Edit tour

Windows Analysis Report
http://tinyurl.com/4cbr8n8t

Overview

General Information

Sample URL:	http://tinyurl.com/4cbr8n8t
Analysis ID:	1417016
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2004,i,858439363166866708,11796472518649460152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6900 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://tinyurl.com/4cbr8n8t" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LLZ-pisrb7to06_imT7--DF4ap-Hd_n4FFKTechSqum6iLMyrMcHFrwH3DSLAc7qiFpFtO9UKr3g2FdJQbWRtBiFUmt8HGy9UyufWQIEResIkIno3WMrE8Txst1DU_dP6PHlA3i3C0j5dhDDjSEnktx8jj4f2EVqxMATN8-E4RYPzikevDR1NQFQLxIT0NGY1jZ7BzYCl42gGQJVDPUgLIb-0HlFz-_Vufbi4zCK8zgOngWm1yWtGlctuttE50U0rxJPb1inBJrcHKX28yA-EUkPXyRGZ4c&cb=5qjiu8db9vd2	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LLZ-pisrb7to06_imT7--DF4ap-Hd_n4FFKTechSqum6iLMyrMcHFrwH3DSLAc7qiFpFtO9UKr3g2FdJQbWRtBiFUmt8HGy9UyufWQIEResIkIno3WMrE8Txst1DU_dP6PHlA3i3C0j5dhDDjSEnktx8jj4f2EVqxMATN8-E4RYPzikevDR1NQFQLxIT0NGY1jZ7BzYCl42gGQJVDPUgLIb-0HlFz-_Vufbi4zCK8zgOngWm1yWtGlctuttE50U0rxJPb1inBJrcHKX28yA-EUkPXyRGZ4c&cb=5qjiu8db9vd2	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.209.62.90:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.62.90:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49703 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /4cbr8n8t HTTP/1.1Host: tinyurl.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /amp/p0TYllLRa.tgestbtw.com/RxSzx HTTP/1.1Host: google.aeConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LLZ-pisrb7to06_imT7--DF4ap-Hd_n4FFKTechSqum6iLMyrMcHFrwH3DSLAc7qiFpFtO9UKr3g2FdJQbWRtBiFUmt8HGy9UyufWQIEResIkIno3WMrE8Txst1DU_dP6PHlA3i3C0j5dhDDjSEnktx8jj4f2EVqxMATN8-E4RYPzikevDR1NQFQLxIT0NGY1jZ7BzYCl42gGQJVDPUgLIb-0HlFz-_Vufbi4zCK8zgOngWm1yWtGlctuttE50U0rxJPb1inBJrcHKX28yA-EUkPXyRGZ4c&cb=5qjiu8db9vd2 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
Source: global traffic	HTTP traffic detected: GET /js/bg/OMzbJ87gkB5MAUky6mmDB4mflkEza4rQHUJNCD4hS_4.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LLZ-pisrb7to06_imT7--DF4ap-Hd_n4FFKTechSqum6iLMyrMcHFrwH3DSLAc7qiFpFtO9UKr3g2FdJQbWRtBiFUmt8HGy9UyufWQIEResIkIno3WMrE8Txst1DU_dP6PHlA3i3C0j5dhDDjSEnktx8jj4f2EVqxMATN8-E4RYPzikevDR1NQFQLxIT0NGY1jZ7BzYCl42gGQJVDPUgLIb-0HlFz-_Vufbi4zCK8zgOngWm1yWtGlctuttE50U0rxJPb1inBJrcHKX28yA-EUkPXyRGZ4c&cb=5qjiu8db9vd2Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LLZ-pisrb7to06_imT7--DF4ap-Hd_n4FFKTechSqum6iLMyrMcHFrwH3DSLAc7qiFpFtO9UKr3g2FdJQbWRtBiFUmt8HGy9UyufWQIEResIkIno3WMrE8Txst1DU_dP6PHlA3i3C0j5dhDDjSEnktx8jj4f2EVqxMATN8-E4RYPzikevDR1NQFQLxIT0NGY1jZ7BzYCl42gGQJVDPUgLIb-0HlFz-_Vufbi4zCK8zgOngWm1yWtGlctuttE50U0rxJPb1inBJrcHKX28yA-EUkPXyRGZ4c&cb=5qjiu8db9vd2Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AM9qaELoax5VcKbFgGD2zLgg5666GoIPt1ziu1v46bVW_aERBX1MZoMkOvxTn9r2yJF_V2QAmP_emVD59HPG0QQ; NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA515YSWXZ2uQRU5C2JeMh2B8-jZ-CAvq3JQr6mWXq_fN_GXDbECH-0Xptke2wOEdHrE19WQQ0H3wFpuWUlCsH8Tvh7ENN34jier39833CXJ9n-3ZzcVq9GJzj5bh0SXf4iY_m2D_VzKyXiU4TAu_tcta1VKjMYNpX_qbbUpJmQ15qr24vg8IZElopJTLvc86gK_6hW1qLog7FjVAwDdaziTjnOQxA&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AM9qaELoax5VcKbFgGD2zLgg5666GoIPt1ziu1v46bVW_aERBX1MZoMkOvxTn9r2yJF_V2QAmP_emVD59HPG0QQ; NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA515YSWXZ2uQRU5C2JeMh2B8-jZ-CAvq3JQr6mWXq_fN_GXDbECH-0Xptke2wOEdHrE19WQQ0H3wFpuWUlCsH8Tvh7ENN34jier39833CXJ9n-3ZzcVq9GJzj5bh0SXf4iY_m2D_VzKyXiU4TAu_tcta1VKjMYNpX_qbbUpJmQ15qr24vg8IZElopJTLvc86gK_6hW1qLog7FjVAwDdaziTjnOQxA&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AM9qaELoax5VcKbFgGD2zLgg5666GoIPt1ziu1v46bVW_aERBX1MZoMkOvxTn9r2yJF_V2QAmP_emVD59HPG0QQ; NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE

Source: unknown

DNS traffic detected: queries for: tinyurl.com

Source: unknown

HTTP traffic detected: POST /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 7425sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-protobufferAccept: */*Origin: https://www.google.comX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE

Source: chromecache_68.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_68.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_68.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_68.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_68.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_68.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_68.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_68.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_68.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_68.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_68.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_73.2.dr, chromecache_68.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_68.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__.
Source: chromecache_73.2.dr, chromecache_65.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.209.62.90:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.62.90:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49703 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@17/43@10/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2004,i,858439363166866708,11796472518649460152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://tinyurl.com/4cbr8n8t"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2004,i,858439363166866708,11796472518649460152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://tinyurl.com/4cbr8n8t	0%	Avira URL Cloud	safe
http://tinyurl.com/4cbr8n8t	1%	Virustotal		Browse

Source	Detection	Scanner	Label
https://recaptcha.net	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
about:blank	0%	Avira URL Cloud	safe
https://www.gstatic.c..?/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tinyurl.com	104.20.139.65	true	false	high
www.google.com	142.251.16.106	true	false	high
google.ae	172.253.115.94	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx	false		high
https://www.google.com/recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false		high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf	false		high
https://www.google.com/recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false		high
https://www.google.com/recaptcha/api.js	false		high
https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high
https://www.google.com/js/bg/OMzbJ87gkB5MAUky6mmDB4mflkEza4rQHUJNCD4hS_4.js	false		high
about:blank	false	Avira URL Cloud: safe	low
https://tinyurl.com/4cbr8n8t	false		high
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LLZ-pisrb7to06_imT7--DF4ap-Hd_n4FFKTechSqum6iLMyrMcHFrwH3DSLAc7qiFpFtO9UKr3g2FdJQbWRtBiFUmt8HGy9UyufWQIEResIkIno3WMrE8Txst1DU_dP6PHlA3i3C0j5dhDDjSEnktx8jj4f2EVqxMATN8-E4RYPzikevDR1NQFQLxIT0NGY1jZ7BzYCl42gGQJVDPUgLIb-0HlFz-_Vufbi4zCK8zgOngWm1yWtGlctuttE50U0rxJPb1inBJrcHKX28yA-EUkPXyRGZ4c&cb=5qjiu8db9vd2	false		high
https://www.google.com/favicon.ico	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/log?format=json&hasfast=true	chromecache_68.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_68.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_68.2.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_68.2.dr	false		high
https://support.google.com/recaptcha#6262736	chromecache_68.2.dr	false		high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_68.2.dr	false		high
https://recaptcha.net	chromecache_68.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.gstatic.c..?/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__.	chromecache_68.2.dr	false	Avira URL Cloud: safe	low
https://www.google.com/recaptcha/api2/	chromecache_73.2.dr, chromecache_68.2.dr	false		high
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_68.2.dr	false		high
https://cloud.google.com/contact	chromecache_68.2.dr	false		high
https://support.google.com/recaptcha	chromecache_68.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_68.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.16.103	unknown	United States	15169	GOOGLEUS	false
172.67.1.225	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.16.106	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.115.94	google.ae	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.7
192.168.2.9

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417016
Start date and time:	2024-03-28 13:58:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://tinyurl.com/4cbr8n8t
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@17/43@10/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.31.94, 172.253.63.101, 172.253.63.138, 172.253.63.102, 172.253.63.139, 172.253.63.113, 172.253.63.100, 172.253.122.84, 34.104.35.123, 172.253.63.94, 172.253.122.95, 172.253.63.95, 142.251.167.95, 172.253.62.95, 142.251.163.95, 142.251.111.95, 142.251.16.95, 172.253.115.95, 142.250.31.95, 142.251.167.94, 13.85.23.86, 192.229.211.108, 20.3.187.198, 52.165.165.26, 20.114.59.183
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, fonts.gstatic.com, slscr.update.microsoft.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 11:59:39 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9765184305357475
Encrypted:	false
SSDEEP:	48:8N0dCTOTGFAHT0idAKZdA1oehwiZUklqeh1y+3:8NZwGSDey
MD5:	7B29455F151A9041365738AC87BD18A8
SHA1:	DF0D8D016601FFFDD79FE431FB8F3C1776878580
SHA-256:	B7EDA941C1D9D2C53208D6F0346D6098DC55A46435EA3A55E53BF4C809950467
SHA-512:	F33D6B2B9D012AB9BF405A1490F6D588318A6D3F106C50A09E453665EBA8F6C4CEC4413FFC929123F5F24F24A623EE19B8A607769D69834CD903BCDBF4ABFB83
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......F.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Xrg....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xrg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Xrg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Xrg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Xtg...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........fv.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 11:59:39 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9907447254651354
Encrypted:	false
SSDEEP:	48:8O0dCTOTGFAHT0idAKZdA1leh/iZUkAQkqehOy+2:8OZwGSx9QLy
MD5:	F9288B254F4471D9EC6B8DC2E77AABFD
SHA1:	672BFD184CD8EEF1196617D682B41A389A9CBE8B
SHA-256:	20F18C3044A7C635A4EC053B3C30159B6DA67F5E3ACC13AD2DE527A1480C1C85
SHA-512:	15FED6AE89EA91263390FBFB0C7967D58F8B6011BD3412C6A9838574331EF32E4F5DD62BF7BEE080D08638BEA8D0FDD6DFAFB26D4B46E7571E9AFC9FA9AD5DAF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......9.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Xrg....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xrg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Xrg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Xrg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Xtg...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........fv.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.998805808936922
Encrypted:	false
SSDEEP:	48:8/0dCTOTGbHT0idAKZdA14t5eh7sFiZUkmgqeh7sky+BX:8/ZwG3RnCy
MD5:	AE42C4A3E0FBE5E02F1E8F5056B38F62
SHA1:	6F5AE4EDC01CE7FDAD3A7C5493A86EA267F9DAF0
SHA-256:	429265C0943CF272BC85E440BEDCC7F6DC553B44F9D2CB420777DF5B0FFC17AF
SHA-512:	76B10B3147B2605444CABDFF1E232068170DF1FA6F1B2419EC2C65E4938FD2BD19DB77031FC1E5134CC3728758498750EE77A2B6D9BC7C4D01603CBC8D619B3C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Xrg....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xrg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Xrg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Xrg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........fv.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 11:59:39 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9875283707301064
Encrypted:	false
SSDEEP:	48:890dCTOTGFAHT0idAKZdA16ehDiZUkwqehKy+R:89ZwGSCsy
MD5:	43A8FEC0A33558231623698600C57E3D
SHA1:	B07927991CEEEC2EFA6B8001664D52195D521DE6
SHA-256:	3D9FAEC76FAF9CA3F0BEF0511BFB08CA45AF19313765832E48453666793A0B1A
SHA-512:	10FFEA40DA04AB6F37A5E9D0AEEFA68628DE2D91E68006D63AE5E77C3CE6104E1BF08A9DBEB688B971185F5965E89260633FBAC43882E1596D1313E2EE3E96A2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....V3.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Xrg....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xrg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Xrg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Xrg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Xtg...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........fv.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 11:59:39 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.975971389112968
Encrypted:	false
SSDEEP:	48:83v0dCTOTGFAHT0idAKZdA1UehBiZUk1W1qehIy+C:83vZwGSy9oy
MD5:	F54020485B15537AA870ADCC3F58FC90
SHA1:	184C26F159A90B6B521C2DD0930131EFA148BC16
SHA-256:	978F89F1193DA6F37E6CBB8C6C931A150AC4CD3086E3E18A6818ABC02B238213
SHA-512:	C56E476939D2CC9AEFEE714B7051F57FA6FED2880D29B10BA890D0947FA3132AEAFBBE0FD93E48A84F02EF279940C0CF4903B42A70A44252E69F48B5F4B3C200
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......>.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Xrg....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xrg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Xrg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Xrg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Xtg...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........fv.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 11:59:39 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.991878590869895
Encrypted:	false
SSDEEP:	48:8O0dCTOTGFAHT0idAKZdA1duTrehOuTbbiZUk5OjqehOuTbCy+yT+:8OZwGSzTYTbxWOvTbCy7T
MD5:	0B041D45B0F8DF5E54792C0853DD8B64
SHA1:	A8013188DD36232304C4407AF045A395C5960BF0
SHA-256:	17E6228C8A44FA582B09478E274FE2516292C31BB1DDA766ED6F40582998AFCF
SHA-512:	C2DB407A632FA45C017F1F167C1AFCB72CFC872904162BFF2B969EBFC8C4F83F074FC232BC11829949A876394B61E7C93F67E60D6E51F097F772C7E0922CBA39
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Xrg....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xrg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Xrg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Xrg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Xtg...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........fv.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.831212416381637
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKq3TPMQZgWaee:PLKdXNQKqb5gL
MD5:	9F9C09E710BF4B791F895D28BCA13B4E
SHA1:	E83642A8B6872CEBBACD4A3902A7C55D7E6B89BB
SHA-256:	BFE921737A9444EA43003FCEE8F7BA1F9BFA429502ED435976605A5A87FA6A18
SHA-512:	968CE1F65ED431F79030A0C566326A0D0B973C04E6FB56726B4B9ED9BEBCC5255D4DF232D456D836165C15F92C7685C3986FBF7786D7E2FD0B3F099C10ABF387
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js');

