

tls, http2

chrome.exe

2.9kB
90.9kB
37
81

HTTP Request

GET https://c.amazon-adsystem.com/aax2/apstag.js

HTTP Response

200

HTTP Request

GET https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fnow.gg&pubid=763aebd8-5c09-4e7c-8035-dd824f7f190b

HTTP Response

200
13.224.223.9:443

https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js

tls, http2

chrome.exe

2.0kB
10.4kB
18
22

HTTP Request

GET https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js

HTTP Response

200
52.84.90.106:443

https://config.aps.amazon-adsystem.com/configs/763aebd8-5c09-4e7c-8035-dd824f7f190b

tls, http2

chrome.exe

1.9kB
8.0kB
17
21

HTTP Request

GET https://config.aps.amazon-adsystem.com/configs/763aebd8-5c09-4e7c-8035-dd824f7f190b

HTTP Response

200
172.67.10.132:443

https://raven-edge.aditude.io/api/v1/ravenconfig?ppid=nowgg-main-TcY9v&geo=GB

tls, http2

chrome.exe

2.0kB
5.1kB
19
22

HTTP Request

GET https://raven-edge.aditude.io/api/v1/ravenconfig?ppid=nowgg-main-TcY9v&geo=GB

HTTP Response

200
18.245.143.83:443

https://tags.crwdcntrl.net/lt/c/16576/sync.min.js

tls, http2

chrome.exe

2.1kB
20.1kB
22
30

HTTP Request

GET https://tags.crwdcntrl.net/lt/c/16576/sync.min.js

HTTP Response

200
23.49.161.153:443

https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js

tls, http2

chrome.exe

1.9kB
23.3kB
18
30

HTTP Request

GET https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js

HTTP Response

200
104.22.53.86:443

https://cdn.id5-sync.com/api/1.0/id5-api.js

tls, http2

chrome.exe

2.1kB
34.0kB
22
48

HTTP Request

GET https://cdn.id5-sync.com/api/1.0/id5-api.js

HTTP Response

200
63.33.40.35:443

https://bcp.crwdcntrl.net/6/map

tls, http2

chrome.exe

2.6kB
6.9kB
14
18

HTTP Request

POST https://bcp.crwdcntrl.net/6/map

HTTP Response

200
18.245.253.22:443

https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js

tls, http2

chrome.exe

3.2kB
68.2kB
43
63

HTTP Request

GET https://script.hotjar.com/modules.8da33a8f469c3b5ffcec.js

HTTP Response

200

HTTP Request

GET https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js

HTTP Response

200
99.84.9.16:443

https://vc.hotjar.io/sessions/848438?s=0.25&r=0.1124561975686873

tls, http2

chrome.exe

1.9kB
6.0kB
17
20

HTTP Request

GET https://vc.hotjar.io/sessions/848438?s=0.25&r=0.1124561975686873

HTTP Response

204
104.18.11.176:443

https://mp.4dex.io/prebid

tls, http2

chrome.exe

2.0kB
4.1kB
19
19

HTTP Request

POST https://mp.4dex.io/prebid

HTTP Response

204
34.247.98.43:443

https://metrics.hotjar.io/?v=6&site_id=848438

tls, http2

chrome.exe

2.0kB
5.5kB
16
18

HTTP Request

POST https://metrics.hotjar.io/?v=6&site_id=848438

HTTP Response

204
52.3.66.223:443

https://lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws/

tls, http

chrome.exe

7.3kB
8.2kB
25
25

HTTP Request

OPTIONS https://lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws/

HTTP Response

200

HTTP Request

POST https://lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws/

HTTP Response

200
131.153.232.246:443

https://event-ingestor.judy.pnap.aditude.cloud/v1/

tls, http2

chrome.exe

6.5kB
5.8kB
19
18

HTTP Request

OPTIONS https://event-ingestor.judy.pnap.aditude.cloud/v1/

HTTP Response

204

HTTP Request

POST https://event-ingestor.judy.pnap.aditude.cloud/v1/

HTTP Response

200
142.250.102.84:443

accounts.google.com

tls, http2

chrome.exe

1.2kB
5.8kB
12
12
142.250.68.227:443

https://beacons.gvt2.com/domainreliability/upload-nel

tls, http2

chrome.exe

2.7kB
7.7kB
24
28

HTTP Request

OPTIONS https://beacons.gvt2.com/domainreliability/upload-nel

HTTP Request

POST https://beacons.gvt2.com/domainreliability/upload-nel
35.186.205.6:443

https://notify.bugsnag.com/

tls, http2

chrome.exe

11.9kB
5.8kB
26
28

HTTP Request

OPTIONS https://notify.bugsnag.com/

HTTP Request

POST https://notify.bugsnag.com/

8.8.8.8:53

0.159.190.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

0.159.190.20.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

19.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

19.229.111.52.in-addr.arpa
8.8.8.8:53

discord.com

dns

c-realV2.exe

57 B
137 B
1
1

DNS Request

discord.com

DNS Response

162.159.128.233

162.159.136.232

162.159.137.232

162.159.138.232

162.159.135.232
8.8.8.8:53

233.128.159.162.in-addr.arpa

dns

74 B
136 B
1
1

DNS Request

233.128.159.162.in-addr.arpa
8.8.8.8:53

www.google.com

dns

chrome.exe

60 B
156 B
1
1

DNS Request

www.google.com

DNS Response

142.250.27.105

142.250.27.106

142.250.27.99

142.250.27.147

142.250.27.103

142.250.27.104
142.250.27.105:443

www.google.com

https

chrome.exe

4.0kB
20.2kB
29
33
8.8.8.8:53

chrome.google.com

dns

chrome.exe

63 B
180 B
1
1

DNS Request

chrome.google.com

DNS Response

142.250.27.138

142.250.27.139

142.250.27.102

142.250.27.101

142.250.27.100

142.250.27.113
8.8.8.8:53

95.27.250.142.in-addr.arpa

dns

72 B
105 B
1
1

DNS Request

95.27.250.142.in-addr.arpa
8.8.8.8:53

105.27.250.142.in-addr.arpa

dns

73 B
107 B
1
1

DNS Request

105.27.250.142.in-addr.arpa
8.8.8.8:53

94.27.250.142.in-addr.arpa

dns

72 B
105 B
1
1

DNS Request

94.27.250.142.in-addr.arpa
8.8.8.8:53

138.27.250.142.in-addr.arpa

dns

73 B
107 B
1
1

DNS Request

138.27.250.142.in-addr.arpa
224.0.0.251:5353

chrome.exe

862 B
7
8.8.8.8:53

clients2.google.com

dns

chrome.exe

65 B
185 B
1
1

DNS Request

clients2.google.com

DNS Response

142.250.102.113

142.250.102.102

142.250.102.101

142.250.102.139

142.250.102.100

142.250.102.138
142.250.102.113:443

clients2.google.com

https

chrome.exe

2.4kB
8.1kB
9
11
8.8.8.8:53

113.102.250.142.in-addr.arpa

dns

74 B
108 B
1
1

DNS Request

113.102.250.142.in-addr.arpa
8.8.8.8:53

now.gg

dns

chrome.exe

52 B
116 B
1
1

DNS Request

now.gg

DNS Response

18.244.114.96

18.244.114.85

18.244.114.51

18.244.114.57
8.8.8.8:53

cdn.now.gg

dns

chrome.exe

56 B
158 B
1
1

DNS Request

cdn.now.gg

DNS Response

92.123.142.145

92.123.142.67
18.244.114.96:443

now.gg

https

chrome.exe

266.2kB
797.4kB
490
854
92.123.142.145:443

cdn.now.gg

https

chrome.exe

409.5kB
13.9MB
3710
14378
8.8.8.8:53

cmp.inmobi.com

dns

chrome.exe

60 B
206 B
1
1

DNS Request

cmp.inmobi.com

DNS Response

18.244.114.102

18.244.114.32

18.244.114.118

18.244.114.17
8.8.8.8:53

sessions.bugsnag.com

dns

chrome.exe

66 B
82 B
1
1

DNS Request

sessions.bugsnag.com

DNS Response

35.190.88.7
35.190.88.7:443

sessions.bugsnag.com

https

chrome.exe

4.1kB
4.9kB
17
17
92.123.142.145:443

cdn.now.gg

https

chrome.exe

2.5kB
19.5kB
13
22
8.8.8.8:53

content-autofill.googleapis.com

dns

chrome.exe

77 B
109 B
1
1

DNS Request

content-autofill.googleapis.com

DNS Response

142.250.102.95

142.250.27.95
8.8.8.8:53

96.114.244.18.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

96.114.244.18.in-addr.arpa
8.8.8.8:53

145.142.123.92.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

145.142.123.92.in-addr.arpa
8.8.8.8:53

94.102.250.142.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

94.102.250.142.in-addr.arpa
8.8.8.8:53

102.114.244.18.in-addr.arpa

dns

73 B
131 B
1
1

DNS Request

102.114.244.18.in-addr.arpa
8.8.8.8:53

7.88.190.35.in-addr.arpa

dns

70 B
120 B
1
1

DNS Request

7.88.190.35.in-addr.arpa
8.8.8.8:53

95.102.250.142.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

95.102.250.142.in-addr.arpa
8.8.8.8:53

api.cmp.inmobi.com

dns

chrome.exe

64 B
224 B
1
1

DNS Request

api.cmp.inmobi.com

DNS Response

3.78.104.71

52.57.223.191

3.127.100.137
8.8.8.8:53

accounts.google.com

dns

chrome.exe

65 B
81 B
1
1

DNS Request

accounts.google.com

DNS Response

142.250.102.84
8.8.8.8:53

71.104.78.3.in-addr.arpa

dns

70 B
134 B
1
1

DNS Request

71.104.78.3.in-addr.arpa
8.8.8.8:53

84.102.250.142.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

84.102.250.142.in-addr.arpa
18.244.114.96:443

now.gg

https

chrome.exe

8.0kB
130.4kB
69
120
142.250.102.84:443

accounts.google.com

https

chrome.exe

3.7kB
8.4kB
11
13
8.8.8.8:53

97.27.250.142.in-addr.arpa

dns

72 B
105 B
1
1

DNS Request

97.27.250.142.in-addr.arpa
8.8.8.8:53

region1.google-analytics.com

dns

chrome.exe

74 B
106 B
1
1

DNS Request

region1.google-analytics.com

DNS Response

216.239.34.36

216.239.32.36
8.8.8.8:53

36.34.239.216.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

36.34.239.216.in-addr.arpa
216.239.34.36:443

region1.google-analytics.com

https

chrome.exe

4.8kB
7.1kB
10
13
140.233.131.42:9031

chrome.exe

3.5MB
17.3MB
48457
92003
8.8.8.8:53

42.131.233.140.in-addr.arpa

dns

73 B
127 B
1
1

DNS Request

42.131.233.140.in-addr.arpa
8.8.8.8:53

cloud.bluestacks.com

dns

chrome.exe

66 B
82 B
1
1

DNS Request

cloud.bluestacks.com

DNS Response

34.160.86.181
8.8.8.8:53

eb.bluestacks.com

dns

chrome.exe

63 B
155 B
1
1

DNS Request

eb.bluestacks.com

DNS Response

52.8.8.59

52.52.115.199
8.8.8.8:53

181.86.160.34.in-addr.arpa

dns

72 B
124 B
1
1

DNS Request

181.86.160.34.in-addr.arpa
8.8.8.8:53

59.8.8.52.in-addr.arpa

dns

68 B
127 B
1
1

DNS Request

59.8.8.52.in-addr.arpa
8.8.8.8:53

static.hotjar.com

dns

chrome.exe

63 B
152 B
1
1

DNS Request

static.hotjar.com

DNS Response

13.224.245.27

13.224.245.89

13.224.245.61

13.224.245.87
8.8.8.8:53

dn0qt3r0xannq.cloudfront.net

dns

chrome.exe

296 B
138 B
4
1

DNS Request

dn0qt3r0xannq.cloudfront.net

DNS Request

dn0qt3r0xannq.cloudfront.net

DNS Request

dn0qt3r0xannq.cloudfront.net

DNS Request

dn0qt3r0xannq.cloudfront.net

DNS Response

18.244.140.75

18.244.140.65

18.244.140.67

18.244.140.95
142.250.102.95:443

content-autofill.googleapis.com

https

chrome.exe

4.2kB
5.4kB
6
7
8.8.8.8:53

27.245.224.13.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

27.245.224.13.in-addr.arpa
8.8.8.8:53

beacons.gcp.gvt2.com

dns

chrome.exe

66 B
112 B
1
1

DNS Request

beacons.gcp.gvt2.com

DNS Response

142.250.69.3
8.8.8.8:53

raven-edge.aditude.io

dns

chrome.exe

67 B
115 B
1
1

DNS Request

raven-edge.aditude.io

DNS Response

172.67.10.132

104.22.60.119

104.22.61.119
18.244.140.75:443

dn0qt3r0xannq.cloudfront.net

https

chrome.exe

4.0kB
9.6kB
20
20
8.8.8.8:53

edge.aditude.io

dns

chrome.exe

61 B
109 B
1
1

DNS Request

edge.aditude.io

DNS Response

104.22.60.119

172.67.10.132

104.22.61.119
8.8.8.8:53

cadmus.script.ac

dns

chrome.exe

62 B
94 B
1
1

DNS Request

cadmus.script.ac

DNS Response

104.18.23.145

104.18.22.145
8.8.8.8:53

pub.doubleverify.com

dns

chrome.exe

132 B
302 B
2
2

DNS Request

pub.doubleverify.com

DNS Response

104.18.167.224

104.18.166.224

DNS Request

pub.doubleverify.com

DNS Response

104.18.167.224

104.18.166.224
8.8.8.8:53

static.kueezrtb.com

dns

chrome.exe

130 B
226 B
2
2

DNS Request

static.kueezrtb.com

DNS Response

104.22.34.123

172.67.21.232

104.22.35.123

DNS Request

static.kueezrtb.com

DNS Response

104.22.34.123

172.67.21.232

104.22.35.123
8.8.8.8:53

www.googletagservices.com

dns

chrome.exe

142 B
270 B
2
2

DNS Request

www.googletagservices.com

DNS Response

142.250.27.155

142.250.27.156

142.250.27.154

142.250.27.157

DNS Request

www.googletagservices.com

DNS Response

142.250.27.155

142.250.27.157

142.250.27.154

142.250.27.156
8.8.8.8:53

static.vidazoo.com

dns

chrome.exe

128 B
294 B
2
2

DNS Request

static.vidazoo.com

DNS Response

104.18.28.64

104.18.29.64

DNS Request

static.vidazoo.com

DNS Response

104.18.29.64

104.18.28.64
8.8.8.8:53

raven-static.aditude.io

dns

chrome.exe

138 B
234 B
2
2

DNS Request

raven-static.aditude.io

DNS Response

104.22.61.119

172.67.10.132

104.22.60.119

DNS Request

raven-static.aditude.io

DNS Response

104.22.60.119

104.22.61.119

172.67.10.132
8.8.8.8:53

track.kueezrtb.com

dns

chrome.exe

128 B
224 B
2
2

DNS Request

track.kueezrtb.com

DNS Request

track.kueezrtb.com

DNS Response

172.67.21.232

104.22.34.123

104.22.35.123

DNS Response

104.22.35.123

104.22.34.123

172.67.21.232
8.8.8.8:53

gtrack.kueezrtb.com

dns

chrome.exe

130 B
226 B
2
2

DNS Request

gtrack.kueezrtb.com

DNS Request

gtrack.kueezrtb.com

DNS Response

104.22.35.123

104.22.34.123

172.67.21.232

DNS Response

104.22.35.123

172.67.21.232

104.22.34.123
8.8.8.8:53

75.140.244.18.in-addr.arpa

dns

144 B
258 B
2
2

DNS Request

75.140.244.18.in-addr.arpa

DNS Request

75.140.244.18.in-addr.arpa
8.8.8.8:53

132.10.67.172.in-addr.arpa

dns

144 B
268 B
2
2

DNS Request

132.10.67.172.in-addr.arpa

DNS Request

132.10.67.172.in-addr.arpa
8.8.8.8:53

145.23.18.104.in-addr.arpa

dns

144 B
268 B
2
2

DNS Request

145.23.18.104.in-addr.arpa

DNS Request

145.23.18.104.in-addr.arpa
8.8.8.8:53

119.60.22.104.in-addr.arpa

dns

144 B
268 B
2
2

DNS Request

119.60.22.104.in-addr.arpa

DNS Request

119.60.22.104.in-addr.arpa
8.8.8.8:53

123.34.22.104.in-addr.arpa

dns

144 B
268 B
2
2

DNS Request

123.34.22.104.in-addr.arpa

DNS Request

123.34.22.104.in-addr.arpa
8.8.8.8:53

64.28.18.104.in-addr.arpa

dns

142 B
266 B
2
2

DNS Request

64.28.18.104.in-addr.arpa

DNS Request

64.28.18.104.in-addr.arpa
8.8.8.8:53

224.167.18.104.in-addr.arpa

dns

146 B
270 B
2
2

DNS Request

224.167.18.104.in-addr.arpa

DNS Request

224.167.18.104.in-addr.arpa
8.8.8.8:53

155.27.250.142.in-addr.arpa

dns

146 B
214 B
2
2

DNS Request

155.27.250.142.in-addr.arpa

DNS Request

155.27.250.142.in-addr.arpa
8.8.8.8:53

i.clean.gg

dns

chrome.exe

112 B
144 B
2
2

DNS Request

i.clean.gg

DNS Response

34.95.69.49

DNS Request

i.clean.gg

DNS Response

34.95.69.49
8.8.8.8:53

geo-location.prebid.cloud

dns

chrome.exe

142 B
270 B
2
2

DNS Request

geo-location.prebid.cloud

DNS Response

18.172.153.127

18.172.153.113

18.172.153.15

18.172.153.63

DNS Request

geo-location.prebid.cloud

DNS Response

18.172.153.63

18.172.153.127

18.172.153.15

18.172.153.113
8.8.8.8:53

securepubads.g.doubleclick.net

dns

chrome.exe

152 B
280 B
2
2

DNS Request

securepubads.g.doubleclick.net

DNS Response

142.250.27.155

142.250.27.157

142.250.27.154

142.250.27.156

DNS Request

securepubads.g.doubleclick.net

DNS Response

142.250.27.155

142.250.27.154

142.250.27.156

142.250.27.157
34.95.69.49:443

i.clean.gg

https

chrome.exe

1.7kB
5.0kB
5
7
8.8.8.8:53

u.kueezrtb.com

dns

chrome.exe

60 B
108 B
1
1

DNS Request

u.kueezrtb.com

DNS Response

104.22.35.123

104.22.34.123

172.67.21.232
8.8.8.8:53

otrack.kueezrtb.com

dns

chrome.exe

65 B
113 B
1
1

DNS Request

otrack.kueezrtb.com

DNS Response

104.22.34.123

104.22.35.123

172.67.21.232
8.8.8.8:53

production-raven.infra.aditude.cloud

dns

chrome.exe

82 B
146 B
1
1

DNS Request

production-raven.infra.aditude.cloud

DNS Response

18.165.201.18

18.165.201.71

18.165.201.2