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	low
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56398), with no line terminators
Category:	downloaded
Size (bytes):	56398
Entropy (8bit):	5.907604034780877
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKYlebyB5lxRx54PHSGdXXwW7MFWwXVuE2:4UcW6v+0B5chXwW49z2
MD5:	EB4BC511F79F7A1573B45F5775B3A99B
SHA1:	D910FB51AD7316AA54F055079374574698E74B35
SHA-256:	7859A62E04B0ACB06516EB12454DE6673883ECFAEAED6C254659BCA7CD59C050
SHA-512:	EC9BDF1C91B6262B183FD23F640EAC22016D1F42DB631380676ED34B962E01BADDA91F9CBDFA189B42FE3182A992F1B95A7353AF41E41B2D6E1DAB17E87637A0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (596)
Category:	downloaded
Size (bytes):	511331
Entropy (8bit):	5.71888713211764
Encrypted:	false
SSDEEP:	12288:7e12rSHPSBGm98q91OOf9Ni6CG9/xuQ7PieaImmUkFBP:Edqbw+/3lfpFBP
MD5:	48C590D47C8B1868CECAB334E9A34CBE
SHA1:	5F1A9F94294EC337F657AC2EBEC1C74E097CE5B3
SHA-256:	F3756825DF5194A174B7A55EBD3B484C276766EEF21343D34B053B98ED386801
SHA-512:	24B9E42BCEBEFCB81D2DC8760256A63E84846C2A49CEE2A6B3904EB5DBA4551DBEA599E0892C7FA6674E32D6E047CA31B396ADD5467F6D3FADFE8F9B3A72A6F2
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT./.var nA=function(){return[function(M,a,q,C,W,O){return 4>(M>>((W=[2,1,9],M&101)==M&&(qT\|\|D[40](22,"Edge"),CA\|\|(qT(),CA=a),Pj.add(q,C)),W)[0]&8)&&5<=(M>>W[1]&7)&&(D[8](W[0],function(Y){S[24](28,0,"end",Y,a)},wT),t[6](W[2],!1,wT)\|\|Z[33](5)),O},function(M,a,q,C,W,O,Y,P){return 2==(M+1&(M-6<<1<(((P=[22,57,33],10)>(M<<2&12)&&10<=(M>>1&11)&&(C=new be,Y=I[24](37,C,a,q)),M&42)==M&&(Y=Hj('<textarea id="'+J[41](3,a)+'" name="'+J[41](P[2],q)+'" class="g-recaptcha-response"></textarea>')),M)&&(M-2^P[0])>=M&&(D[25](61,.a,DG)\|\|D[25](P[1],a,Sf)?C=c[P[2]](36,a):(a instanceof Ur?q=c[P[2]](32,Z[3](31,a)):(a instanceof IN?W=c[P[2]](12,t[44](70,a).toString

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, components 3
Category:	dropped
Size (bytes):	30512
Entropy (8bit):	7.971166213703722
Encrypted:	false
SSDEEP:	768:att/cvQxgidYih0tUEf/T1QIjL7xQ0AqerkA/qf9LxYbO460GFc8YlZ:att/lDHh0tUK/ppenrelLxYbhZgYlZ
MD5:	4E3277820CD7DEC16A95353C027BDAE9
SHA1:	449D93B6AF0D87C6E77C3A3DF464E58A6DF8B136
SHA-256:	E598FEA4588FB57CF818EF539B498AD7D3E6118DD0949A6A322A5E2B2D936A71
SHA-512:	7322D3491F442FFA6B5288AAC7EF35A778FFA2F19BF2441460B5EBB3FADE8A1BC47037408DB4C0F3C5D9DAC5CF3D9C92AA1E5931367DF4CCE92DC2FCDECFE819
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................,.,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.../R.5.;D..`...'%.. f#n.....=;f.\|.ey......,.Aq...v-..=.j....6...%......7......b..v...........j0\]....?..q.V!O.Y..1...$.zsF..lo...Q6V.%..cF.P.....rp.....c.......i.j0Oy.~g....09.s..:rzv5.Z..~,.i.M..\|E.... ....T7..#.Eu:...Kq..YCg................}E\.TO..v..Z..-..Y...'{[-Q.&TA`..QF.....\..u=D.o..:..s....eX.(.;\..<g.J.G.5o.H..n\|X.....B2.9.!\|....jo..^....s.j7w..lZS..

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:	12:6v/7OEUT9vceKKNtY3kM8O+mucROzZbJOAjPBE2Iq8AnxT9:bTdcVIM8tfHzzjy2IdKT9
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:	12:6v/7OEUelyuRs56fyKgIEInu5VLJBZInmJhd/3VqQXD8GBm1:belFRs56fuIEIu5VNBZInMTICfBO
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/info_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	low
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1222), with no line terminators
Category:	downloaded
Size (bytes):	1222
Entropy (8bit):	5.816702834732249
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCLTLv138EgFB5vtTGJTlWtqbs11j2sLqo40RWUnYN:VKEctKonR3evtTA8d15HLrwUnG
MD5:	13F205D907EAAD06744379FF66C6ECDB
SHA1:	096C28C619C99714192E2161A60315A404BC0618
SHA-256:	15347086A4C3F7A12D7AE800FA711B988A1C1C1572262D53B9295D1E1A089E8A
SHA-512:	C973122796A254D9F83CCFEA4250EF05E92BE20C1E7212169A43B2937C5E8FF506907F4D687F08B38F8BF8B71E3EDDE131B998767DCFF52E19DE57FF7317E227
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-wEVSdqKc5hf9vkWC9kAmVRAEa11o8QNGecO6p5G2

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:	12:6v/7OEUelyuRs56fyKgIEInu5VLJBZInmJhd/3VqQXD8GBm1:belFRs56fuIEIu5VNBZInMTICfBO
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:	12:6v/7OEUT9vceKKNtY3kM8O+mucROzZbJOAjPBE2Iq8AnxT9:bTdcVIM8tfHzzjy2IdKT9
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/refresh_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0
Category:	downloaded
Size (bytes):	15340
Entropy (8bit):	7.983406336508752
Encrypted:	false
SSDEEP:	384:F2gPJde0V2iGrQyD8b3k/tigCdeNqOUd47SH0tsGm:4gPVV2NQE8b3ldeNWH0Wb
MD5:	19B7A0ADFDD4F808B53AF7E2CE2AD4E5
SHA1:	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA
SHA-256:	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
SHA-512:	49DA16000687AC81FC4CA9E9112BDCA850BB9F32E0AF2FE751ABC57A8E9C3382451B50998CEB9DE56FC4196F1DC7EF46BBA47933FC47EB4538124870B7630036
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Preview:	wOF2......;........d..;..........................d..z..J.`..L.Z..<.....\..`..^...x.6.$..6. ..\|. ..8..z%......Q.{..q...FF.kd .8.(..d..).!C...Y.JA...r. ..GH8F......nW...".2&....2<..+C...p...b..SC.......J......z.-..Q..#6&1zUe../\...l.....<.....9s...E~.]B-..B.wY..o......Q..A.F..1j.......-.`P% .. ,..@1.0..~.....WWW.d.u<c{..^.R.+..w....&.........A......+C....(.N.....0.~..0.J.;.Nu..7....]..m.H.....[h.GL3....?)....c.H...2.3.}y........SXI\|..iVN'%E.D.W....r..<`....i....6;E$.....U.$j.@...._.......R2....WS...k.vz.R.'a9!^...N....h.._.....c.%."..S.2.16B...o.2}.pmU[.\|.LI....2.....OWQLO1-....s..8.(...".\|6...6R.. ..M-.zO.}w)..v..mXxX...c..3#.+.v....F`.Z;.zQ.......r,....Yo.....g.h....+.....O.3Y..)Y.8.!....elX......._.3.}k~u.{ C..H.z..FP........@...d..)T.R...L.H.J.j.@..............$...E......y...3.b...I.h u.+%.HA.\..9..8..X.!....gx...].:..V..C...._..X..!....6..)...GM:E.....O.Z.}k.;.T.k..D.k.O..D5.r..."......?..T.Q.A...CF...3g.5.Dn<.QPy..G..1.9..Q..0..

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17572)
Category:	downloaded
Size (bytes):	18165
Entropy (8bit):	5.653435632518094
Encrypted:	false
SSDEEP:	384:Ep2K696g5H5zhHZDIgcuuTZmAcTTQp05yiWeaenqGElHKN/:M2KOH5r/UVQj/aenRElqd
MD5:	0C4D3AB97EFA1A507DD8F13E313ABF93
SHA1:	69A2C481F8C5DB9FE2B3AD071EDC08018AD91E73
SHA-256:	38CCDB27CEE0901E4C014932EA698307899F9641336B8AD01D424D083E214BFE
SHA-512:	45145813E2BDD627B86C537A9CDBBFE29AC712D6AC3D56C17F2CE05F3C5AD8A1B48342812D713625505E7DA62F88238BEE6DFDBA76FD0F8ACE923CF400A0358C
Malicious:	false
Reputation:	low
URL:	https://www.google.com/js/bg/OMzbJ87gkB5MAUky6mmDB4mflkEza4rQHUJNCD4hS_4.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var m=this\|\|self,q=function(B){return B},N=function(B,u){if(B=(u=m.trustedTypes,null),!u\|\|!u.createPolicy)return B;try{B=u.createPolicy("bg",{createHTML:q,createScript:q,createScriptURL:q})}catch(D){m.console&&m.console.error(D.message)}return B};(0,eval)(function(B,u){return(u=N())&&1===B.eval(u.createScript("1"))?function(D){return u.createScript(D)}:function(D){return""+D}}(m)(Array(7824Math.random()\|0).join("\n")+['(function(){/',.'',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var e=function(B,u){for(u=[];B--;)u.push(255*Math.random()\|0);return u},Bu=function(B,u,q,D){for(q=(D=O(u),0);0<B;B--)q=q<<8\|A(u);L(D,u,q)},us=function(B,u){104<B.h.length?U([y,36],B,0):(B.h.push(B.A.slice()),B.A[227]=void 0,L(227,B,u))},DM=function(B,u,q,D,T){for(T=(B=(D=B[3]\|0,B[2]\|0),0);14>T;T++)q=q>>>8\|q<<24,q+=u\|0,D=D>>>8\|D<<24,u=u<<3\|u>>>29,D+=B\|0,D^=T+1635,q^=B+1635,u^=q,B=B<<3\|B>>>29,B^=D;return