18.165.201.64
8.8.8.8:53

cdn.jsdelivr.net

dns

chrome.exe

62 B
160 B
1
1

DNS Request

cdn.jsdelivr.net

DNS Response

151.101.129.229

151.101.1.229

151.101.193.229

151.101.65.229
8.8.8.8:53

c.amazon-adsystem.com

dns

chrome.exe

134 B
252 B
2
2

DNS Request

c.amazon-adsystem.com

DNS Response

13.224.223.9

DNS Request

c.amazon-adsystem.com

DNS Response

13.224.223.9
8.8.8.8:53

config.aps.amazon-adsystem.com

dns

chrome.exe

76 B
140 B
1
1

DNS Request

config.aps.amazon-adsystem.com

DNS Response

52.84.90.106

52.84.90.126

52.84.90.86

52.84.90.40
8.8.8.8:53

secure.cdn.fastclick.net

dns

chrome.exe

140 B
334 B
2
2

DNS Request

secure.cdn.fastclick.net

DNS Response

23.49.161.153

DNS Request

secure.cdn.fastclick.net

DNS Response

23.49.161.153
8.8.8.8:53

tags.crwdcntrl.net

dns

chrome.exe

128 B
256 B
2
2

DNS Request

tags.crwdcntrl.net

DNS Response

18.245.143.83

18.245.143.58

18.245.143.118

18.245.143.100

DNS Request

tags.crwdcntrl.net

DNS Response

18.245.143.118

18.245.143.100

18.245.143.83

18.245.143.58
8.8.8.8:53

cdn.id5-sync.com

dns

chrome.exe

124 B
220 B
2
2

DNS Request

cdn.id5-sync.com

DNS Request

cdn.id5-sync.com

DNS Response

104.22.53.86

172.67.38.106

104.22.52.86

DNS Response

104.22.53.86

172.67.38.106

104.22.52.86
8.8.8.8:53

bcp.crwdcntrl.net

dns

chrome.exe

126 B
382 B
2
2

DNS Request

bcp.crwdcntrl.net

DNS Response

63.33.40.35

34.254.23.94

54.171.9.108

54.154.220.125

52.214.219.236

34.242.213.176

54.73.93.8

52.215.197.131

DNS Request

bcp.crwdcntrl.net

DNS Response

52.215.197.131

52.214.219.236

34.242.213.176

34.254.23.94

54.154.220.125

63.33.40.35

54.171.9.108

54.73.93.8
8.8.8.8:53

script.hotjar.com

dns

chrome.exe

63 B
127 B
1
1

DNS Request

script.hotjar.com

DNS Response

18.245.253.22

18.245.253.99

18.245.253.48

18.245.253.79
8.8.8.8:53

3.69.250.142.in-addr.arpa

dns

71 B
139 B
1
1

DNS Request

3.69.250.142.in-addr.arpa
8.8.8.8:53

49.69.95.34.in-addr.arpa

dns

140 B
240 B
2
2

DNS Request

49.69.95.34.in-addr.arpa

DNS Request

49.69.95.34.in-addr.arpa
8.8.8.8:53

127.153.172.18.in-addr.arpa

dns

73 B
131 B
1
1

DNS Request

127.153.172.18.in-addr.arpa
8.8.8.8:53

18.201.165.18.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

18.201.165.18.in-addr.arpa
8.8.8.8:53

9.223.224.13.in-addr.arpa

dns

71 B
127 B
1
1

DNS Request

9.223.224.13.in-addr.arpa
8.8.8.8:53

229.129.101.151.in-addr.arpa

dns

74 B
134 B
1
1

DNS Request

229.129.101.151.in-addr.arpa
8.8.8.8:53

106.90.84.52.in-addr.arpa

dns

71 B
127 B
1
1

DNS Request

106.90.84.52.in-addr.arpa
8.8.8.8:53

83.143.245.18.in-addr.arpa

dns

72 B
128 B
1
1

DNS Request

83.143.245.18.in-addr.arpa
8.8.8.8:53

153.161.49.23.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

153.161.49.23.in-addr.arpa
8.8.8.8:53

86.53.22.104.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

86.53.22.104.in-addr.arpa
8.8.8.8:53

35.40.33.63.in-addr.arpa

dns

70 B
131 B
1
1

DNS Request

35.40.33.63.in-addr.arpa
8.8.8.8:53

vc.hotjar.io

dns

chrome.exe

58 B
147 B
1
1

DNS Request

vc.hotjar.io

DNS Response

99.84.9.16

99.84.9.52

99.84.9.26

99.84.9.107
8.8.8.8:53

mp.4dex.io

dns

chrome.exe

56 B
88 B
1
1

DNS Request

mp.4dex.io

DNS Response

104.18.11.176

104.18.10.176
35.190.88.7:443

sessions.bugsnag.com

https

chrome.exe

1.6kB
3.8kB
4
6
8.8.8.8:53

16.9.84.99.in-addr.arpa

dns

69 B
123 B
1
1

DNS Request

16.9.84.99.in-addr.arpa
8.8.8.8:53

22.253.245.18.in-addr.arpa

dns

72 B
128 B
1
1

DNS Request

22.253.245.18.in-addr.arpa
8.8.8.8:53

176.11.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

176.11.18.104.in-addr.arpa
8.8.8.8:53

metrics.hotjar.io

dns

chrome.exe

126 B
328 B
2
2

DNS Request

metrics.hotjar.io

DNS Response

34.247.98.43

34.253.170.23

52.48.14.101

DNS Request

metrics.hotjar.io

DNS Response

52.48.14.101

34.247.98.43

34.253.170.23
8.8.8.8:53

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

dns

chrome.exe

106 B
234 B
1
1

DNS Request

lektoxlh6in65e32e4n63qwqxu0wtrkq.lambda-url.us-east-1.on.aws

DNS Response

52.3.66.223

3.215.252.162

3.219.165.175

44.193.232.66

34.194.89.143

34.233.140.175

54.91.104.212

52.1.31.221
8.8.8.8:53

event-ingestor.judy.pnap.aditude.cloud

dns

chrome.exe

84 B
196 B
1
1

DNS Request

event-ingestor.judy.pnap.aditude.cloud

DNS Response

131.153.232.246

131.153.232.242

131.153.232.244

131.153.232.243

131.153.232.245

131.153.232.247

131.153.232.248
8.8.8.8:53

43.98.247.34.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

43.98.247.34.in-addr.arpa
8.8.8.8:53

246.232.153.131.in-addr.arpa

dns

148 B
294 B
2
2

DNS Request

246.232.153.131.in-addr.arpa

DNS Request

246.232.153.131.in-addr.arpa
8.8.8.8:53

223.66.3.52.in-addr.arpa

dns

70 B
123 B
1
1

DNS Request

223.66.3.52.in-addr.arpa
8.8.8.8:53

now.gg

dns

chrome.exe

104 B
232 B
2
2

DNS Request

now.gg

DNS Response

18.244.114.57

18.244.114.85

18.244.114.96

18.244.114.51

DNS Request

now.gg

DNS Response

18.244.114.85

18.244.114.51

18.244.114.96

18.244.114.57
18.244.114.57:443

now.gg

https

chrome.exe

8.0kB
130.4kB
69
120
142.250.102.84:443

accounts.google.com

https

chrome.exe

2.3kB
8.2kB
7
11
8.8.8.8:53

cdn.now.gg

dns

chrome.exe

112 B
316 B
2
2

DNS Request

cdn.now.gg

DNS Response

92.123.142.145

92.123.142.67

DNS Request

cdn.now.gg

DNS Response

92.123.142.67

92.123.142.145
92.123.142.145:443

cdn.now.gg

https

chrome.exe

3.0kB
2.2kB
7
9
8.8.8.8:53

57.114.244.18.in-addr.arpa

dns

144 B
258 B
2
2

DNS Request

57.114.244.18.in-addr.arpa

DNS Request

57.114.244.18.in-addr.arpa
8.8.8.8:53

region1.google-analytics.com

dns

chrome.exe

148 B
212 B
2
2

DNS Request

region1.google-analytics.com

DNS Request

region1.google-analytics.com

DNS Response

216.239.34.36

216.239.32.36

DNS Response

216.239.32.36

216.239.34.36
216.239.34.36:443

region1.google-analytics.com

https

chrome.exe

2.9kB
2.9kB
7
8
34.160.86.181:443

cloud.bluestacks.com

https

chrome.exe

2.9kB
3.9kB
5
6
142.250.102.95:443

content-autofill.googleapis.com

https

chrome.exe

3.5kB
3.0kB
9
9
142.250.69.3:443

beacons.gcp.gvt2.com

https

chrome.exe

3.3kB
7.7kB
10
10
8.8.8.8:53

beacons.gvt2.com

dns

chrome.exe

124 B
156 B
2
2

DNS Request

beacons.gvt2.com

DNS Request

beacons.gvt2.com

DNS Response

142.250.68.227

DNS Response

142.250.68.227
8.8.8.8:53

227.68.250.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

227.68.250.142.in-addr.arpa
142.250.68.227:443

beacons.gvt2.com

https

chrome.exe

3.2kB
7.6kB
8
9
142.250.102.84:443

accounts.google.com

https

chrome.exe

3.6kB
3.6kB
9
9
8.8.8.8:53

now.gg

dns

chrome.exe

52 B
116 B
1
1

DNS Request

now.gg

DNS Response

18.244.114.57

18.244.114.96

18.244.114.85

18.244.114.51
18.244.114.57:443

now.gg

https

chrome.exe

16.5kB
11.6kB
36
29
142.250.68.227:443

beacons.gvt2.com

https

chrome.exe

3.8kB
3.6kB
11
10
192.168.5.3:8080

chrome.exe

3.0kB
24
8.8.8.8:53

3.5.168.192.in-addr.arpa

dns

70 B
70 B
1
1

DNS Request

3.5.168.192.in-addr.arpa
18.244.114.57:443

now.gg

https

chrome.exe

3.8kB
9.5kB
17
19
8.8.8.8:53

now.gg

dns

chrome.exe

104 B
232 B
2
2

DNS Request

now.gg

DNS Response

18.244.114.96

18.244.114.51

18.244.114.57

18.244.114.85

DNS Request

now.gg

DNS Response

18.244.114.57

18.244.114.96

18.244.114.51

18.244.114.85
18.244.114.96:443

now.gg

https

chrome.exe

8.1kB
11.3kB
25
41
8.8.8.8:53

notify.bugsnag.com

dns

chrome.exe

64 B
80 B
1
1

DNS Request

notify.bugsnag.com

DNS Response

35.186.205.6
35.186.205.6:443

notify.bugsnag.com

https

chrome.exe

1.6kB
3.9kB
4
6
8.8.8.8:53

6.205.186.35.in-addr.arpa

dns

142 B
244 B
2
2

DNS Request

6.205.186.35.in-addr.arpa

DNS Request

6.205.186.35.in-addr.arpa
18.244.114.96:443

now.gg

https

chrome.exe

3.8kB
9.5kB
17
19
8.8.8.8:53

now.gg

dns

chrome.exe

52 B
116 B
1
1

DNS Request

now.gg

DNS Response

18.244.114.96

18.244.114.85

18.244.114.57

18.244.114.51
18.244.114.96:443

now.gg

https

chrome.exe

2.6kB
9.5kB
17
19
18.244.114.96:443

now.gg

https

chrome.exe

2.6kB
9.5kB
17
19
18.244.114.96:443

now.gg

https

chrome.exe

2.6kB
9.5kB
17
19
8.8.8.8:53

now.gg

dns

chrome.exe

104 B
232 B
2
2

DNS Request

now.gg

DNS Request

now.gg

DNS Response

18.244.114.96

18.244.114.85

18.244.114.51

18.244.114.57

DNS Response

18.244.114.85

18.244.114.96

18.244.114.51

18.244.114.57
18.244.114.96:443

now.gg

https

chrome.exe

3.8kB
9.5kB
17
19
18.244.114.96:443

now.gg

https

chrome.exe

2.6kB
9.5kB
17
19
18.244.114.96:443

now.gg

https

chrome.exe

2.6kB
9.5kB
17
19
8.8.8.8:53

now.gg

dns

chrome.exe

52 B
116 B
1
1

DNS Request

now.gg

DNS Response

18.244.114.57

18.244.114.51

18.244.114.85

18.244.114.96
18.244.114.57:443

now.gg

https

chrome.exe

2.6kB
9.5kB
17
19
18.244.114.57:443

now.gg

https

chrome.exe

3.8kB
9.5kB
17
19

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
1b5dd9b2dc2a573a29a7e99de2582805

SHA1
362c395046bfb83c5bb79035e1b2ef202f63c539

SHA256
bdd43d9d441277570a29de608f7ed2bf6a67be9ed9181d674dc2f31d05081ad7

SHA512
de941e6cdc69f7b0896a76d731cd94bf0325cdaff6d0a9903504f4e9006d2308bf05ce53fbf77a0ded69650a2ac74a354f8fe95e03bb28e2e1f4f191bad02fac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
41727532c82b6bb04ccd14c2ce522a71

SHA1
a8731f27a7c5a7ca2fd7c37a6c433b4094bb25f4

SHA256
92cab0bb22a8400d5bf60a2d2ba201b036c91db4e78bf622412398415306d5a1

SHA512
57fa99ac977ea4c0792707d508818ec60ca04a5f4e73b3383aee371107666303e2ca7f353ebb388870cd237eae33572337372b28e761415987e75f2ac7e6f8e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
11d31f0ba4b639f3ae441990532f391a

SHA1
3ffdb1aea82dfec08899a68e6350d25b878f1ef5

SHA256
3edc354b3d1240f98d96cd574a17db774a4423a058309dcd022e83276b4d5f99

SHA512
3436e95c75cf35a4ea1df064d91711bf275fc952eb631769d77161a14e84dbdeae3060f95f0e1f5ba284aff718e640567b0337d1b6c4e604cb394c64032511c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
f07ee67a0a40ccb7b3e78d776948e863

SHA1
863f6627c1529a601714e90b8c887a4238ae4776

SHA256
125176df1bc932debc893d549cfc2857a0b1c5b34abcb8a306a824b998c6316c

SHA512
c96475d860ff61a43836e1293a9e29742bc11ced601d7f1785d555dd04bc71cd346fda73b11f5e10b2af625dd518dc4c230013992ed32507d8bdf88f4a849566

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
c64f903e90fc628dd131a75a13c05d19

SHA1
8c8691201ccfbf58aa3201623cdb050fd267a91c

SHA256
4d0eac2188bf40b4570c4acbba5b9a4ce920d377030a251966d4dc9051de0453

SHA512
54db06cac9732a272559a8a6d1920a142f4581a1b21b1c22c7b338e7ba53bb82a4adbfe65344a0e8e25a7cc0364c84d228d01114158dd1de56270c9dff027765

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
c6d890e5b26fc6f9945b5281e5a5d0bf

SHA1
a7a4fea99311ed66473da46108adc9fec3b2d3ba

SHA256
500e2789be7f18bdd3f8e21e2f79c0f26e9c55f79c88b945eac63ca11279fea6

SHA512
df946b4e6947f756334302cdd55d29bbbf223b7fb2f3ed67cef421c0d27eb1c3c989b6a8e82deb653e578dfb561a009af5b223997f6ea2bbd21601ed2e5671ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
27b09a84718e76cac517dd347dd55a3f

SHA1
9851f94387265d77cd3dcc5d989c093b6773635e

SHA256
eee9763ba1b1910d800f1f0398f9786bf94891ab9e529ab019a7d666b4dc2ae9

SHA512
64a1146bff217044fc7374e0a6b02b9ac5ef6047bc65164f66352d95d703a6dca9de27012fe26e789f7a1071c8395dafdce27f47246bb98bc0bc643fdc6127c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
ea5b83094ee1512ae82d70874caf8700

SHA1
752a64a23b073e5a805f151b01f3fcf0174218f6

SHA256
b9657c2d4a99ec19b260674bf56dad36ca0744891d8afb757a63bcb3f37d4061

SHA512
f779e6a4aea380066102f78a93cc395f5c26c76e09c1a6525bd7f01a93924cc82d67f3c3a1461eb45fcc2e8e41367b082ebf3b21b66525e54cd415f5e682d59d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
88d66b8159bb9c91925a50d26c84fecd

SHA1
9269d8ec0277f6e20bba30f97793312970f0a6a1

SHA256
63ed3e8a0fd3cfc5f1f53edd7d7032cf0e4a00f3ab6e52e208603130ed99c843

SHA512
d2adbd32017a7fbcd70e3e6c7c5701a7f83d89742891138c3bae3cf1e653fca05b0e319f87c4b5b4c9563ae5a2a87947a0092c670f48a95f43393b031b56888f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
90472a299c4180ea0522771185e8641d

SHA1
f2c06c9a9f80c7522b02e4d528ea9c0b6fe6fab8

SHA256
840f848317649290c8bf2c4407e9d215eacdfab150ef1b3096cf8f9564b4c9a5

SHA512
15ae4ec0c8d6e296a4a9d62094ee3843be754744089af9a765ba490b601881ff47a9331dd25ab0932fdb2ffb96d1d1bcce02cd87fc575c03d10133dcf5ea99ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cbf6825e0a77b7a5e67538d755a990a8

SHA1
57c8ea76d35729fd100f3bc6b718622638dd370b

SHA256
52f5f3778c9caefa1682816f827d69ed4dde3356a170f0c0cb49f02f410f2acd

SHA512
19ef324f25d74d80977ae5035d0f579fb3c0132f5b55300fbe2362e6d4937b1dc7d4a6f6c2713a929214a29dec1f1d90d98783084380913f9e9f2d4114b29972

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
0642b41521768227f66cd367b0c77ee8

SHA1
b723d0717694fab24a6e882f41b6b14d28e6a35b

SHA256
5f49fd4e814078725c570d79b9939eba0f9fb923320a73e4ac6ddb1f651b1bed

SHA512
dbc27c67a5a06039576c8553838c17be4d9588a44184cee832afe2ab68f1b60f7598f3c5cb928b7c55e7f6c94af99e39caa292dc3eabf78da5ef209814ebcf08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
21ece2b6b8d1e3593c487196062da87b

SHA1
104d9b7a408b01a73159c2de566ba885365c20b4

SHA256
85288a0ce1716e5b39ee02298386dec13b523c01e39b1cfe6349fed687838e61

SHA512
4f5d802a5337d009e40aea4390eb0e80bd342d4930bb944c6635cad0fa739b5cabb94412fd920d84d886e4ec1ab6f41fe7e37e084d880ffd51993a3336c88765

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5d603cd2a5e48276fe8915253bd78414

SHA1
10a70bfc84bea5f0602122c4fb3afb02c791d39a

SHA256
bfcd3851498250d547512271f42c11243fe5a7445317b08034daf565df9eaa13

SHA512
50493cc19a4e21c8ce12b0581d8340fb41b11f6d7d7d1fdde708d966a7db8f33dba67e415a57b288ce844757aafb7803ee86414d37a01697eee95606a5594fad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5dcc73a5f667f4f4de835ce916374f78

SHA1
a55f1b17cee972b316f270f2ce89b91528fc467a

SHA256
5bf343daa73cbfe917acd05c5cd04dab0c41e5c8d3584390d4120a1e3d56bcc7

SHA512
265d375d4e1fbf56f511b9445fe745c1bdec761551371640bb006928a518ac2af7112c484b642a04d43b860890ce20a4ae8cb064d70d75a87157879a5df998f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
caaeb55fb0cdb807062ca3cfeaedf6e9

SHA1
3945199b751ff9051fb37bd9699cefe53d5b7cce

SHA256
b32f0e6c4660b89d8cb18d5075ecac70836242d336683398e67cefff37159aa4

SHA512
52e258305abe44771a050b336d87ab18d076f2869425545cce720361b41ae9280ffe6980ef2e9762c762c06d5c97e361e0920b6bd0f8ea2a0b4d3abe78be7368

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
98251aa736fc19951710d9cb9ec8f509

SHA1
b65e04346d28bbfd6f6490a6addd075f1a0cf693

SHA256
26136a16ccc8d68869df8973494cfa03e4f9762bb39ced454ec7e015d27aba36

SHA512
6b29f13794af54eec7aa48d59f27d231e4b6953c212048da2fda5df34ca2f3549d07a0bb77124dc4c9e20aa94af8b4aac380cf9c18a1df94706a804f72a91411