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:	12:6v/7OEUhUxzPKmghSn8nazyk+k8/OzxQcxNMvVb:bhUxzlvWkT8FcxK1
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/audio_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.184482755717443
Encrypted:	false
SSDEEP:	6:otqWtxbQLZVVi7GeqlAGmwbQLZVZYZ7qT:o7xbK95eqKVaKiM
MD5:	B54D0452E2FDB8C0D91C455D1C5495F9
SHA1:	DDD85730B9CB4CB9905B1D7E7643F595D2F33CB8
SHA-256:	F4138D99EC6E17514BB87CEEAD1C1D2A204219C970864FC85BFF00949EE18082
SHA-512:	6883DE3ABB2A7B71CBDE6EDA0854D5B9EC696A0656735843BBB6329007D758B502D2557CB36D5A1CEFC7B4D0AB5DCBC227C88DE9163662741C60F9D561F5A367
Malicious:	false
Reputation:	low
Preview:	<HTML>.<HEAD>.<TITLE>HTTP method GET is not supported by this URL</TITLE>.</HEAD>.<BODY BGCOLOR="#FFFFFF" TEXT="#000000">. GSE Default Error -->.<H1>HTTP method GET is not supported by this URL</H1>.<H2>Error 405</H2>.</BODY>.</HTML>.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:	12:6v/7OEUhUxzPKmghSn8nazyk+k8/OzxQcxNMvVb:bhUxzlvWkT8FcxK1
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, components 3
Category:	downloaded
Size (bytes):	30512
Entropy (8bit):	7.971166213703722
Encrypted:	false
SSDEEP:	768:att/cvQxgidYih0tUEf/T1QIjL7xQ0AqerkA/qf9LxYbO460GFc8YlZ:att/lDHh0tUK/ppenrelLxYbhZgYlZ
MD5:	4E3277820CD7DEC16A95353C027BDAE9
SHA1:	449D93B6AF0D87C6E77C3A3DF464E58A6DF8B136
SHA-256:	E598FEA4588FB57CF818EF539B498AD7D3E6118DD0949A6A322A5E2B2D936A71
SHA-512:	7322D3491F442FFA6B5288AAC7EF35A778FFA2F19BF2441460B5EBB3FADE8A1BC47037408DB4C0F3C5D9DAC5CF3D9C92AA1E5931367DF4CCE92DC2FCDECFE819
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA515YSWXZ2uQRU5C2JeMh2B8-jZ-CAvq3JQr6mWXq_fN_GXDbECH-0Xptke2wOEdHrE19WQQ0H3wFpuWUlCsH8Tvh7ENN34jier39833CXJ9n-3ZzcVq9GJzj5bh0SXf4iY_m2D_VzKyXiU4TAu_tcta1VKjMYNpX_qbbUpJmQ15qr24vg8IZElopJTLvc86gK_6hW1qLog7FjVAwDdaziTjnOQxA&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................,.,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.../R.5.;D..`...'%.. f#n.....=;f.\|.ey......,.Aq...v-..=.j....6...%......7......b..v...........j0\]....?..q.V!O.Y..1...$.zsF..lo...Q6V.%..cF.P.....rp.....c.......i.j0Oy.~g....09.s..:rzv5.Z..~,.i.M..\|E.... ....T7..#.Eu:...Kq..YCg................}E\.TO..v..Z..-..Y...'{[-Q.&TA`..QF.....\..u=D.o..:..s....eX.(.;\..<g.J.G.5o.H..n\|X.....B2.9.!\|....jo..^....s.j7w..lZS..