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b8d8a4b4c52276ea39f0644c5f99a9d6

SHA1
79bfa16f417f22353967d2c718fc54241ab85ac9

SHA256
136422be1ea5dd88f8058c548dbd10ec6aeec524be908deaefc7f60fa085ba57

SHA512
fff0328964f0cbb11da21024a014bb524e5f39a07e3ac0bd634a05aa6467a86cedd9cd474d0c5ab67bf462f81064d98e1585403b7b4314ab4cd20ea83aa1308d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5f71301f9b6e4c7dff85a05c99e5a422

SHA1
13bfb92548463af3de910a4b443158f0bd05a07d

SHA256
5e436152b813d2bd2f8090977aefce83265738c0d6928682b90572b4da8e1d3d

SHA512
0f23cf1148312bb62460533b1e03c56d7e214e6ddca25cf057bb9d6d8550b6f7bdbed03f9b616d136b68b00d038de9e22a4c6ccd36b584cede6242a0dab5bccd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a43fc68aa89a657d38739207152c722c

SHA1
1e2d3df471b604fb083e52879007588da164306a

SHA256
db7acfb965604496c4177962a1e57f9d4352f08dfcd00983a9de1cf31008bad3

SHA512
973c9e1f38b19bf20581e5222d0281e80cb5c55e45f1aaf1f16172d7b77d3f6684e60460786f8689f45bfcd1d0d8b66bd8ee7401e718d7311cca061fee7077d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6b79fc7fd14d24d488f9bd04b91b8c95

SHA1
839a6927f279c29c33bfdb7e12456509c7adb376

SHA256
799821f982ae195041bd200c81139df5d75422247074cbb54f3faca840869b9a

SHA512
4bb422b9f60fe308c1f0434f8c19d3662a13a7e643f75a0562303de7ea4bb547b75f4294a7231e46fef72da4554119acd43f239e22a67f04cd6a8ac18a03794a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2cfd227622c3ef7a2d0bc7c2829d41f2

SHA1
2e7ff793c67b4b74e9ad157b2210fbaa7d53c7dd

SHA256
116e0eb83d00ee635efd315f30b34af123322ccb62851305116ae668dc30308b

SHA512
ba2005b64d9fae124777f07fe1e3dbe1779117f5ce9c951e55aa8c1b894a030c7b3f9bfd4840c6dda3b2841044a33e8240e826b9c0990268b1a86d7639956bd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9b9ce5b62202a03595e668f100837e1f

SHA1
b28c06859a0285c3655cd018de419e9e2e73d57d

SHA256
11b4e2a4ad0ae3d611bcc677e959b89512e99687c36f56747cc8fc88ae6959c7

SHA512
317d93b1951d5dc2a09104b2fdd90b80f849e7ab6b201b5e7688b41bba3320ed594f285eb64ab1381d80457e2ae69fed6d196c50dbb4c75d04ec776844523a87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c970099ddbc3f878669d375ec9851d3d

SHA1
1c681aa4cf079343ea3f2e92fdc97edf1a9cbb69

SHA256
e721bcade0a28144ea56c4ac470db5158535cc7a9028905a754fe11bc8c607ab

SHA512
f18b7efa9dc544501d862cdd3539318358cbb2f549933234c0008b4f73d0775502e560ebbed2db84e740c010cdef89bee6b8db566f1205f015f687c15aa5b787

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b254e2fe012d678682a687b63b335685

SHA1
6e1b85626853c36fc97b4dcbb01fd036c563d273

SHA256
0132347f6a337e1c53b93c3c07c74373b2777328ef81b94e4fbfac5a7d1460f3

SHA512
233269c6a1dd4ad7639ce80e42c1c1e3d9523be48ed80996eb94da0cef196652a7b3fec00e721aa1d2bfeca17526b57d023faaa118c7dfc67ccd012191e1c425

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
48b102866dcdd2dd540498cd7412d037

SHA1
3d23912c4fcdaa4acd5a0b6fd564e376a4022d44

SHA256
680aa8469ddfb4b03f82a4ede0523f85847d6ad808b4db16946fe3f20d2a6c63

SHA512
87fdf1729a689ce2035990757ab4c92a7c55837df0d67415ab2cc754b55e692b1de9b3fb12bfb08ec8536b5438c6b9c6d07cb4660ee13ffa868c6c5412d64c0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c069296319ce46ad3dd2f1f3f63d3a21

SHA1
556d01512d1d636616927baa6dca3d947f5f00dc

SHA256
13a791d097f17b49a5f1dee40d562ea094606179441b80313d3434dffb471e2a

SHA512
d0264d234f7e241c1cb07daa6f761eb98df7c751490e94c8cab65c9a0d11c83b3a3c46c2011ae0b0f0666d2fbc1469154ed8ce12fd93f695b2eea70e8c658fe4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ba540a198372cab6b066e8dcdd8ba518

SHA1
11de7a8b05a8f299c9f562b94413b28413709afd

SHA256
4ca98d74440f0f026f3e34a094538b3aa088a239214a87a90ec644ecf4f7dd61

SHA512
31643a49c4cc013281ca41fd1f9636f83fea605ca5239e674dfba060c8067f7e5a79480f91314c0b32add7b5d805d3159c764d1edd9c5f300921cf2d93828ed7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0d148b30859ede6500dae3e8f1d4bba8

SHA1
a445dedb02a44be7390efda5794a78ac71837160

SHA256
4cfa0b61fb41faf0f5502ecf6f26325fd0e64c161207fbd3ff1258763c385176

SHA512
0bb3f939c7120acf11d7bf8b0c3a8994569c4c9f4d9bd2d5f58abbd7057a05291989a6f5b503fb9ef66407e5ff35a5dfcbcf924ad1c2789fdd1d53fc5f0c7458

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
861037e878bcd2ea7f12e8510799a06d

SHA1
c4fa03299bf2e5f67ec13328e03bd6dd284f6173

SHA256
9c482cb07bcf0a2200980c8fcb7e2b79657fdac9a5565b58901b9cb0331696df

SHA512
b0a5b42c3091b63343ae5cf8a9750835c72e00d2843ef0d1d11ff7671f3278a2e2721ed98ef609345e1c006cb797c1f75aafcb3a9c9260b2d1379abf4e4fce0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
269c872e5280349b9543ab3aa782ab0d

SHA1
be2ae17b7058ba64723d17bab18c8b7a50e297ff

SHA256
c21c1da6ecb7a74915c24cab207e84c33a10c14045d3ba93720c2edb2d284403

SHA512
53f8ba8cfcb872a3a6fb507bc851029b7bef57a3ccb787daf1d8e86911d0dfccb4e781939a5297f2878d5948e3470eeec299779e7871898eae29616f7791174e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
271d7a42a2e783848e80c0b54e4bbf5d

SHA1
a13292fc1082cad0e07bd4183c6d06df533a6124

SHA256
c8dacdaae4bd213d6e297cda798cb733c63bd42643ed7b9edb4586298a54c97d

SHA512
f55b4fc688f26d9ba6b08797fc41937841c5ec2804415bad75eff8ce264d35e42c23a6a3137686cc5b8d06b6a9d8f894c846c9ace90da2bac2467c76551d3bef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
52f5ae6ffeaa36d804a991386e726d17

SHA1
32d1104dd6c5c96b5ad32a8cd3bf3a9c93e1acb3

SHA256
f925c323eff49fb522b7f8affb4124453dbf45d408e78e6b50111d08f95fc4b4

SHA512
eff3d27474369f313e75ff3386290cc7146bf777d5748f80f5e371a3797322570ead09b78ceeee3d3dc3d3aff2b2c619edfc5b7234cc79bbd306c50e04696f4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1a9f6e9183cdbd090cd27002ebf00a71

SHA1
1d710f19b5069304be6691cbcc750eaef6dbdb56

SHA256
a024715bdce6dd3f5011de460d25fcfd52f617fc162c11d91597ffd11de35555

SHA512
77f9605e9c20e5254f3bfebd1bcb107452fdb2ee99ed09f01316b4cbeb787272e11811746e11944ed677f24a699295f02a23e1bb143d6641edfb3530efe26c66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ab5223e88b15fceda849c02e116da69c

SHA1
e25870882d14b586810c193fc7e8f75c1710bfec

SHA256
0007f879aa9fda31314c3ba14afdc6145ef2c3533ef5801f4923138eabfd64fc

SHA512
73446c094ec83ba2be2ae875ad058cc953891b92893ccca382c3115f95d2f044b4ad3d57406b7c925b74c30fb024384945784522aebaff200d92efbe47a66107

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6ab4b5613d03106072cc9b93f58e56a0

SHA1
d4e07cf3c127c096e070027af63ecd91a6a4199b

SHA256
1b7fc99b6f876251e9301e26b7fd3d4a66a2e3213e6f02aa62a67491600be2a9

SHA512
b8c2e5111917d1fe6c5cb2ca73afe9d933176293dae71fcaf81ae173fa31b87515ebf08ed6f5628ad76a7ce006bad12546633dd0deba95a95c8d1626d633ffbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
dd38ac4dc3e85dd58298b97f2fbb1110

SHA1
b0c8129e3fa9b3656d85c7b041e51b2d1350613e

SHA256
5af72508bc600736eb04456defb1842d7861fabe7551512a2b75aae79f277b72

SHA512
e708daeb248c2b9cc1e61144afc7486f5832ccd55aa6007c41f16a2dc19998f9003891a5f4f9fb25d8eddc2482ada738e6f97c1e7a174168c7fd3ff0e6707b78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
46b4b44cee61243b79b82017011c864e

SHA1
0bccb10dbc1416bc746f537ee425fe6cb390b060

SHA256
d3c2c4b2ffb9b1de7f4745a8a5b879d5772044bcdf909296a782589c32eb7af1

SHA512
325532868a23abe5b892902f43ece75f6fd68ab7b16d879b4c273be1b7c696f98b99cf6b87e972dc5e4cb2a31c1b04733dae39d59471af4e6307972b189c8b21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
883b85032bc88315ae19671fdb4749eb

SHA1
87f1558574e909e55ebf0900c5fbeab951fb5be0

SHA256
ad0853f606cf3c1045b80d26ff1e4bf994b4ab3330af01aa51b3179a90b43ec6

SHA512
695aaeedcf275e034c821368c67ea0b25ef3dd9b70685654bb00e9d108aa847cdeac11d11beaa527c3790f9e3451a9164b782d352ed70f53fcb1fabbb5ca1d7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d24f99046c657025a8b60da06f38af53

SHA1
068502a2e902b8680f947677deeb21008a41c5fe

SHA256
22dc4b3b4eb502cf360c0b81f2ca269f0083834c9723f9bf07399e9b2e1eb2a3

SHA512
4da8c982f45fa29e5c677263fdb3602339b4ca6c4785e6d96de549b972719af5d72b61dd2d0c20dbc0df8f2cf0e543c79530be6a8ed9bf934c9915dd7320bb33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
82206f0960ac9c53cb39721f01d1ea9b

SHA1
eddd41565aba93c2348c8b3d41706c11369d4b23

SHA256
4ef5c2b985f1d31f3900c107925341eea82f2702a27655a6e31f8f00e50b1657

SHA512
36d92b3cd901b8d7f2d3642215fac5f423b9419596e5a447627dd7d56ddd5bb81554bd0e63fede777a4100cb3e26534065716c87faa67435873536f1e941ad57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9abba1902477b3d0b25092889e61871e

SHA1
5a99a4a568b87dab4c8bca5b9d93539c69cfeb1f

SHA256
00ce31bf5c10e8d470b0c28efe0a172df9d4a4116af2a79d7d818a601cf7a81a

SHA512
6487192be5e611bb376d584077e4af3c31d9eeee76b5bc349626a4775d3b45d15d9d705f75d4007357dd3aa07c2f0d6d41cf575fa9d0a49b45edb4f5aff5fb4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
81bf4806afac3e4819b99b290a056704

SHA1
c8085d22244e197e6c2cbb547803c393aa718b0c

SHA256
599970e5034f8203a00fdb5017fa598fad3655b7211b9dc892c15bc1a22706a0

SHA512
1986710ae959660a749ddd56b22e48be13d4eeaa23f245296adcb3a781bd3614057fcbce437bad59cd90d4d289c454c620fd7f7d2e8fade9f4b5e6e746f45c7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3b331113fc7b3b047165c5176e0b39c2

SHA1
97d93de5735d739c04301795eb4e84f1f9822efe

SHA256
4af4880cc558176a25251ddda7b7df5c0637d3cde8345e73cc06c8babe5b1a73

SHA512
9b1ba8058f2aaf76c6c0d2738b0f099fa85aa7efd1ecf8b436f5083d838a2464d75b2ea6a6276fbbd3ab2c1ae921f3dc83a9fb9f927d2aaed0ee91d9f40a78bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
786071618648de0ca21fab148958d0b6

SHA1
4e829e36fce07b70fc990e31648362a2108be5d7

SHA256
8a37eca7f68efee00ece75c1f37ef186feb8a790c29c2d7d87facf2c644955e2

SHA512
679a6b511db7fc4497e79bb5d8f6fe0abe9d04928d381137cbfec4beeb40c9b2984aea3d46da55dc7fddb4d2bd4e43372b79f05f5295ccf7fcfb5f41a0980131

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
c6f6ce198f4e7e4404f9c2676f204738

SHA1
24f19f6d07cf4523d4c6e453cffea7dd8fd9aa67

SHA256
b517d7c77c3dfe28efbaed102e307a86304df0c7fb929eb8f0f0637c749e0707

SHA512
0583d9a3039125124c37e7f73a3914b433f279534890a2363111eee88a86cfd36948bae617112af90c745ff2b360c1cb51311ba7ec95b3fd23a9bf3c2c0743e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
65079d5972dd27f24d937285de1f2e1e

SHA1
6fbc2bf00a33f70e6086a2dc276e4690b54fe930

SHA256
1ae496940e34729c79b1b4040a602a8882bb666138294b645cde62ff7fc74dc8

SHA512
7797d15d978c4bc28ee23764d69c4c140eb28c08c9b6c483799eaa6809a76f4770c14a2af4bccd70d1c6969853c773342c7e088bc70575636e33b6903df0bf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\_asyncio.pyd

Filesize
34KB

MD5
cb95a91c8b907752b69c8f12a72bc40e

SHA1
1e9504a7bdc0e9abb8bb6e39da2ba4e0d7386efe

SHA256
7d87702964e1e1faca0e30325900c3f075fe7acd05b3692f9f5e062b60e641cc

SHA512
650d1d626df473858eac810dc2f8697e18d91a5a6d2a17f8643f89a6215e43018852b81b82123cce80ba21d1249258b3eee944fb4e9571f28e1fce6a6d7b9bc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\_bz2.pyd

Filesize
46KB

MD5
dafa6d12daef616d7afb2853d339b4d6

SHA1
482ec0e8581ad99c42495fb76f42884191481399

SHA256
3260d2120df53e7a4a3d68299e72d8919fbb956f30d92d2d0f75f055bd72262c

SHA512
9358cb9a0b728567d5800efbb139f0fd6c4b016f2c6ef366d770f8f0aca92eb42d5769f48f4ea11e6bf064a04fdb3901f86db80b3f622d0ea8b8ccb1cf2c26f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\_ctypes.pyd

Filesize
56KB

MD5
ee797ca2e9dae16f1afaf5350c0fe170

SHA1
623a9ccbff3a0c9416e882e0ae4251caead84aa5

SHA256
3496264fa3f5cc6cc5c7f359bfb1f3a2388065f45461479cbcc6ab88601065dc

SHA512
dbb6abc1d738c783627db7ef9e553bfffe7af345f2bf0dadaa987d4ca6c883ce55ac9038da95995c68d1691f296f20283918119d803ad1f930f04fe8bd067018

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\_decimal.pyd

Filesize
104KB

MD5
e313e859ded9d57a93d5c9458841cf8a

SHA1
d45c4ffce746691e1eb35ab6e2432a6c7095bb14

SHA256
bd700d7b50849dcca44ad1df5f8ca8176fd287ba43614bc1c58a80a07a05f1e9

SHA512
227560009c898ca7ab2c0da3885fdfa46fec7554eea2a914500a3e6baa83c8861ab4585000230b80259e2c60967eacf842a13ff369ac3e6359ff2df56796fcbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\_hashlib.pyd

Filesize
33KB

MD5
9b98ab14cc78ead3b6e25deaa45b66db

SHA1
a49b4621a592fd1fe09bf9638917407c7df4450e

SHA256
71c588c4d87a06acb3275537783ff34950e6dd651365545fac42c53ed5fba182

SHA512
2fce844285e7f1a8cca88e80b132da736ffa3efb50a498daf687546ea410148693ef5d31d9da2a68784bcfd3e15e34d13c3868a90a814ecfabe006d911769cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\_lzma.pyd

Filesize
84KB

MD5
d79bdfeb08765cedcb612cacf40cb667

SHA1
9008847fb90a7bcb84d6ebbb34611022a8118cb8

SHA256
7909a4571b1af1f5aba469f6c2a642c1fbdc949890c96a89f4782a53a7fb5471

SHA512
d53d11e75ef590e8578af5cb8be71fe77930f9cfded89c1afa0bb1d04410432cd655d4d4287c0c7c547d9c667dba7d2bd51ecfda727fb312bc2c38993c1360be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\_overlapped.pyd

Filesize
30KB

MD5
7f766374428a6d7390724f659239ce69

SHA1
c69be06cb7d8257f42d03815164323a746c525fa

SHA256
40588139ae6eba475e5ab00d90eed826aa374b7d335298d106dc81153142e19d

SHA512
4515f80e09281ae5bd619fb881e6a4683ac854c2c85f5d010aa2cd3600a08ccb80bdae48320c8582deafe41b0a7d0996a88bce38a66c97721c0772519d22b933

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\_queue.pyd

Filesize
24KB

MD5
8b91d1de78b7e337ad267cfeb5c22b15

SHA1
f1f7d67859ad0007f1a4968a82ac0281829fa61c

SHA256
981a27eff5e45b819c295cd669c905bec18faf661fb5183f255932b627d008d5

SHA512
c52ea0bef75b33c912f089654af75aa684fb8337d452e326a2a0a764380c35219c1b8b8c979694bff1eb0b32aaf1dde98de4ec51b88e332545ff703e89ea0366

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\_socket.pyd

Filesize
41KB

MD5
98b4b4b16b28cea6bc7ad21e5b7099cb

SHA1
3d68d473e621ae6f4ea8d45f009d76fd31754a97

SHA256
604c46e40e85ee8cfde8b6092d4785bb4c6b1c3692e648ce30fbabc119527014

SHA512
e587ef54944d77189666c2f3ef9a4e27ebc17fa53ba12fbab6246815435bd63e7df4634b34f44b9e112f89f4cd56caaf1af066e14102d8c7fccf0355d2cc454c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\_ssl.pyd

Filesize
60KB

MD5
cd4cd236dfd476e629c5e30597d0b5d6

SHA1
49df5575ecf1f58f3f61daa979518f43d6fde86a

SHA256
0713d93a6c083f2ab1391dc78ad5d897c1ef4eef8a71648213d6631f0b6843e5

SHA512
829b72f81cfe3563ada7ea71d815b1a4772469a3624dff600ea1a532b3aac554a4f3a64950087f6d05b67bebe937244ff75a9eeaf03b3f80fd883e7d52f859fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\_uuid.pyd