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk8dqZYMe7mkRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 13:59:32.150672913 CET	49676	443	192.168.2.8	52.182.143.211
Mar 28, 2024 13:59:34.072520018 CET	49673	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:34.447484970 CET	49672	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:36.963121891 CET	49676	443	192.168.2.8	52.182.143.211
Mar 28, 2024 13:59:38.220324039 CET	49671	443	192.168.2.8	204.79.197.203
Mar 28, 2024 13:59:39.971575975 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:39.971601963 CET	443	49710	172.67.1.225	192.168.2.8
Mar 28, 2024 13:59:39.971703053 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:39.971915960 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:39.971926928 CET	443	49710	172.67.1.225	192.168.2.8
Mar 28, 2024 13:59:40.171446085 CET	443	49710	172.67.1.225	192.168.2.8
Mar 28, 2024 13:59:40.182056904 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:40.182070017 CET	443	49710	172.67.1.225	192.168.2.8
Mar 28, 2024 13:59:40.183166981 CET	443	49710	172.67.1.225	192.168.2.8
Mar 28, 2024 13:59:40.183235884 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:40.184895039 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:40.184964895 CET	443	49710	172.67.1.225	192.168.2.8
Mar 28, 2024 13:59:40.185086012 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:40.185094118 CET	443	49710	172.67.1.225	192.168.2.8
Mar 28, 2024 13:59:40.238765001 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:40.547636986 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:40.547741890 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:40.602220058 CET	443	49710	172.67.1.225	192.168.2.8
Mar 28, 2024 13:59:40.602397919 CET	443	49710	172.67.1.225	192.168.2.8
Mar 28, 2024 13:59:40.602473974 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:40.604409933 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:40.604437113 CET	443	49710	172.67.1.225	192.168.2.8
Mar 28, 2024 13:59:40.604448080 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:40.604510069 CET	49710	443	192.168.2.8	172.67.1.225
Mar 28, 2024 13:59:40.712188005 CET	49713	443	192.168.2.8	172.253.115.94
Mar 28, 2024 13:59:40.712215900 CET	443	49713	172.253.115.94	192.168.2.8
Mar 28, 2024 13:59:40.712289095 CET	49713	443	192.168.2.8	172.253.115.94
Mar 28, 2024 13:59:40.712531090 CET	49713	443	192.168.2.8	172.253.115.94
Mar 28, 2024 13:59:40.712543964 CET	443	49713	172.253.115.94	192.168.2.8
Mar 28, 2024 13:59:40.922990084 CET	443	49713	172.253.115.94	192.168.2.8
Mar 28, 2024 13:59:40.939374924 CET	49713	443	192.168.2.8	172.253.115.94
Mar 28, 2024 13:59:40.939389944 CET	443	49713	172.253.115.94	192.168.2.8
Mar 28, 2024 13:59:40.940440893 CET	443	49713	172.253.115.94	192.168.2.8
Mar 28, 2024 13:59:40.940540075 CET	49713	443	192.168.2.8	172.253.115.94
Mar 28, 2024 13:59:40.943803072 CET	49713	443	192.168.2.8	172.253.115.94
Mar 28, 2024 13:59:40.943861961 CET	443	49713	172.253.115.94	192.168.2.8
Mar 28, 2024 13:59:40.944206953 CET	49713	443	192.168.2.8	172.253.115.94
Mar 28, 2024 13:59:40.944214106 CET	443	49713	172.253.115.94	192.168.2.8
Mar 28, 2024 13:59:40.986809969 CET	49713	443	192.168.2.8	172.253.115.94
Mar 28, 2024 13:59:41.377192974 CET	443	49713	172.253.115.94	192.168.2.8
Mar 28, 2024 13:59:41.377260923 CET	49713	443	192.168.2.8	172.253.115.94
Mar 28, 2024 13:59:41.377270937 CET	443	49713	172.253.115.94	192.168.2.8
Mar 28, 2024 13:59:41.377320051 CET	443	49713	172.253.115.94	192.168.2.8
Mar 28, 2024 13:59:41.377361059 CET	49713	443	192.168.2.8	172.253.115.94
Mar 28, 2024 13:59:41.382054090 CET	49713	443	192.168.2.8	172.253.115.94
Mar 28, 2024 13:59:41.382069111 CET	443	49713	172.253.115.94	192.168.2.8
Mar 28, 2024 13:59:41.483210087 CET	49714	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:41.483254910 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:41.483330011 CET	49714	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:41.484080076 CET	49714	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:41.484098911 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:41.695142984 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:41.695698977 CET	49714	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:41.695720911 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:41.696785927 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:41.696851015 CET	49714	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:41.699428082 CET	49714	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:41.699508905 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:41.700062990 CET	49714	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:41.700071096 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:41.753213882 CET	49714	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:41.897360086 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:41.897406101 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:41.897449970 CET	49714	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:41.897466898 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:41.897542000 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:41.897650003 CET	49714	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:41.898344040 CET	49714	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:41.898359060 CET	443	49714	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:42.315231085 CET	49715	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:42.315275908 CET	443	49715	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:42.315356970 CET	49715	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:42.316056013 CET	49715	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:42.316070080 CET	443	49715	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:42.533513069 CET	443	49715	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:42.571297884 CET	49715	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:42.571316957 CET	443	49715	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:42.572088957 CET	443	49715	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:42.572813034 CET	49715	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:42.572921991 CET	443	49715	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:42.573265076 CET	49715	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:42.616239071 CET	443	49715	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:42.767309904 CET	443	49715	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:42.767508030 CET	443	49715	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:42.767574072 CET	49715	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:42.782788992 CET	49715	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:42.782815933 CET	443	49715	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:42.829492092 CET	49716	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:42.829523087 CET	443	49716	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:42.829668999 CET	49716	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:42.833811998 CET	49716	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:42.833827972 CET	443	49716	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:43.199717045 CET	443	49716	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:43.199781895 CET	49716	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:43.217432022 CET	49716	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:43.217453003 CET	443	49716	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:43.217700958 CET	443	49716	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:43.268639088 CET	49716	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:43.432213068 CET	49716	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:43.480238914 CET	443	49716	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:43.612101078 CET	443	49716	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:43.612171888 CET	443	49716	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:43.612237930 CET	49716	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:43.612349033 CET	49716	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:43.612370014 CET	443	49716	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:43.612375021 CET	49716	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:43.612380028 CET	443	49716	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:43.653793097 CET	49718	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:43.653831005 CET	443	49718	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:43.653912067 CET	49718	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:43.654256105 CET	49718	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:43.654262066 CET	443	49718	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:43.680505991 CET	49673	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:44.016660929 CET	443	49718	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:44.016746998 CET	49718	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:44.054164886 CET	49672	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:44.153300047 CET	49718	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:44.153330088 CET	443	49718	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:44.153661013 CET	443	49718	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:44.157150030 CET	49718	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:44.159616947 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.159668922 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.159749985 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.160109997 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.160125971 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.200237036 CET	443	49718	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:44.376135111 CET	443	49718	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:44.376243114 CET	443	49718	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:44.376311064 CET	49718	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:44.377985001 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.378496885 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.378505945 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.378885984 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.380045891 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.380104065 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.380575895 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.380599022 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.381634951 CET	49718	443	192.168.2.8	23.209.62.90
Mar 28, 2024 13:59:44.381656885 CET	443	49718	23.209.62.90	192.168.2.8
Mar 28, 2024 13:59:44.631865025 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.631932974 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.631963968 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.632010937 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.632019043 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.632031918 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.632055998 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.639065981 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.639123917 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.639131069 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.646425962 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.646478891 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.646492004 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.646500111 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.646574020 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.652045012 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.659367085 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.659446001 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.659452915 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.707226992 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.737529039 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.741211891 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.741283894 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.741358995 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.741372108 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.741714954 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.748648882 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.756135941 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.756227016 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.756232023 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.763859034 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.763922930 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.763931036 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.771080017 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.771141052 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.771147966 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.778434038 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.778527975 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.778533936 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.785780907 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.786016941 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.786031961 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.792557001 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.792996883 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.793003082 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.799180031 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.799230099 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.799237013 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.805906057 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.805969000 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.805974007 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.812505960 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.812536001 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.812606096 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.812614918 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.812700033 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.819154978 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.822472095 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.822524071 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.822540045 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.822612047 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:44.822662115 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.823035002 CET	49719	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:44.823046923 CET	443	49719	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:45.787991047 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:45.788008928 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:45.788139105 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:45.789340973 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:45.789351940 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.011517048 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.011763096 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.011799097 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.012192011 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.012753963 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.012834072 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.013348103 CET	49725	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.013385057 CET	443	49725	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.013458967 CET	49725	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.013612032 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.014014006 CET	49725	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.014028072 CET	443	49725	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.056246996 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.219033003 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.219114065 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.219160080 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.219218016 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.219230890 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.219242096 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.219275951 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.219295979 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.219320059 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.225491047 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.229983091 CET	443	49725	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.230452061 CET	49725	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.230469942 CET	443	49725	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.230791092 CET	443	49725	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.231182098 CET	49725	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.231236935 CET	443	49725	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.231462955 CET	49725	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.232546091 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.232572079 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.232595921 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.232618093 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.232656956 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.239645004 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.246598005 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.246649981 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.246674061 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.276236057 CET	443	49725	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.298881054 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.319947958 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.323425055 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.323484898 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.323498011 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.323539972 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.323872089 CET	49723	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.323889971 CET	443	49723	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.458266020 CET	443	49725	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.458410025 CET	443	49725	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.458479881 CET	49725	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.498389006 CET	49725	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.498405933 CET	443	49725	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.548511028 CET	49727	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.548537016 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.548619986 CET	49727	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.549068928 CET	49727	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.549083948 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.565964937 CET	49676	443	192.168.2.8	52.182.143.211
Mar 28, 2024 13:59:46.755352974 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.757201910 CET	49727	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.757215023 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.757548094 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.760420084 CET	49727	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.760477066 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.760586977 CET	49727	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.794720888 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.794754028 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.794913054 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.795244932 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.795257092 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.800151110 CET	49727	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.800157070 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.961886883 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.961935043 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.961966991 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.962013006 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.962021112 CET	49727	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.962033033 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.962054014 CET	49727	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.964832067 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:46.964888096 CET	49727	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.965293884 CET	49727	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:46.965305090 CET	443	49727	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.011431932 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.011660099 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:47.011672020 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.012007952 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.012435913 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:47.012495041 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.012537003 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:47.055373907 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:47.055382967 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.073278904 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.073314905 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.073404074 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.074610949 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.074620962 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.242933989 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.242995977 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.243032932 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.243048906 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:47.243060112 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.243103981 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.243108988 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:47.243114948 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.243184090 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:47.243191004 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.252674103 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.252743006 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:47.252965927 CET	49728	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:47.252983093 CET	443	49728	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:47.280397892 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.280693054 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.280709028 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.282020092 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.282079935 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.282466888 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.282531023 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.282645941 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.282654047 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.323271036 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.484832048 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.484877110 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.484915018 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.484930038 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.484946012 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.484981060 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.485043049 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.485052109 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.485096931 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.486119986 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:47.486156940 CET	443	49729	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:47.486279011 CET	49729	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:54.886827946 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:55.041248083 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:55.041954041 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:55.041969061 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:55.042007923 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:55.042021036 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:55.042027950 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:55.042063951 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:56.781846046 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:56.936790943 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:56.938851118 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:56.970506907 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:56.970720053 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:56.971235991 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:56.971298933 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:57.125173092 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:57.125242949 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:57.125279903 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:57.125328064 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:57.125332117 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:57.125480890 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:57.127489090 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:57.171798944 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:57.171871901 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:57.171902895 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:57.171926022 CET	49703	443	192.168.2.8	23.206.229.226
Mar 28, 2024 13:59:57.321608067 CET	443	49703	23.206.229.226	192.168.2.8
Mar 28, 2024 13:59:59.286819935 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.286859989 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.287228107 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.287228107 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.287266016 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.495429993 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.495723963 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.495749950 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.496170044 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.496670961 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.496670961 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.496689081 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.496737003 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.496737003 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.496777058 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.548885107 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.790025949 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.799839973 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.799997091 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.800029039 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.800044060 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.801115036 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.801122904 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.807369947 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.807411909 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.807430029 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.807437897 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.807491064 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.814223051 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.821250916 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.821289062 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.821316957 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.821325064 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.821682930 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.890034914 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.893469095 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.893503904 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.893524885 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.893532991 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.893980026 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.900424004 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.900496006 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.900619030 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.900795937 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.900795937 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.906835079 CET	49733	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:59.906862020 CET	443	49733	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:59.907099009 CET	49733	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:59.910834074 CET	49733	443	192.168.2.8	142.251.16.103
Mar 28, 2024 13:59:59.910847902 CET	443	49733	142.251.16.103	192.168.2.8
Mar 28, 2024 13:59:59.941261053 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.941274881 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 13:59:59.941407919 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.941904068 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 13:59:59.941915989 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.118772984 CET	443	49733	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.119102955 CET	49733	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.119131088 CET	443	49733	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.120342970 CET	443	49733	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.120392084 CET	49733	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.121148109 CET	49733	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.121231079 CET	443	49733	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.121309042 CET	49733	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.168235064 CET	443	49733	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.174858093 CET	49733	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.174882889 CET	443	49733	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.185478926 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.186250925 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.186260939 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.186584949 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.187089920 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.187150002 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.187302113 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.205806971 CET	49732	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.205828905 CET	443	49732	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.221894979 CET	49733	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.228260994 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.340265036 CET	443	49733	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.340445995 CET	443	49733	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.340497017 CET	49733	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.341418982 CET	49733	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.341434002 CET	443	49733	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.404652119 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.404788971 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.404840946 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.404848099 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.404860020 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.404943943 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.404951096 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.408286095 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.408375025 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.408381939 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.411911011 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.411971092 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.411979914 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.418806076 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.418869019 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.418895960 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.426163912 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.426227093 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.426235914 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.470249891 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.470259905 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.505948067 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.506058931 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.506089926 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.509407997 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.509459019 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.509475946 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.516819000 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.516976118 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.516987085 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.523741007 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.523797989 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.523816109 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.530519962 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.530575991 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.530585051 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.537595987 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.537643909 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.537657022 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.545072079 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.545124054 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.545453072 CET	49737	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:00.545466900 CET	443	49737	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:00.553267956 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.553293943 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.553365946 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.553797007 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.553811073 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.773678064 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.773957014 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.773967981 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.774328947 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.774756908 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.774820089 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:00.774918079 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:00.816242933 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.007397890 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.007519007 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.007559061 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.007618904 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.007641077 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.007838964 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.008336067 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.014703035 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.014751911 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.014770031 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.014775991 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.014836073 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.021991968 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.029366016 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.029412985 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.029432058 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.029438972 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.029495955 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.036705017 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.080169916 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.113456011 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.117023945 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.117069006 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.117073059 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.117079973 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.117121935 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.127824068 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.131828070 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.131903887 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.131903887 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.131922960 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.131964922 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.139075041 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.146455050 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.146518946 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.146522999 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.146533012 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.146595955 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.153780937 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.153856039 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:01.153903961 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.154100895 CET	49743	443	192.168.2.8	142.251.16.103
Mar 28, 2024 14:00:01.154114962 CET	443	49743	142.251.16.103	192.168.2.8
Mar 28, 2024 14:00:27.503254890 CET	49704	80	192.168.2.8	72.21.81.240
Mar 28, 2024 14:00:27.597507954 CET	80	49704	72.21.81.240	192.168.2.8
Mar 28, 2024 14:00:27.597592115 CET	49704	80	192.168.2.8	72.21.81.240
Mar 28, 2024 14:00:42.367928028 CET	49747	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:42.367980003 CET	443	49747	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:42.368055105 CET	49747	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:42.368813038 CET	49747	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:42.368829012 CET	443	49747	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:42.586450100 CET	443	49747	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:42.586805105 CET	49747	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:42.586839914 CET	443	49747	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:42.587229967 CET	443	49747	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:42.588192940 CET	49747	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:42.588273048 CET	443	49747	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:42.628458977 CET	49747	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:52.607233047 CET	443	49747	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:52.607304096 CET	443	49747	142.251.16.106	192.168.2.8
Mar 28, 2024 14:00:52.607364893 CET	49747	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:54.287237883 CET	49747	443	192.168.2.8	142.251.16.106
Mar 28, 2024 14:00:54.287276030 CET	443	49747	142.251.16.106	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 13:59:37.930651903 CET	53	55267	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:38.025173903 CET	53	58294	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:38.651916027 CET	53	56749	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:39.863347054 CET	52984	53	192.168.2.8	1.1.1.1
Mar 28, 2024 13:59:39.863543987 CET	63554	53	192.168.2.8	1.1.1.1
Mar 28, 2024 13:59:39.873747110 CET	53236	53	192.168.2.8	1.1.1.1
Mar 28, 2024 13:59:39.874032021 CET	53042	53	192.168.2.8	1.1.1.1
Mar 28, 2024 13:59:39.958018064 CET	53	52984	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:39.960316896 CET	53	63554	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:39.970688105 CET	53	53236	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:39.971103907 CET	53	53042	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:40.605726004 CET	56448	53	192.168.2.8	1.1.1.1
Mar 28, 2024 13:59:40.605890036 CET	63836	53	192.168.2.8	1.1.1.1
Mar 28, 2024 13:59:40.703555107 CET	53	56448	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:40.711709976 CET	53	63836	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:41.386555910 CET	62367	53	192.168.2.8	1.1.1.1
Mar 28, 2024 13:59:41.387171984 CET	57390	53	192.168.2.8	1.1.1.1
Mar 28, 2024 13:59:41.482234001 CET	53	62367	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:41.482275963 CET	53	57390	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:42.890363932 CET	53	61278	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:44.257476091 CET	53	51025	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:45.972352982 CET	53	51290	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:46.350001097 CET	53	52659	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:46.976170063 CET	63421	53	192.168.2.8	1.1.1.1
Mar 28, 2024 13:59:46.976421118 CET	65270	53	192.168.2.8	1.1.1.1
Mar 28, 2024 13:59:47.070897102 CET	53	63421	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:47.071962118 CET	53	65270	1.1.1.1	192.168.2.8
Mar 28, 2024 13:59:55.937798023 CET	53	63045	1.1.1.1	192.168.2.8
Mar 28, 2024 14:00:15.037421942 CET	53	64689	1.1.1.1	192.168.2.8
Mar 28, 2024 14:00:27.418744087 CET	138	138	192.168.2.8	192.168.2.255
Mar 28, 2024 14:00:37.779432058 CET	53	51910	1.1.1.1	192.168.2.8
Mar 28, 2024 14:00:37.795923948 CET	53	50125	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 28, 2024 13:59:39.863347054 CET	192.168.2.8	1.1.1.1	0x85b1	Standard query (0)	tinyurl.com	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:39.863543987 CET	192.168.2.8	1.1.1.1	0x5c2c	Standard query (0)	tinyurl.com	65	IN (0x0001)	false
Mar 28, 2024 13:59:39.873747110 CET	192.168.2.8	1.1.1.1	0x9a96	Standard query (0)	tinyurl.com	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:39.874032021 CET	192.168.2.8	1.1.1.1	0x442a	Standard query (0)	tinyurl.com	65	IN (0x0001)	false
Mar 28, 2024 13:59:40.605726004 CET	192.168.2.8	1.1.1.1	0xac8a	Standard query (0)	google.ae	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:40.605890036 CET	192.168.2.8	1.1.1.1	0xeaca	Standard query (0)	google.ae	65	IN (0x0001)	false
Mar 28, 2024 13:59:41.386555910 CET	192.168.2.8	1.1.1.1	0x2607	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:41.387171984 CET	192.168.2.8	1.1.1.1	0x7b3a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 28, 2024 13:59:46.976170063 CET	192.168.2.8	1.1.1.1	0x83df	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:46.976421118 CET	192.168.2.8	1.1.1.1	0x27c	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 28, 2024 13:59:39.958018064 CET	1.1.1.1	192.168.2.8	0x85b1	No error (0)	tinyurl.com		104.20.139.65	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:39.958018064 CET	1.1.1.1	192.168.2.8	0x85b1	No error (0)	tinyurl.com		172.67.1.225	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:39.958018064 CET	1.1.1.1	192.168.2.8	0x85b1	No error (0)	tinyurl.com		104.20.138.65	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:39.960316896 CET	1.1.1.1	192.168.2.8	0x5c2c	No error (0)	tinyurl.com			65	IN (0x0001)	false
Mar 28, 2024 13:59:39.970688105 CET	1.1.1.1	192.168.2.8	0x9a96	No error (0)	tinyurl.com		172.67.1.225	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:39.970688105 CET	1.1.1.1	192.168.2.8	0x9a96	No error (0)	tinyurl.com		104.20.138.65	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:39.970688105 CET	1.1.1.1	192.168.2.8	0x9a96	No error (0)	tinyurl.com		104.20.139.65	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:39.971103907 CET	1.1.1.1	192.168.2.8	0x442a	No error (0)	tinyurl.com			65	IN (0x0001)	false
Mar 28, 2024 13:59:40.703555107 CET	1.1.1.1	192.168.2.8	0xac8a	No error (0)	google.ae		172.253.115.94	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:41.482234001 CET	1.1.1.1	192.168.2.8	0x2607	No error (0)	www.google.com		142.251.16.106	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:41.482234001 CET	1.1.1.1	192.168.2.8	0x2607	No error (0)	www.google.com		142.251.16.104	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:41.482234001 CET	1.1.1.1	192.168.2.8	0x2607	No error (0)	www.google.com		142.251.16.105	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:41.482234001 CET	1.1.1.1	192.168.2.8	0x2607	No error (0)	www.google.com		142.251.16.99	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:41.482234001 CET	1.1.1.1	192.168.2.8	0x2607	No error (0)	www.google.com		142.251.16.103	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:41.482234001 CET	1.1.1.1	192.168.2.8	0x2607	No error (0)	www.google.com		142.251.16.147	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:41.482275963 CET	1.1.1.1	192.168.2.8	0x7b3a	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 28, 2024 13:59:47.070897102 CET	1.1.1.1	192.168.2.8	0x83df	No error (0)	www.google.com		142.251.16.103	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:47.070897102 CET	1.1.1.1	192.168.2.8	0x83df	No error (0)	www.google.com		142.251.16.99	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:47.070897102 CET	1.1.1.1	192.168.2.8	0x83df	No error (0)	www.google.com		142.251.16.147	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:47.070897102 CET	1.1.1.1	192.168.2.8	0x83df	No error (0)	www.google.com		142.251.16.106	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:47.070897102 CET	1.1.1.1	192.168.2.8	0x83df	No error (0)	www.google.com		142.251.16.104	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:47.070897102 CET	1.1.1.1	192.168.2.8	0x83df	No error (0)	www.google.com		142.251.16.105	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:47.071962118 CET	1.1.1.1	192.168.2.8	0x27c	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 28, 2024 13:59:55.461190939 CET	1.1.1.1	192.168.2.8	0x75f0	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:59:55.461190939 CET	1.1.1.1	192.168.2.8	0x75f0	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Mar 28, 2024 14:00:07.816787004 CET	1.1.1.1	192.168.2.8	0x23fe	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:00:07.816787004 CET	1.1.1.1	192.168.2.8	0x23fe	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Mar 28, 2024 14:00:30.085176945 CET	1.1.1.1	192.168.2.8	0x505d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:00:30.085176945 CET	1.1.1.1	192.168.2.8	0x505d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tinyurl.com

google.ae

www.google.com

https:

fs.microsoft.com

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Mar 28, 2024 13:59:55.042007923 CET	23.206.229.226	443	192.168.2.8	49703	CN=r.bing.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Oct 18 22:32:40 CEST 2023 Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
Mar 28, 2024 13:59:55.042007923 CET	23.206.229.226	443	192.168.2.8	49703	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		28a2c9bd18a11de089ef85a160da29e4

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	172.67.1.225	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:40 UTC	662	OUT	GET /4cbr8n8t HTTP/1.1 Host: tinyurl.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-28 12:59:40 UTC	1201	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 28 Mar 2024 12:59:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close location: https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx referrer-policy: unsafe-url x-robots-tag: noindex x-tinyurl-redirect-type: redirect Cache-Control: max-age=0, must-revalidate, no-cache, no-store, private x-tinyurl-redirect: eyJpdiI6IlBjUkJ4UEUzT2pYcnVrNWdrbTgycFE9PSIsInZhbHVlIjoiNEUrSnlVRG8vSjlrNElaZS9iT3NoNFZseU4xQzhpMUM5bnRsenNqUHVraUhyY2JiZ2ViL242cHgzam9QNHhCcUhTdElTZFJkRk1nRGJZcm5sYnRxeWc9PSIsIm1hYyI6IjFhZTI4Njk0OWFlNDY4ODIwNzM0MmUyYjdjMjU0MDY1NGNjZDVkYTVmMGY0NmQ1ZDczZWNlOGQwNzM3ODJkYTciLCJ0YWciOiIifQ== x-content-type-options: nosniff x-xss-protection: 1; mode=block CF-Cache-Status: MISS Set-Cookie: __cf_bm=c8_nv5tAm.02pKcmWsJzVXfOkI6GNQ0tvdmKGy_YE.Q-1711630780-1.0.1.1-vSwgedSV17AU1mk8k.V4n0oM2izRp7NaxgX.0f1u9HgWs3TcfvFnJkEu3ym3MG4fZNL6UdSJLWqdbOTX45eKwg; path=/; expires=Thu, 28-Mar-24 13:29:40 GMT; domain=.tinyurl.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 86b7cc7928c93919-IAD alt-svc: h3=":443"; ma=86400
2024-03-28 12:59:40 UTC	168	IN	Data Raw: 31 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 67 6f 6f 67 6c 65 2e 61 65 2f 61 6d 70 2f 70 30 54 59 6c 6c 4c 52 61 2e 74 67 65 73 74 62 74 77 2e 63 6f 6d 2f Data Ascii: 1be<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://google.ae/amp/p0TYllLRa.tgestbtw.com/
2024-03-28 12:59:40 UTC	285	IN	Data Raw: 52 78 53 7a 78 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 67 6f 6f 67 6c 65 2e 61 65 2f 61 6d 70 2f 70 30 54 59 6c 6c 4c 52 61 2e 74 67 65 73 74 62 74 77 2e 63 6f 6d 2f 52 78 53 7a 78 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6f 6f 67 6c 65 2e 61 65 2f 61 6d 70 2f 70 30 54 59 6c 6c 4c 52 61 2e 74 67 65 73 74 62 74 77 2e 63 6f 6d 2f 52 78 53 7a 78 22 3e 68 74 74 70 73 3a 2f 2f 67 6f 6f 67 6c 65 2e 61 65 2f 61 6d 70 2f 70 30 54 59 6c 6c 4c 52 61 2e 74 67 65 73 74 62 74 77 2e 63 6f 6d 2f 52 78 Data Ascii: RxSzx'" /> <title>Redirecting to https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx</title> </head> <body> Redirecting to <a href="https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx">https://google.ae/amp/p0TYllLRa.tgestbtw.com/Rx
2024-03-28 12:59:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49713	172.253.115.94	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:40 UTC	684	OUT	GET /amp/p0TYllLRa.tgestbtw.com/RxSzx HTTP/1.1 Host: google.ae Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-28 12:59:41 UTC	1996	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIvdOVsAYQpc_ulQESBGalMCs Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-SxUdLjummkTuznj2UjCBPw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Thu, 28 Mar 2024 12:59:41 GMT Server: gws Content-Length: 425 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-03-28-12; expires=Sat, 27-Apr-2024 12:59:41 GMT; path=/; domain=.google.ae; Secure; SameSite=none Set-Cookie: NID=512=cwvF0J_yK8tze7fWzF8_lU4Sv9e3_8yJJ57xOwX3uE-ykZKSqRy-EtjTUgY_hno6eAHA8sk4QM2qOdgVqPPBRxzatJ3TqH8zdUr-HUX1vsAP_ODFAuRf2Vp2V7ZR5kLucTpqpy2ZhibnAbtfdwcmHMR_QsYHzBWS-5iE5ThLfw4; expires=Fri, 27-Sep-2024 12:59:41 GMT; path=/; domain=.google.ae; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-28 12:59:41 UTC	425	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 67 6f 6f 67 6c 65 2e 61 65 2f 61 6d 70 2f 70 30 54 59 6c 6c 4c 52 61 2e 74 67 65 73 74 62 74 77 2e 63 6f Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49714	142.251.16.106	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:41 UTC	1047	OUT	GET /sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 12:59:41 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 28 Mar 2024 12:59:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3136 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-28 12:59:41 UTC	896	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 67 6f 6f 67 6c 65 2e 61 65 2f 61 6d 70 2f 70 30 54 59 6c 6c 4c 52 61 2e 74 67 65 73 74 62 74 77 2e 63 6f 6d 2f 52 78 53 7a 78 3c 2f 74 69 74 6c Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx</titl
2024-03-28 12:59:41 UTC	1252	IN	Data Raw: 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 4c 4c 5a 2d 70 69 73 72 62 37 74 6f 30 36 5f 69 6d 54 37 2d 2d 44 Data Ascii: submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="LLZ-pisrb7to06_imT7--D
2024-03-28 12:59:41 UTC	988	IN	Data Raw: 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 Data Ascii: s page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49715	142.251.16.106	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:42 UTC	1052	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 12:59:42 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Thu, 28 Mar 2024 12:59:42 GMT Date: Thu, 28 Mar 2024 12:59:42 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 12:59:42 UTC	724	IN	Data Raw: 34 63 36 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 4c6/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-03-28 12:59:42 UTC	505	IN	Data Raw: 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 6d 6f 56 31 6d 54 67 51 36 53 39 31 6e 75 54 6e 6d 6c 6c 34 59 39 79 66 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 3b 70 6f 2e 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 77 45 56 53 64 71 4b 63 35 68 66 39 76 6b Data Ascii: mV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-wEVSdqKc5hf9vk
2024-03-28 12:59:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49716	23.209.62.90	443

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:43 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-28 12:59:43 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=237787 Date: Thu, 28 Mar 2024 12:59:43 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49718	23.209.62.90	443