Filesize
21KB

MD5
adfcda65b24dba25a281160c8e2549b6

SHA1
052d2b22afb1442025b5ff22501e18cccc017d04

SHA256
cfda1ec3a28982545816b037799c0d1c089ad82d0a255efc97b23ff60571373c

SHA512
76f45fb36e614fd96498bbb6a3de00730d12f4bf7f89a63f3f9d75a66c8598ab105d1acbb53227437b9a89b8fd81e6d6fbb059e62247bbed01815a4c0f6a52c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\aiohttp\_helpers.cp311-win_amd64.pyd

Filesize
20KB

MD5
1f08cad759839d57af8ad8d3d66307f9

SHA1
3407c49d52c46778349d5583b08bcd55238b882b

SHA256
926eda0ad4312561f65a0ac786f40de0e7edfb78467bbd3f2f647211bf3b895d

SHA512
c2e82e7d40e92c2d5cf5a8181c63a20f31c4e7134fe3bce581de4969d8a00ffb3290d5a7eff99c262c5b8d7a9813ede275a784dbc0c1e9d34ec8a2aa24e9de74

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\aiohttp\_http_parser.cp311-win_amd64.pyd

Filesize
63KB

MD5
2b1aa1aecbe9c124ff07fd349c9b3c8f

SHA1
cbe2a15c9e09ef0d9ef8ff61305deb14b0d937f1

SHA256
402d8443e33b0223e28f6b9c3660073ed1f35527a921b455ada1398ff299a03c

SHA512
70b206cbef196ef0555ec27edcd61a3a7a2278afa284aeefdb15dc7d583cbb4486bfc445c809dab0feec82756db5148deba2d18a35a4272bbd694643eebb0b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\aiohttp\_http_writer.cp311-win_amd64.pyd

Filesize
19KB

MD5
1a75e171dbeeb2fb92ec885e2bc5652d

SHA1
37b31aa6ec621dafdba16f044c0f8349959168f2

SHA256
d2057b4cfa5a1687601fcba4b2730d76b90da4db09a1d76b1943a4751961685a

SHA512
55850a84cc065b36e7b5374ba840abf110f8a2f5fc3a9840e6a1163087e85a0cd2538ca1e6d42bae2fbd89513aced846dbb00bcfabd1dff4ee7a2f03728c05c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\aiohttp\_websocket.cp311-win_amd64.pyd

Filesize
14KB

MD5
6e18d60399ab6e284f11dfae829bb8e6

SHA1
b39dc183f9f002dcdc0a6ca07dcee64286cce764

SHA256
edfadfab5ad2428365f9e0d6cd9e91fc4c29b78b9e3e6ac7cbcd118ed986f11f

SHA512
452def3915a095e5410cbb0f4b6e7e1a885ee9217f4f84bd6bf63e8201602c03ea382270291dcf650a2132029e24bb11cd29278411c5d4ec904dfd306c8f59b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\base_library.zip

Filesize
1.7MB

MD5
e9c28bc7ae0276a2413d913fabe101cc

SHA1
baefb0b00eac192113737106bc76b02244c17838

SHA256
7ecd1dfe0dcc82c2e595729cb238acb890326adc87136334ce9c21a5f0c847bf

SHA512
c25532849462e0dc1e3e7fd5f0dcc93a5dc18c7b29920819143ec30fec899f98cb8a538ab0084b9ba91f62705de3dededef6acfae02daf1efceabac3819804e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\certifi\cacert.pem

Filesize
268KB

MD5
59a15f9a93dcdaa5bfca246b84fa936a

SHA1
7f295ea74fc7ed0af0e92be08071fb0b76c8509e

SHA256
2c11c3ce08ffc40d390319c72bc10d4f908e9c634494d65ed2cbc550731fd524

SHA512
746157a0fcedc67120c2a194a759fa8d8e1f84837e740f379566f260e41aa96b8d4ea18e967e3d1aa1d65d5de30453446d8a8c37c636c08c6a3741387483a7d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\charset_normalizer\md.cp311-win_amd64.pyd

Filesize
9KB

MD5
7f1584f25ffd99d876f6816db20d033e

SHA1
1b0e9d7d2e2779887299f29ad991dc5cda7eaa5e

SHA256
ff381242e40a70510e0e69a34e3ab18fdcdb56865f5905425d20ddfff3452400

SHA512
5f6a01985b820aeacdd5e54eade039d20e90643510fdf2a97be6b955436420bb38a86c44f6245aef0200fe4515800eaf231721ecfe50dfdbf57b96a966d828ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

Filesize
38KB

MD5
c85002eed76b760e311b042f5831a4a6

SHA1
a5ea6c4e3dfc6ae735f7ff9876839940507230fd

SHA256
d2dba1513d01ca0a06024bbe7af43a6896c327d370153407d430ba8b5abea55e

SHA512
0f7e1b4b80975945e9aabdb559c7a2a0ac43128d979f01d11d04092b93148ae2c1fab88b4ed5cf004305fb4d7dccad32d5bdcdf75cfd554d7329a2773c29d9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\frozenlist\_frozenlist.cp311-win_amd64.pyd

Filesize
24KB

MD5
2ff22166c3bdc9dcb9ea6de5e8d16bbe

SHA1
d0dd16250d01150e93b0ff645cf2acc51ca5ca31

SHA256
776214669dfab09c476e9a26be0e67bf8bb2df9e7b7bf2746e6b3d2a54b09d0f

SHA512
c5ec6ac73e83c3e7879bfd90e662cf537784d37dc15c72fa6ab28331c756ccde5185c72dab4b1e56e1b4a2bedc4ff99233f194fbe32492c03eda3f8df7efb3d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\libcrypto-1_1.dll

Filesize
1.1MB

MD5
8a0b20d8e0e7f225693d711d556adc8a

SHA1
9486b7bdba3682f29f918ec22ec3d3f0dd0101fd

SHA256
0b7ba07933749e08f265ce5f9361a52cd00c86c84713db8c7b6955e75fb8359b

SHA512
164b5138e708c494094c60084945b24c73ff345433c8231fcc79a8fa5059634374f8998b04d9a967e37cde8af88bd4ff4484eca641fe112952af4b98081d7bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\libffi-8.dll

Filesize
27KB

MD5
aaf07947fe7aa9980900dfd10145c32f

SHA1
79b605e95c55524ef13ed130fddb277df121aaee

SHA256
55210e5a2e9885c30624cda41bf4a83b2598e661590349e7997ab28be70569a4

SHA512
e17463ecdad0c5fda59197b0bfd2f35ae0580e8791eaad5ef52c2ad876e993709fbe7b6c10e5a16eba276c7f8163f5acffd86fe500652854407ae036b8befabe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\libssl-1_1.dll

Filesize
203KB

MD5
5fba49b16f11befe297103bc28f20940

SHA1
412a4d12b6837314826b3ab8f868182da12b1f1a

SHA256
cc147f1b1467d4646450b66a8e59d26980a50f36fd3176eb2701e7bd28b22c72

SHA512
62881a3b70afea335819ca2fafe85711607ce526f45a628fa775574c36ff3b287d5c9b9a8449131831e15644048a5e8255c3cae91487bd8cdd90e684748dec98

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\multidict\_multidict.cp311-win_amd64.pyd

Filesize
20KB

MD5
926e67372520a3bb5afaf00ecc0a2baa

SHA1
7cd4cddde1a7c6b12168551ce88fbc8e6a9486e1

SHA256
5c120e3ffa9c3ed47455d3e2ea63da488ec77937236c9e91f1213810f9ca1146

SHA512
bc64b93d144b56560f145dccad1849e8e8b982126df074546f08a0276ee33b7d5cf53241eca80223ef7f989f1b10cbdd7e0a5690f9b3d0de433cf1ca7af79195

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\pyexpat.pyd

Filesize
86KB

MD5
a9ee1c53c76d3c2c622a5c4649edcbf2

SHA1
c9b0e3269d9eb5e6aa47c39619f70b3e8b208924

SHA256
446f5b0e6fb174ba8f2c8ffb45d093e87f12b02b1119e9b4baa9642c981321ce

SHA512
e256b074dbf40a662398f0b2eb909a498051e16eb7fedcdd5afe247f80632a60a8cb01cc5aeec52f1d392c90b5aaaa94ca4b72ed2d3e0d4018a840d7408b2fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\python311.dll

Filesize
1.6MB

MD5
5ef44effa518fc9b3acda79684381d75

SHA1
df6d1a46e691dce3373800b188137eed4ce97dfc

SHA256
90fe310cce48c73f05b7e678a36f2d6bb8870c316b9f12495255b60ad7787777

SHA512
ca52ccd9dedfb03d38544cb2f5a248d52873f7ef143ee3693d2fe11e941e81c5a48da277dbe0cdcf5b01701778ba083d0355fdfef0c13faa59411e7e12e5928c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\select.pyd

Filesize
24KB

MD5
ccdb37c527ce2db915e3701ee204c7dd

SHA1
8454bc2761504ea11fbaa6f2683bbca36a3989a9

SHA256
0f8d10473924f0bee9430be8824f8bd626fa4efaf98cdc10eee64e70dd4ef3f0

SHA512
3e04fecf39585445f2541d5ee16c3e522770daa9b1778a5e51db68261d4080e1b5373ded5a9a46f5f2204de1049be85814f86b28dd882ced8cff0632c34b70d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\simplejson\_speedups.cp311-win_amd64.pyd

Filesize
19KB

MD5
7537313d97bdcf7cac86f9e9a00527cd

SHA1
f4afaafc207e06222b9c828cd15b4fd75e620d0d

SHA256
c8bda770244b2966588758752f19c735efc71e3a86d077555040d3ff0f47ada7

SHA512
1dbb67202d248a825188a52ec0cf7bbd05ac8d687c0976836b518c89ae23fc722ce98dfacc08def9c27f066643860dcde9935a104c5ddaa11b19afb4c68f5dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\unicodedata.pyd

Filesize
294KB

MD5
54386c35a62c1a9eb63a29863f623a63

SHA1
7bb961b23816d30b727448c20bb65a57f64c95a1

SHA256
8066be8a9e752be80afff19fb21449998964dc8882cbe947230629ab21dc1009

SHA512
f7294832edc2e0bf87359bee12d60aac6eb397bcdd848317c0444a22b855f986d7c550a0268bf47902d78e9f0aecd206ee487e2081dee6665158f0ceb327e5e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\yarl\_quoting_c.cp311-win_amd64.pyd