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:44 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-28 12:59:44 UTC	774	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 8BFC17DD061B46CAAD2B2AEB7B19C3D8 Ref B: CH1AA2040901011 Ref C: 2023-07-21T06:04:00Z X-MSEdge-Ref: Ref A: 1421F39FA7224BE199CC2F2C3DD24574 Ref B: CHI30EDGE0415 Ref C: 2023-07-21T06:04:00Z Content-Type: application/octet-stream X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=237836 Date: Thu, 28 Mar 2024 12:59:44 GMT Content-Length: 55 Connection: close X-CID: 2
2024-03-28 12:59:44 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49719	142.251.16.106	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:44 UTC	1659	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LLZ-pisrb7to06_imT7--DF4ap-Hd_n4FFKTechSqum6iLMyrMcHFrwH3DSLAc7qiFpFtO9UKr3g2FdJQbWRtBiFUmt8HGy9UyufWQIEResIkIno3WMrE8Txst1DU_dP6PHlA3i3C0j5dhDDjSEnktx8jj4f2EVqxMATN8-E4RYPzikevDR1NQFQLxIT0NGY1jZ7BzYCl42gGQJVDPUgLIb-0HlFz-_Vufbi4zCK8zgOngWm1yWtGlctuttE50U0rxJPb1inBJrcHKX28yA-EUkPXyRGZ4c&cb=5qjiu8db9vd2 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 12:59:44 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 28 Mar 2024 12:59:44 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-pi-hrF5JBzCxKUU8JKggJA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 12:59:44 UTC	361	IN	Data Raw: 32 61 64 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2ada<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-03-28 12:59:44 UTC	1252	IN	Data Raw: 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 Data Ascii: o/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//f
2024-03-28 12:59:44 UTC	1252	IN	Data Raw: 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 Data Ascii: 9, U+20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329,
2024-03-28 12:59:44 UTC	1252	IN	Data Raw: 30 2d 30 34 39 31 2c 20 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a Data Ascii: 0-0491, U+04B0-04B1, U+2116;}/* greek-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}
2024-03-28 12:59:44 UTC	1252	IN	Data Raw: 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c Data Ascii: */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA,
2024-03-28 12:59:44 UTC	1252	IN	Data Raw: 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b Data Ascii: l(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal;
2024-03-28 12:59:44 UTC	1252	IN	Data Raw: 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 6d 6f 56 31 6d 54 67 51 36 53 39 31 6e 75 54 6e 6d 6c 6c 34 59 39 79 66 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 70 69 2d 68 72 46 35 4a 42 7a 43 78 4b 55 55 38 4a 4b 67 67 4a 41 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 Data Ascii: U+FEFF, U+FFFD;}</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/styles__ltr.css"><script nonce="pi-hrF5JBzCxKUU8JKggJA" type="text/javascript">window['__recaptcha_api'] = 'http
2024-03-28 12:59:44 UTC	1252	IN	Data Raw: 6b 71 41 6d 79 41 64 4c 57 59 52 33 4e 33 73 6d 4a 57 63 4e 46 47 33 4d 35 79 72 62 76 31 63 59 5a 70 4f 55 64 42 6b 63 44 77 32 6b 45 2d 4e 49 35 59 74 50 4f 34 35 6f 79 6e 49 2d 38 78 79 44 38 74 57 49 73 43 64 4d 41 54 71 51 46 5f 5f 52 42 53 72 46 4d 41 71 6a 5a 63 77 4c 73 65 71 39 38 74 57 62 47 48 37 74 6c 2d 34 61 4b 71 4b 4b 6c 6f 48 79 73 63 66 5a 68 37 6c 33 49 54 36 6c 75 51 7a 70 44 54 69 45 77 6a 41 48 50 46 45 48 30 4e 76 35 5a 4d 7a 38 48 32 2d 41 5f 44 63 62 5f 4b 78 35 48 68 77 73 36 56 41 51 4d 79 63 6c 75 6c 56 39 6a 30 66 31 6f 52 62 57 6a 4b 51 30 33 48 71 76 42 32 49 68 6b 34 49 45 55 4c 72 35 34 37 71 4a 72 66 55 70 50 55 49 36 61 4b 56 38 4a 31 32 4e 64 77 67 6a 73 37 56 73 53 37 37 37 75 7a 56 44 6e 52 32 4d 66 73 71 46 78 70 6a Data Ascii: kqAmyAdLWYR3N3smJWcNFG3M5yrbv1cYZpOUdBkcDw2kE-NI5YtPO45oynI-8xyD8tWIsCdMATqQF__RBSrFMAqjZcwLseq98tWbGH7tl-4aKqKKloHyscfZh7l3IT6luQzpDTiEwjAHPFEH0Nv5ZMz8H2-A_Dcb_Kx5Hhws6VAQMyclulV9j0f1oRbWjKQ03HqvB2Ihk4IEULr547qJrfUpPUI6aKV8J12Ndwgjs7VsS777uzVDnR2MfsqFxpj
2024-03-28 12:59:44 UTC	1252	IN	Data Raw: 46 36 36 31 56 73 39 53 30 56 63 6b 2d 44 72 58 68 41 49 43 5f 42 45 55 6f 48 37 4d 75 36 52 6e 6a 56 5a 6f 43 39 6f 52 35 36 79 47 50 79 34 51 67 73 48 55 35 53 4b 43 53 56 37 6d 50 37 77 48 5f 62 76 44 39 7a 56 36 4f 41 46 2d 51 79 62 61 34 73 39 2d 59 30 31 2d 41 48 7a 56 4f 6f 49 63 4f 72 6f 49 41 61 45 38 65 34 42 66 6e 67 4d 49 32 42 55 67 5a 4a 67 44 57 34 51 30 74 54 63 42 36 5f 32 4b 51 61 77 5f 71 6a 76 42 65 33 71 36 51 61 67 72 38 4b 59 2d 42 77 35 33 74 6b 59 35 35 70 64 55 2d 45 41 57 64 66 53 79 6e 33 4b 58 4a 38 7a 69 55 52 65 78 6b 50 43 6e 52 56 4d 55 41 54 66 44 69 45 7a 55 53 71 78 69 36 77 65 7a 39 66 54 62 2d 4c 52 52 6f 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 Data Ascii: F661Vs9S0Vck-DrXhAIC_BEUoH7Mu6RnjVZoC9oR56yGPy4QgsHU5SKCSV7mP7wH_bvD9zV6OAF-Qyba4s9-Y01-AHzVOoIcOroIAaE8e4BfngMI2BUgZJgDW4Q0tTcB6_2KQaw_qjvBe3q6Qagr8KY-Bw53tkY55pdU-EAWdfSyn3KXJ8ziURexkPCnRVMUATfDiEzUSqxi6wez9fTb-LRRo"><script type="text/javascript" nonc
2024-03-28 12:59:44 UTC	601	IN	Data Raw: 30 39 50 65 45 52 6c 63 54 56 69 59 6e 70 51 52 47 4a 58 57 55 64 47 4e 79 74 61 61 48 68 55 63 46 42 6d 62 32 39 49 4d 58 46 6a 52 6c 4e 47 52 6a 55 30 56 6d 78 32 52 33 42 51 4d 6b 45 77 52 47 67 72 4e 56 6c 47 64 6b 6c 6b 5a 47 6c 74 63 7a 4e 71 61 48 42 71 64 6e 42 5a 51 58 56 61 63 45 64 35 51 56 68 76 63 55 5a 5a 63 30 67 76 4d 6b 5a 51 55 45 74 76 59 6b 64 53 55 55 38 79 63 47 6f 32 65 48 64 5a 4d 48 4e 50 54 48 46 35 65 55 56 49 51 32 77 30 52 58 52 58 5a 7a 5a 54 5a 45 6b 33 54 46 68 4c 63 43 38 77 53 45 74 42 52 55 55 35 62 31 4d 78 55 33 52 73 4f 47 68 7a 65 56 52 50 52 30 70 6f 4e 57 59 7a 52 55 70 4c 65 57 49 76 56 57 78 68 65 6e 68 49 51 6e 68 47 4f 46 46 6b 4d 55 77 33 53 33 52 69 52 6a 52 4a 4e 55 30 31 62 32 39 78 62 46 4a 55 63 30 68 77 Data Ascii: 09PeERlcTViYnpQRGJXWUdGNytaaHhUcFBmb29IMXFjRlNGRjU0Vmx2R3BQMkEwRGgrNVlGdklkZGltczNqaHBqdnBZQXVacEd5QVhvcUZZc0gvMkZQUEtvYkdSUU8ycGo2eHdZMHNPTHF5eUVIQ2w0RXRXZzZTZEk3TFhLcC8wSEtBRUU5b1MxU3RsOGhzeVRPR0poNWYzRUpLeWIvVWxhenhIQnhGOFFkMUw3S3RiRjRJNU01b29xbFJUc0hw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49723	142.251.16.106	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:46 UTC	1347	OUT	GET /js/bg/OMzbJ87gkB5MAUky6mmDB4mflkEza4rQHUJNCD4hS_4.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LLZ-pisrb7to06_imT7--DF4ap-Hd_n4FFKTechSqum6iLMyrMcHFrwH3DSLAc7qiFpFtO9UKr3g2FdJQbWRtBiFUmt8HGy9UyufWQIEResIkIno3WMrE8Txst1DU_dP6PHlA3i3C0j5dhDDjSEnktx8jj4f2EVqxMATN8-E4RYPzikevDR1NQFQLxIT0NGY1jZ7BzYCl42gGQJVDPUgLIb-0HlFz-_Vufbi4zCK8zgOngWm1yWtGlctuttE50U0rxJPb1inBJrcHKX28yA-EUkPXyRGZ4c&cb=5qjiu8db9vd2 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 12:59:46 UTC	799	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18165 Date: Thu, 28 Mar 2024 12:59:46 GMT Expires: Fri, 28 Mar 2025 12:59:46 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 19 Mar 2024 16:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-28 12:59:46 UTC	453	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6d 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 71 3d 66 75 6e 63 74 69 6f 6e 28 42 29 7b 72 65 74 75 72 6e 20 42 7d 2c 4e 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 75 29 7b 69 66 28 42 3d 28 75 3d 6d 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 6e 75 6c 6c 29 2c 21 75 7c 7c 21 75 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 42 3b 74 72 79 7b 42 3d 75 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var m=this\|\|self,q=function(B){return B},N=function(B,u){if(B=(u=m.trustedTypes,null),!u\|\|!u.createPolicy)return B;try{B=u.createPolicy("bg",{createHTML:
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: 44 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 44 29 7b 72 65 74 75 72 6e 22 22 2b 44 7d 7d 28 6d 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 5b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 27 2c 0a 27 27 2c 0a 27 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 75 29 7b 66 6f 72 28 75 3d 5b 5d 3b 42 2d 2d 3b 29 75 2e 70 75 73 68 28 32 35 35 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 3b 72 65 74 75 72 6e 20 75 7d 2c 42 75 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 75 2c 71 2c 44 29 7b 66 6f 72 28 71 3d 28 44 3d 4f 28 75 29 2c 30 29 3b 30 3c 42 3b Data Ascii: D)}:function(D){return""+D}}(m)(Array(7824Math.random()\|0).join("\n")+['(function(){/','',' SPDX-License-Identifier: Apache-2.0','/','var e=function(B,u){for(u=[];B--;)u.push(255Math.random()\|0);return u},Bu=function(B,u,q,D){for(q=(D=O(u),0);0<B;
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: 72 6e 20 75 7d 2c 74 52 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 75 2c 71 2c 44 2c 54 2c 45 29 7b 69 66 28 21 75 2e 48 29 7b 75 2e 43 2b 2b 3b 74 72 79 7b 66 6f 72 28 71 3d 28 54 3d 28 45 3d 76 6f 69 64 20 30 2c 30 29 2c 75 2e 4e 29 3b 2d 2d 42 3b 29 74 72 79 7b 69 66 28 44 3d 76 6f 69 64 20 30 2c 75 2e 4a 29 45 3d 54 38 28 75 2c 75 2e 4a 29 3b 65 6c 73 65 7b 69 66 28 28 54 3d 48 28 32 32 37 2c 75 29 2c 54 29 3e 3d 71 29 62 72 65 61 6b 3b 45 3d 28 44 3d 4f 28 28 4c 28 34 31 31 2c 75 2c 54 29 2c 75 29 29 2c 48 28 44 2c 75 29 29 7d 6b 28 21 28 45 26 26 45 5b 46 5d 26 32 30 34 38 3f 45 28 75 2c 42 29 3a 55 28 5b 79 2c 32 31 2c 44 5d 2c 75 2c 30 29 2c 31 29 2c 42 2c 75 2c 66 61 6c 73 65 29 7d 63 61 74 63 68 28 4b 29 7b 48 28 34 32 2c 75 29 3f 55 28 4b 2c 75 2c 32 Data Ascii: rn u},tR=function(B,u,q,D,T,E){if(!u.H){u.C++;try{for(q=(T=(E=void 0,0),u.N);--B;)try{if(D=void 0,u.J)E=T8(u,u.J);else{if((T=H(227,u),T)>=q)break;E=(D=O((L(411,u,T),u)),H(D,u))}k(!(E&&E[F]&2048?E(u,B):U([y,21,D],u,0),1),B,u,false)}catch(K){H(42,u)?U(K,u,2
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: 6e 20 75 2e 63 72 65 61 74 65 28 29 3b 72 65 74 75 72 6e 28 75 2e 63 72 65 61 74 65 28 35 2a 42 2a 42 2b 37 35 2a 42 2b 38 39 29 2c 75 29 2e 70 72 6f 74 6f 74 79 70 65 7d 2c 51 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 75 29 7b 42 2e 48 3d 28 28 42 2e 48 3f 42 2e 48 2b 22 7e 22 3a 22 45 3a 22 29 2b 75 2e 6d 65 73 73 61 67 65 2b 22 3a 22 2b 75 2e 73 74 61 63 6b 29 2e 73 6c 69 63 65 28 30 2c 32 30 34 38 29 7d 2c 43 6c 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 75 2c 71 2c 44 2c 54 29 7b 69 66 28 28 44 3d 75 5b 30 5d 2c 44 29 3d 3d 56 54 29 42 2e 76 3d 74 72 75 65 2c 42 2e 62 4b 3d 32 35 2c 42 2e 53 28 75 29 3b 65 6c 73 65 20 69 66 28 44 3d 3d 4a 29 7b 54 3d 28 42 2e 76 3d 74 72 75 65 2c 75 29 5b 31 5d 3b 74 72 79 7b 71 3d 42 2e 48 7c 7c 42 2e 53 28 75 29 7d 63 61 74 63 Data Ascii: n u.create();return(u.create(5BB+75*B+89),u).prototype},Q=function(B,u){B.H=((B.H?B.H+"~":"E:")+u.message+":"+u.stack).slice(0,2048)},Cl=function(B,u,q,D,T){if((D=u[0],D)==VT)B.v=true,B.bK=25,B.S(u);else if(D==J){T=(B.v=true,u)[1];try{q=B.H\|\|B.S(u)}catc