Filesize
30KB

MD5
a364a3210e1b7c35f9bb9c1672ad5fc1

SHA1
d1c65204c9ef8d601eb2800fb96925cb85cbf274

SHA256
8ec8b9b6f9cab2aaf787d29e16f1e6a19fe3a88ab1948c4e25922f20f3e22f09

SHA512
b7f96701f284abda7dcd8a6d25cb34a9314c04a401799863672199e84ba72ee207bf92b80ad7135379fde4cd8da078b982a446c11e14d086ed6eb49cbde8d862

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/60-76-0x00007FFACF4F0000-0x00007FFACFAD9000-memory.dmp

Filesize
5.9MB

Download
memory/60-1778-0x00007FFAE1F60000-0x00007FFAE1F6A000-memory.dmp

Filesize
40KB

Download
memory/60-1777-0x00007FFACF050000-0x00007FFACF16C000-memory.dmp

Filesize
1.1MB

Download
memory/60-1776-0x00007FFADA5E0000-0x00007FFADA61E000-memory.dmp

Filesize
248KB

Download
memory/60-1775-0x00007FFADA620000-0x00007FFADA635000-memory.dmp

Filesize
84KB

Download
memory/60-1774-0x00007FFADD040000-0x00007FFADD052000-memory.dmp

Filesize
72KB

Download
memory/60-1773-0x00007FFADD060000-0x00007FFADD07B000-memory.dmp

Filesize
108KB

Download
memory/60-1772-0x00007FFAE2270000-0x00007FFAE227E000-memory.dmp

Filesize
56KB

Download
memory/60-1771-0x00007FFADDC00000-0x00007FFADDC14000-memory.dmp

Filesize
80KB

Download
memory/60-1770-0x00007FFADE620000-0x00007FFADE634000-memory.dmp

Filesize
80KB

Download
memory/60-1769-0x00007FFADE640000-0x00007FFADE652000-memory.dmp

Filesize
72KB

Download
memory/60-1768-0x00007FFAE1FC0000-0x00007FFAE1FD5000-memory.dmp

Filesize
84KB

Download
memory/60-1767-0x00007FFACF170000-0x00007FFACF4E5000-memory.dmp

Filesize
3.5MB

Download
memory/60-1766-0x00007FFADDC20000-0x00007FFADDCD8000-memory.dmp

Filesize
736KB

Download
memory/60-1765-0x00007FFADE770000-0x00007FFADE79E000-memory.dmp

Filesize
184KB

Download
memory/60-1764-0x00007FFAE3180000-0x00007FFAE318D000-memory.dmp

Filesize
52KB

Download
memory/60-1763-0x00007FFADE660000-0x00007FFADE695000-memory.dmp

Filesize
212KB

Download
memory/60-1762-0x00007FFAE34B0000-0x00007FFAE34BD000-memory.dmp

Filesize
52KB

Download
memory/60-1761-0x00007FFAE2FC0000-0x00007FFAE2FD9000-memory.dmp

Filesize
100KB

Download
memory/60-1760-0x00007FFADE7F0000-0x00007FFADE81D000-memory.dmp

Filesize
180KB

Download
memory/60-1759-0x00007FFAE4870000-0x00007FFAE4889000-memory.dmp

Filesize
100KB

Download
memory/60-1758-0x00007FFAE49E0000-0x00007FFAE49EF000-memory.dmp

Filesize
60KB

Download
memory/60-1757-0x00007FFAE2280000-0x00007FFAE22A4000-memory.dmp

Filesize
144KB

Download
memory/60-1779-0x00007FFAE1F10000-0x00007FFAE1F1B000-memory.dmp

Filesize
44KB

Download
memory/60-1780-0x00007FFAD8EE0000-0x00007FFAD8F04000-memory.dmp

Filesize
144KB

Download
memory/60-1781-0x00007FFADA5C0000-0x00007FFADA5D6000-memory.dmp

Filesize
88KB

Download
memory/60-1782-0x00007FFACF000000-0x00007FFACF043000-memory.dmp

Filesize
268KB

Download
memory/60-1783-0x00007FFAD55C0000-0x00007FFAD55D2000-memory.dmp

Filesize
72KB

Download
memory/60-1756-0x00007FFACF4F0000-0x00007FFACFAD9000-memory.dmp

Filesize
5.9MB

Download
memory/60-131-0x00007FFACF4F0000-0x00007FFACFAD9000-memory.dmp

Filesize
5.9MB

Download
memory/60-148-0x00007FFADD060000-0x00007FFADD07B000-memory.dmp

Filesize
108KB

Download
memory/60-149-0x00007FFADD040000-0x00007FFADD052000-memory.dmp

Filesize
72KB

Download
memory/60-151-0x00007FFADA5E0000-0x00007FFADA61E000-memory.dmp

Filesize
248KB

Download
memory/60-157-0x00007FFACF000000-0x00007FFACF043000-memory.dmp

Filesize
268KB

Download
memory/60-132-0x00007FFAE2280000-0x00007FFAE22A4000-memory.dmp

Filesize
144KB

Download
memory/60-130-0x00007FFAE1FC0000-0x00007FFAE1FD5000-memory.dmp

Filesize
84KB

Download
memory/60-129-0x00007FFACF170000-0x00007FFACF4E5000-memory.dmp

Filesize
3.5MB

Download
memory/60-128-0x000002FBE8850000-0x000002FBE8BC5000-memory.dmp

Filesize
3.5MB

Download
memory/60-127-0x00007FFADDC20000-0x00007FFADDCD8000-memory.dmp

Filesize
736KB

Download
memory/60-125-0x00007FFADE770000-0x00007FFADE79E000-memory.dmp

Filesize
184KB

Download
memory/60-126-0x00007FFAD55C0000-0x00007FFAD55D2000-memory.dmp

Filesize
72KB

Download
memory/60-122-0x00007FFACF000000-0x00007FFACF043000-memory.dmp

Filesize
268KB

Download
memory/60-92-0x00007FFADE7F0000-0x00007FFADE81D000-memory.dmp

Filesize
180KB

Download
memory/60-102-0x00007FFAE2FC0000-0x00007FFAE2FD9000-memory.dmp

Filesize
100KB

Download
memory/60-105-0x00007FFADD040000-0x00007FFADD052000-memory.dmp

Filesize
72KB

Download
memory/60-106-0x00007FFADA620000-0x00007FFADA635000-memory.dmp

Filesize
84KB

Download
memory/60-107-0x00007FFADA5E0000-0x00007FFADA61E000-memory.dmp

Filesize
248KB

Download
memory/60-108-0x00007FFAE2270000-0x00007FFAE227E000-memory.dmp

Filesize
56KB

Download
memory/60-116-0x00007FFAE1F60000-0x00007FFAE1F6A000-memory.dmp

Filesize
40KB

Download
memory/60-117-0x00007FFAE1F10000-0x00007FFAE1F1B000-memory.dmp

Filesize
44KB

Download
memory/60-118-0x00007FFAD8EE0000-0x00007FFAD8F04000-memory.dmp

Filesize
144KB

Download
memory/60-119-0x00007FFADA5C0000-0x00007FFADA5D6000-memory.dmp

Filesize
88KB

Download
memory/60-93-0x00007FFACF050000-0x00007FFACF16C000-memory.dmp

Filesize
1.1MB

Download
memory/60-94-0x00007FFADD060000-0x00007FFADD07B000-memory.dmp

Filesize
108KB

Download
memory/60-77-0x00007FFAE1FC0000-0x00007FFAE1FD5000-memory.dmp

Filesize
84KB

Download
memory/60-84-0x00007FFAE2280000-0x00007FFAE22A4000-memory.dmp

Filesize
144KB

Download
memory/60-85-0x00007FFAE49E0000-0x00007FFAE49EF000-memory.dmp

Filesize
60KB

Download
memory/60-86-0x00007FFADE640000-0x00007FFADE652000-memory.dmp

Filesize
72KB

Download
memory/60-87-0x00007FFADE620000-0x00007FFADE634000-memory.dmp

Filesize
80KB

Download
memory/60-88-0x00007FFADDC00000-0x00007FFADDC14000-memory.dmp

Filesize
80KB

Download
memory/60-72-0x00007FFACF170000-0x00007FFACF4E5000-memory.dmp

Filesize
3.5MB

Download
memory/60-71-0x000002FBE8850000-0x000002FBE8BC5000-memory.dmp

Filesize
3.5MB

Download
memory/60-68-0x00007FFADDC20000-0x00007FFADDCD8000-memory.dmp

Filesize
736KB

Download
memory/60-66-0x00007FFADE770000-0x00007FFADE79E000-memory.dmp

Filesize
184KB

Download
memory/60-61-0x00007FFAE3180000-0x00007FFAE318D000-memory.dmp

Filesize
52KB

Download
memory/60-53-0x00007FFAE2FC0000-0x00007FFAE2FD9000-memory.dmp

Filesize
100KB

Download
memory/60-58-0x00007FFADE660000-0x00007FFADE695000-memory.dmp

Filesize
212KB

Download
memory/60-55-0x00007FFAE34B0000-0x00007FFAE34BD000-memory.dmp

Filesize
52KB

Download
memory/60-48-0x00007FFAE4870000-0x00007FFAE4889000-memory.dmp

Filesize
100KB

Download
memory/60-49-0x00007FFADE7F0000-0x00007FFADE81D000-memory.dmp

Filesize
180KB

Download
memory/60-42-0x00007FFAE2280000-0x00007FFAE22A4000-memory.dmp

Filesize
144KB

Download
memory/60-43-0x00007FFAE49E0000-0x00007FFAE49EF000-memory.dmp

Filesize
60KB

Download
memory/60-36-0x00007FFACF4F0000-0x00007FFACFAD9000-memory.dmp

Filesize
5.9MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request