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: 41 5b 42 5d 3d 6e 6c 28 71 2c 75 29 3b 65 6c 73 65 7b 69 66 28 75 2e 4e 6a 26 26 31 30 32 21 3d 42 29 72 65 74 75 72 6e 3b 33 35 37 3d 3d 42 7c 7c 36 37 3d 3d 42 7c 7c 33 37 33 3d 3d 42 7c 7c 34 30 33 3d 3d 42 7c 7c 39 3d 3d 42 7c 7c 32 33 31 3d 3d 42 7c 7c 31 37 37 3d 3d 42 7c 7c 31 34 37 3d 3d 42 7c 7c 31 38 31 3d 3d 42 3f 75 2e 41 5b 42 5d 7c 7c 28 75 2e 41 5b 42 5d 3d 55 49 28 71 2c 75 2c 42 2c 33 30 29 29 3a 75 2e 41 5b 42 5d 3d 55 49 28 71 2c 75 2c 42 2c 35 37 29 7d 31 30 32 3d 3d 42 26 26 28 75 2e 55 3d 58 28 33 32 2c 75 2c 66 61 6c 73 65 29 2c 75 2e 4c 3d 76 6f 69 64 20 30 29 7d 2c 53 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 75 2c 71 2c 44 2c 54 2c 45 29 7b 69 66 28 75 2e 57 3d 3d 75 29 66 6f 72 28 45 3d 48 28 42 2c 75 29 2c 36 37 3d 3d 42 7c 7c 31 34 Data Ascii: A[B]=nl(q,u);else{if(u.Nj&&102!=B)return;357==B\|\|67==B\|\|373==B\|\|403==B\|\|9==B\|\|231==B\|\|177==B\|\|147==B\|\|181==B?u.A[B]\|\|(u.A[B]=UI(q,u,B,30)):u.A[B]=UI(q,u,B,57)}102==B&&(u.U=X(32,u,false),u.L=void 0)},S=function(B,u,q,D,T,E){if(u.W==u)for(E=H(B,u),67==B\|\|14
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: 7b 51 28 75 2c 54 29 7d 69 66 28 42 26 26 75 2e 4f 29 7b 28 42 3d 75 2e 4f 2c 42 29 28 66 75 6e 63 74 69 6f 6e 28 29 7b 67 28 74 72 75 65 2c 75 2c 74 72 75 65 29 7d 29 3b 62 72 65 61 6b 7d 7d 72 65 74 75 72 6e 20 44 7d 2c 61 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 75 2c 71 2c 44 2c 54 2c 45 29 7b 69 66 28 75 2e 5a 2e 6c 65 6e 67 74 68 29 7b 75 2e 70 53 3d 28 28 75 2e 75 26 26 30 28 29 2c 75 29 2e 75 3d 74 72 75 65 2c 42 29 3b 74 72 79 7b 54 3d 75 2e 56 28 29 2c 75 2e 54 3d 54 2c 75 2e 67 3d 30 2c 75 2e 50 3d 54 2c 45 3d 61 5a 28 42 2c 75 29 2c 42 3d 71 3f 30 3a 31 30 2c 44 3d 75 2e 56 28 29 2d 75 2e 50 2c 75 2e 44 2b 3d 44 2c 75 2e 6e 53 26 26 75 2e 6e 53 28 44 2c 75 2e 6c 2c 75 2e 76 29 2c 75 2e 76 3d 66 61 6c 73 65 2c Data Ascii: {Q(u,T)}if(B&&u.O){(B=u.O,B)(function(){g(true,u,true)});break}}return D},a=this\|\|self,g=function(B,u,q,D,T,E){if(u.Z.length){u.pS=((u.u&&0(),u).u=true,B);try{T=u.V(),u.T=T,u.g=0,u.P=T,E=aZ(B,u),B=q?0:10,D=u.V()-u.P,u.D+=D,u.nS&&u.nS(D,u.l,u.v),u.v=false,
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: 73 6f 6c 65 3a 75 2c 73 74 61 63 6b 3a 75 2c 6c 65 6e 67 74 68 3a 75 2c 70 61 72 65 6e 74 3a 75 2c 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 3a 75 2c 73 70 6c 69 63 65 3a 75 2c 72 65 70 6c 61 63 65 3a 75 2c 70 6f 70 3a 75 2c 66 6c 6f 6f 72 3a 75 2c 70 72 6f 74 6f 74 79 70 65 3a 75 2c 64 6f 63 75 6d 65 6e 74 3a 75 2c 63 61 6c 6c 3a 75 7d 29 7d 2c 4d 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 75 29 7b 75 2e 5a 2e 73 70 6c 69 63 65 28 30 2c 30 2c 42 29 7d 2c 59 5f 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 75 2c 71 29 7b 69 66 28 71 3d 74 79 70 65 6f 66 20 42 2c 22 6f 62 6a 65 63 74 22 3d 3d 71 29 69 66 28 42 29 7b 69 66 28 42 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 72 65 74 75 72 6e 22 61 72 72 61 79 22 3b 69 66 28 42 20 69 6e 73 74 61 6e Data Ascii: sole:u,stack:u,length:u,parent:u,propertyIsEnumerable:u,splice:u,replace:u,pop:u,floor:u,prototype:u,document:u,call:u})},M=function(B,u){u.Z.splice(0,0,B)},Y_=function(B,u,q){if(q=typeof B,"object"==q)if(B){if(B instanceof Array)return"array";if(B instan
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: 2c 75 5b 71 2b 2b 5d 3d 44 3e 3e 31 38 7c 32 34 30 2c 75 5b 71 2b 2b 5d 3d 44 3e 3e 31 32 26 36 33 7c 31 32 38 29 3a 75 5b 71 2b 2b 5d 3d 44 3e 3e 31 32 7c 32 32 34 2c 75 5b 71 2b 2b 5d 3d 44 3e 3e 36 26 36 33 7c 31 32 38 29 2c 75 5b 71 2b 2b 5d 3d 44 26 36 33 7c 31 32 38 29 3b 72 65 74 75 72 6e 20 75 7d 2c 57 3d 7b 70 61 73 73 69 76 65 3a 74 72 75 65 2c 63 61 70 74 75 72 65 3a 74 72 75 65 7d 2c 63 2c 46 24 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 75 2c 71 2c 44 2c 54 29 7b 66 75 6e 63 74 69 6f 6e 20 45 28 29 7b 7d 72 65 74 75 72 6e 7b 69 6e 76 6f 6b 65 3a 66 75 6e 63 74 69 6f 6e 28 4b 2c 6d 2c 4e 2c 50 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 54 28 66 75 6e 63 74 69 6f 6e 28 56 29 7b 65 6c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4b 28 56 29 7d 29 7d 2c 4e 29 Data Ascii: ,u[q++]=D>>18\|240,u[q++]=D>>12&63\|128):u[q++]=D>>12\|224,u[q++]=D>>6&63\|128),u[q++]=D&63\|128);return u},W={passive:true,capture:true},c,F$=function(B,u,q,D,T){function E(){}return{invoke:function(K,m,N,P){function t(){T(function(V){el(function(){K(V)})},N)
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: 3d 28 56 3d 4f 28 28 50 3d 4f 28 6d 29 2c 6d 29 29 2c 72 3d 4f 28 6d 29 2c 4f 28 6d 29 29 2c 48 28 4e 2c 6d 29 29 2c 48 28 56 2c 6d 29 29 2c 48 28 72 2c 6d 29 29 2c 50 3d 48 28 50 2c 6d 29 2c 59 5f 28 50 29 29 29 7b 66 6f 72 28 43 20 69 6e 20 74 3d 5b 5d 2c 50 29 74 2e 70 75 73 68 28 43 29 3b 50 3d 74 7d 69 66 28 6d 2e 57 3d 3d 6d 29 66 6f 72 28 72 3d 30 3c 72 3f 72 3a 31 2c 6d 3d 30 2c 43 3d 50 2e 6c 65 6e 67 74 68 3b 6d 3c 43 3b 6d 2b 3d 72 29 56 28 50 2e 73 6c 69 63 65 28 6d 2c 28 6d 7c 30 29 2b 28 72 7c 30 29 29 2c 4e 29 7d 7d 2c 34 36 35 2c 28 4c 28 31 34 37 2c 44 2c 28 4c 28 34 30 33 2c 44 2c 28 4c 28 34 37 39 2c 44 2c 28 28 6c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 32 32 30 2c 28 4c 28 36 37 2c 44 2c 28 4c 28 31 37 37 2c 28 6c 28 66 75 6e 63 74 Data Ascii: =(V=O((P=O(m),m)),r=O(m),O(m)),H(N,m)),H(V,m)),H(r,m)),P=H(P,m),Y_(P))){for(C in t=[],P)t.push(C);P=t}if(m.W==m)for(r=0<r?r:1,m=0,C=P.length;m<C;m+=r)V(P.slice(m,(m\|0)+(r\|0)),N)}},465,(L(147,D,(L(403,D,(L(479,D,((l(function(){},220,(L(67,D,(L(177,(l(funct
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: 2c 6d 29 2c 48 29 28 4e 2c 6d 29 2c 74 29 2c 6d 29 2c 50 29 2c 6d 2c 4d 56 28 56 2c 74 2c 4e 2c 6d 29 29 7d 2c 28 6c 28 66 75 6e 63 74 69 6f 6e 28 6d 2c 4e 29 7b 75 73 28 28 4e 3d 48 28 4f 28 6d 29 2c 6d 29 2c 6d 29 2e 57 2c 4e 29 7d 2c 28 4c 28 34 39 33 2c 44 2c 28 4c 28 28 4c 28 33 35 37 2c 44 2c 28 6c 28 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 42 75 28 34 2c 6d 29 7d 2c 28 6c 28 28 4c 28 38 38 2c 44 2c 28 4c 28 34 32 2c 44 2c 28 6c 28 66 75 6e 63 74 69 6f 6e 28 6d 2c 4e 2c 50 29 7b 4c 28 28 4e 3d 48 28 28 50 3d 28 4e 3d 4f 28 6d 29 2c 4f 29 28 6d 29 2c 4e 29 2c 6d 29 2c 4e 3d 59 5f 28 4e 29 2c 50 29 2c 6d 2c 4e 29 7d 2c 31 32 37 2c 28 6c 28 28 6c 28 66 75 6e 63 74 69 6f 6e 28 6d 2c 4e 2c 50 2c 74 2c 56 2c 72 29 7b 6b 28 66 61 6c 73 65 2c 4e 2c 6d 2c 74 72 Data Ascii: ,m),H)(N,m),t),m),P),m,MV(V,t,N,m))},(l(function(m,N){us((N=H(O(m),m),m).W,N)},(L(493,D,(L((L(357,D,(l(function(m){Bu(4,m)},(l((L(88,D,(L(42,D,(l(function(m,N,P){L((N=H((P=(N=O(m),O)(m),N),m),N=Y_(N),P),m,N)},127,(l((l(function(m,N,P,t,V,r){k(false,N,m,tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49725	142.251.16.106	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:46 UTC	1359	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LLZ-pisrb7to06_imT7--DF4ap-Hd_n4FFKTechSqum6iLMyrMcHFrwH3DSLAc7qiFpFtO9UKr3g2FdJQbWRtBiFUmt8HGy9UyufWQIEResIkIno3WMrE8Txst1DU_dP6PHlA3i3C0j5dhDDjSEnktx8jj4f2EVqxMATN8-E4RYPzikevDR1NQFQLxIT0NGY1jZ7BzYCl42gGQJVDPUgLIb-0HlFz-_Vufbi4zCK8zgOngWm1yWtGlctuttE50U0rxJPb1inBJrcHKX28yA-EUkPXyRGZ4c&cb=5qjiu8db9vd2 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 12:59:46 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Thu, 28 Mar 2024 12:59:46 GMT Date: Thu, 28 Mar 2024 12:59:46 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 12:59:46 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 6d 6f 56 31 6d 54 67 51 36 53 39 31 6e 75 54 6e 6d 6c 6c 34 59 39 79 66 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js');
2024-03-28 12:59:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49727	142.251.16.106	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:46 UTC	1107	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 12:59:46 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 28 Mar 2024 11:17:24 GMT Expires: Fri, 05 Apr 2024 11:17:24 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 6142 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-28 12:59:46 UTC	547	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: ee d8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4
2024-03-28 12:59:46 UTC	1252	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-03-28 12:59:46 UTC	1127	IN	Data Raw: ff ff ff a0 a7 f5 ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49728	142.251.16.106	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:47 UTC	1296	OUT	GET /recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://google.ae/amp/p0TYllLRa.tgestbtw.com/RxSzx&q=EgRmpTArGL3TlbAGIjDStzpjIOlB0qXyATLiNxIIdjOYkIXrXIBNUthtrEDpNkc0ApP2YJSiylgnTibjnkMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 12:59:47 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 28 Mar 2024 12:59:47 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-yYEeE5tF_SFmxRdqm13laA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 12:59:47 UTC	361	IN	Data Raw: 31 64 31 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 Data Ascii: 1d11<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face
2024-03-28 12:59:47 UTC	1252	IN	Data Raw: 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f Data Ascii: to/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//
2024-03-28 12:59:47 UTC	1252	IN	Data Raw: 46 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c Data Ascii: F9, U+20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329,
2024-03-28 12:59:47 UTC	1252	IN	Data Raw: 39 30 2d 30 34 39 31 2c 20 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d Data Ascii: 90-0491, U+04B0-04B1, U+2116;}/* greek-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}
2024-03-28 12:59:47 UTC	1252	IN	Data Raw: 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 Data Ascii: */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA
2024-03-28 12:59:47 UTC	1252	IN	Data Raw: 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c Data Ascii: rl(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal
2024-03-28 12:59:47 UTC	828	IN	Data Raw: 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 6d 6f 56 31 6d 54 67 51 36 53 39 31 6e 75 54 6e 6d 6c 6c 34 59 39 79 66 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 79 59 45 65 45 35 74 46 5f 53 46 6d 78 52 64 71 6d 31 33 6c 61 41 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 Data Ascii: , U+FEFF, U+FFFD;}</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/styles__ltr.css"><script nonce="yYEeE5tF_SFmxRdqm13laA" type="text/javascript">window['__recaptcha_api'] = 'htt
2024-03-28 12:59:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49729	142.251.16.103	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:47 UTC	631	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 12:59:47 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 28 Mar 2024 11:17:24 GMT Expires: Fri, 05 Apr 2024 11:17:24 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 6143 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-28 12:59:47 UTC	547	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-03-28 12:59:47 UTC	1252	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C
2024-03-28 12:59:47 UTC	1252	IN	Data Raw: ee d8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4
2024-03-28 12:59:47 UTC	1252	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-03-28 12:59:47 UTC	1127	IN	Data Raw: ff ff ff a0 a7 f5 ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49732	142.251.16.106	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:59 UTC	1088	OUT	POST /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 7425 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 12:59:59 UTC	7425	OUT	Data Raw: 0a 18 6d 6f 56 31 6d 54 67 51 36 53 39 31 6e 75 54 6e 6d 6c 6c 34 59 39 79 66 12 ce 10 30 33 41 46 63 57 65 41 37 45 53 31 50 4e 65 4c 49 6f 42 57 50 38 71 41 4d 33 37 7a 35 5a 4b 78 62 39 43 79 4b 54 6b 6f 32 62 47 62 36 4d 4a 31 2d 39 4d 32 47 63 4b 37 49 4c 48 66 6c 65 51 43 48 44 43 47 79 79 38 67 52 71 7a 75 53 57 4a 70 79 6f 4f 4b 69 34 41 54 6c 6c 41 6d 5a 6a 49 77 32 70 30 6b 53 4b 5a 4a 6e 78 58 37 4a 61 39 33 58 64 46 39 30 2d 34 49 45 50 61 65 57 52 6a 31 38 55 66 4b 5f 4c 71 6a 43 62 5f 54 44 4b 52 57 59 32 64 70 54 58 57 47 59 34 68 53 48 44 5a 71 38 43 2d 6b 59 46 47 62 4f 47 68 4c 72 54 61 4f 45 67 4e 65 71 6c 6f 6a 4f 4d 47 34 64 62 63 75 35 69 2d 36 35 58 65 62 62 76 6e 47 57 75 5f 44 6f 64 49 79 32 6a 36 75 70 78 43 65 50 65 43 57 50 72 Data Ascii: moV1mTgQ6S91nuTnmll4Y9yf03AFcWeA7ES1PNeLIoBWP8qAM37z5ZKxb9CyKTko2bGb6MJ1-9M2GcK7ILHfleQCHDCGyy8gRqzuSWJpyoOKi4ATllAmZjIw2p0kSKZJnxX7Ja93XdF90-4IEPaeWRj18UfK_LqjCb_TDKRWY2dpTXWGY4hSHDZq8C-kYFGbOGhLrTaOEgNeqlojOMG4dbcu5i-65XebbvnGWu_DodIy2j6upxCePeCWPr
2024-03-28 12:59:59 UTC	696	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Thu, 28 Mar 2024 12:59:59 GMT Expires: Thu, 28 Mar 2024 12:59:59 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: _GRECAPTCHA=09AM9qaELoax5VcKbFgGD2zLgg5666GoIPt1ziu1v46bVW_aERBX1MZoMkOvxTn9r2yJF_V2QAmP_emVD59HPG0QQ;Path=/recaptcha;Expires=Tue, 24-Sep-2024 12:59:59 GMT;Secure;HttpOnly;Priority=HIGH;SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 12:59:59 UTC	556	IN	Data Raw: 32 33 38 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 35 6f 73 48 79 6b 70 58 4f 70 64 5a 6a 6b 6b 54 2d 6e 78 71 4e 34 6f 74 4b 30 36 75 38 68 36 66 65 6d 35 55 70 70 34 68 78 30 6c 69 4e 62 56 38 72 34 36 30 6d 54 37 79 32 37 75 41 5a 34 55 53 79 6c 43 39 69 69 79 34 72 4c 49 53 62 6a 39 56 34 63 78 6e 56 31 5f 36 48 30 31 76 51 70 43 56 78 5f 53 70 69 62 73 42 39 36 37 41 43 6e 6d 78 79 61 6d 43 69 43 55 51 39 75 42 7a 7a 55 54 56 55 63 59 32 69 65 65 4f 6f 42 36 6c 65 4e 4a 2d 77 57 61 50 56 51 78 37 43 5f 47 4f 79 6d 76 72 46 69 61 75 6e 39 6b 7a 49 70 33 4e 6e 6a 39 2d 72 61 32 37 72 53 56 74 47 64 6d 6e 47 38 6a 67 65 70 6d 32 77 6b 38 4d 63 4e 66 66 54 41 50 34 51 2d 77 69 4b 51 71 49 58 45 7a 73 6d 4c 41 33 53 75 53 Data Ascii: 238)]}'["rresp","03AFcWeA5osHykpXOpdZjkkT-nxqN4otK06u8h6fem5Upp4hx0liNbV8r460mT7y27uAZ4USylC9iiy4rLISbj9V4cxnV1_6H01vQpCVx_SpibsB967ACnmxyamCiCUQ9uBzzUTVUcY2ieeOoB6leNJ-wWaPVQx7C_GOymvrFiaun9kzIp3Nnj9-ra27rSVtGdmnG8jgepm2wk8McNffTAP4Q-wiKQqIXEzsmLA3SuS
2024-03-28 12:59:59 UTC	19	IN	Data Raw: 76 5f 6e 37 4a 37 51 63 62 49 74 65 4d 65 33 4a 6e 0d 0a Data Ascii: v_n7J7QcbIteMe3Jn
2024-03-28 12:59:59 UTC	1252	IN	Data Raw: 61 33 39 0d 0a 5a 58 41 72 6f 72 56 36 55 36 46 6e 57 4f 6a 74 48 63 37 51 4f 48 70 65 6d 39 62 66 49 42 43 4d 6b 4f 56 65 36 52 42 32 67 70 6a 70 6a 6d 48 41 79 6f 37 64 73 63 44 74 64 72 74 7a 5f 4e 73 35 67 63 44 59 74 4a 41 48 65 61 77 4a 38 4a 51 53 42 69 65 4d 4b 6e 6a 30 4d 49 69 72 52 77 6a 4a 6d 79 4a 79 6c 73 6d 31 41 52 5f 5f 57 71 4c 6e 4d 5f 51 7a 77 63 48 57 76 63 52 37 52 42 6d 39 5a 38 39 4b 51 72 46 47 30 78 79 54 2d 45 37 4a 35 54 79 79 77 35 38 31 30 63 5f 6a 78 76 4b 52 4c 56 70 59 31 57 67 57 47 4f 71 45 53 34 36 4a 44 70 6c 72 72 70 5f 2d 33 78 6c 6f 68 39 61 6c 47 33 66 4b 43 69 33 6c 44 72 78 4c 35 6c 34 78 63 5f 4b 68 61 55 5f 4c 62 54 4b 6e 4e 74 70 66 44 63 68 65 45 4b 38 57 38 30 75 48 35 61 6f 2d 58 70 38 34 49 62 45 63 55 5a Data Ascii: a39ZXArorV6U6FnWOjtHc7QOHpem9bfIBCMkOVe6RB2gpjpjmHAyo7dscDtdrtz_Ns5gcDYtJAHeawJ8JQSBieMKnj0MIirRwjJmyJylsm1AR__WqLnM_QzwcHWvcR7RBm9Z89KQrFG0xyT-E7J5Tyyw5810c_jxvKRLVpY1WgWGOqES46JDplrrp_-3xloh9alG3fKCi3lDrxL5l4xc_KhaU_LbTKnNtpfDcheEK8W80uH5ao-Xp84IbEcUZ
2024-03-28 12:59:59 UTC	1252	IN	Data Raw: 33 64 6a 77 66 34 71 78 34 37 65 4d 37 41 36 58 2d 76 4f 79 45 49 66 33 71 33 6c 56 4b 30 4a 7a 41 38 58 44 36 7a 6d 41 2d 6e 38 4d 79 76 34 65 63 41 58 4f 62 49 45 66 79 46 75 77 59 77 31 62 58 75 30 48 39 39 66 64 48 6e 66 78 6d 51 36 38 51 64 49 43 77 35 65 4e 2d 62 61 39 71 6a 31 4e 5f 79 61 70 63 50 71 79 2d 65 56 76 53 75 50 78 72 33 35 32 43 64 41 4a 4d 69 45 72 4e 4f 6a 33 73 55 6d 45 4e 49 6c 7a 54 51 69 59 58 68 51 66 4f 4a 5f 42 78 64 77 36 46 33 56 53 59 50 59 52 59 42 6b 52 69 78 31 6a 39 69 71 76 6c 5a 7a 33 6f 72 5f 72 4b 66 48 6b 44 53 4c 53 4c 45 30 42 79 44 54 77 6c 68 48 58 79 43 49 72 76 4b 4c 35 56 67 4b 41 62 64 42 66 68 6a 36 41 65 77 67 55 37 72 69 76 4e 47 43 39 67 62 67 57 6a 4f 52 7a 61 44 6e 6a 75 56 4e 78 38 78 42 5f 77 65 42 Data Ascii: 3djwf4qx47eM7A6X-vOyEIf3q3lVK0JzA8XD6zmA-n8Myv4ecAXObIEfyFuwYw1bXu0H99fdHnfxmQ68QdICw5eN-ba9qj1N_yapcPqy-eVvSuPxr352CdAJMiErNOj3sUmENIlzTQiYXhQfOJ_Bxdw6F3VSYPYRYBkRix1j9iqvlZz3or_rKfHkDSLSLE0ByDTwlhHXyCIrvKL5VgKAbdBfhj6AewgU7rivNGC9gbgWjORzaDnjuVNx8xB_weB
2024-03-28 12:59:59 UTC	120	IN	Data Raw: 46 4c 65 78 4d 49 39 41 6a 49 6d 75 70 6e 59 44 37 5f 74 41 67 44 31 6a 48 6b 55 4a 58 6b 58 76 4c 51 6d 79 56 2d 4c 70 6d 46 4f 50 6e 65 43 79 39 70 6d 64 46 4e 37 32 2d 47 65 42 58 5f 47 73 37 47 62 55 46 54 45 68 46 54 46 59 56 74 4c 6f 33 5f 4a 2d 51 2d 31 54 55 6c 46 51 31 51 6b 6d 48 74 57 5f 4c 48 7a 6f 55 49 39 46 6d 48 70 69 36 33 50 4c 68 32 0d 0a Data Ascii: FLexMI9AjImupnYD7_tAgD1jHkUJXkXvLQmyV-LpmFOPneCy9pmdFN72-GeBX_Gs7GbUFTEhFTFYVtLo3_J-Q-1TUlFQ1QkmHtW_LHzoUI9FmHpi63PLh2
2024-03-28 12:59:59 UTC	1252	IN	Data Raw: 31 35 34 62 0d 0a 59 62 6c 7a 7a 44 65 4b 73 50 4e 33 38 4c 41 4c 5f 69 68 34 58 48 4d 30 38 38 43 73 48 66 66 58 4c 37 4c 6e 4d 47 7a 31 32 50 65 48 76 7a 38 34 63 71 36 5a 4b 6c 30 55 45 69 75 53 34 36 57 74 66 6e 68 4b 66 5a 5f 66 68 39 4d 56 6d 4d 2d 63 4f 6b 54 48 39 45 56 66 4c 66 74 59 42 53 44 7a 5f 61 39 6f 69 66 44 53 61 79 76 79 6f 37 34 45 64 51 63 52 4c 70 51 64 47 43 54 39 5f 6b 47 63 50 71 6a 6e 6c 46 67 73 61 45 68 64 63 69 64 53 55 4f 6c 72 78 6b 64 67 38 41 32 4d 52 5a 47 61 53 53 76 43 51 72 43 55 6f 50 4e 37 76 37 6a 72 32 49 4e 41 39 4f 4b 78 51 52 65 50 52 56 71 68 43 50 42 4f 6b 4f 61 43 5f 47 43 62 58 51 34 4c 76 67 76 39 6e 72 64 6b 6f 75 49 42 50 65 4a 47 50 63 74 72 4a 79 4e 66 35 4e 30 64 71 77 64 4c 42 73 77 7a 57 64 50 44 6e Data Ascii: 154bYblzzDeKsPN38LAL_ih4XHM088CsHffXL7LnMGz12PeHvz84cq6ZKl0UEiuS46WtfnhKfZ_fh9MVmM-cOkTH9EVfLftYBSDz_a9oifDSayvyo74EdQcRLpQdGCT9_kGcPqjnlFgsaEhdcidSUOlrxkdg8A2MRZGaSSvCQrCUoPN7v7jr2INA9OKxQRePRVqhCPBOkOaC_GCbXQ4Lvgv9nrdkouIBPeJGPctrJyNf5N0dqwdLBswzWdPDn
2024-03-28 12:59:59 UTC	1252	IN	Data Raw: 65 50 35 52 57 72 70 62 63 33 70 32 75 61 66 44 52 34 57 31 32 4c 4d 47 45 4b 6e 41 76 36 52 38 55 31 46 4a 42 31 4b 6c 58 47 51 5a 31 59 65 6e 62 63 78 32 74 48 5a 64 53 31 54 76 2d 33 73 45 4f 72 41 6c 36 47 67 56 42 57 42 43 44 64 77 73 74 55 6d 39 43 56 57 50 58 6c 6d 6a 50 79 64 66 39 5a 4e 59 6c 4f 61 43 6b 70 6b 68 4d 2d 74 31 4c 4c 77 6f 7a 69 32 54 70 49 6d 39 6c 39 6c 59 68 4e 76 65 49 44 6e 59 6a 62 41 6f 38 67 63 62 51 41 46 35 31 43 62 6c 72 42 4a 50 77 48 5a 47 5f 35 50 4d 61 50 69 34 67 67 52 38 45 63 43 6c 2d 67 5f 39 53 32 65 4a 54 7a 71 41 4a 58 7a 6a 43 70 6d 67 73 75 30 42 42 6d 44 30 4f 73 44 49 4f 56 62 5f 48 6a 35 53 42 30 75 6c 54 72 5a 4e 68 43 78 78 5f 65 57 32 4b 62 73 37 75 6d 56 6a 32 6f 6b 78 34 30 70 65 44 35 46 59 43 6d 69 Data Ascii: eP5RWrpbc3p2uafDR4W12LMGEKnAv6R8U1FJB1KlXGQZ1Yenbcx2tHZdS1Tv-3sEOrAl6GgVBWBCDdwstUm9CVWPXlmjPydf9ZNYlOaCkpkhM-t1LLwozi2TpIm9l9lYhNveIDnYjbAo8gcbQAF51CblrBJPwHZG_5PMaPi4ggR8EcCl-g_9S2eJTzqAJXzjCpmgsu0BBmD0OsDIOVb_Hj5SB0ulTrZNhCxx_eW2Kbs7umVj2okx40peD5FYCmi
2024-03-28 12:59:59 UTC	1252	IN	Data Raw: 37 2d 76 6e 62 61 48 64 75 57 38 61 63 67 43 70 56 53 6b 76 51 22 2c 6e 75 6c 6c 2c 31 32 30 2c 5b 22 70 6d 65 74 61 22 2c 5b 22 2f 6d 2f 30 31 39 39 67 22 2c 6e 75 6c 6c 2c 33 2c 33 2c 33 2c 6e 75 6c 6c 2c 22 42 69 6b 65 22 5d 2c 6e 75 6c 6c 2c 5b 31 5d 5d 2c 22 64 79 6e 61 6d 69 63 22 2c 6e 75 6c 6c 2c 5b 22 62 67 64 61 74 61 22 2c 22 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 50 54 58 70 69 53 6a 67 33 5a 32 74 43 4e 55 31 42 56 57 74 35 4e 6d 31 74 52 45 49 30 62 57 5a 73 61 30 56 36 59 54 52 79 55 55 68 56 53 6b 35 44 52 44 52 6f 55 31 38 30 4c 6d 70 7a 22 2c 22 22 2c 22 57 45 4e 72 53 33 4e 59 4f 55 31 6f 63 58 70 54 56 69 74 54 56 44 67 34 55 31 68 33 64 7a 68 70 61 55 56 70 63 6d 52 73 59 7a 41 33 Data Ascii: 7-vnbaHduW8acgCpVSkvQ",null,120,["pmeta",["/m/0199g",null,3,3,3,null,"Bike"],null,[1]],"dynamic",null,["bgdata","Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9PTXpiSjg3Z2tCNU1BVWt5Nm1tREI0bWZsa0V6YTRyUUhVSk5DRDRoU180Lmpz","","WENrS3NYOU1ocXpTVitTVDg4U1h3dzhpaUVpcmRsYzA3
2024-03-28 12:59:59 UTC	1252	IN	Data Raw: 55 35 61 4d 56 46 34 55 6b 64 6d 57 55 5a 46 57 47 5a 4d 62 58 46 43 59 56 46 4b 55 33 68 6e 4b 32 4e 52 52 7a 67 30 55 31 4e 58 62 48 59 79 51 32 39 78 5a 56 46 4b 55 46 4a 43 62 6d 68 43 53 55 4a 78 5a 58 64 34 53 30 70 79 56 47 35 45 62 6d 70 70 62 6b 34 32 4d 56 70 42 52 6a 4a 79 51 32 5a 48 61 55 39 77 4f 46 5a 79 54 7a 5a 74 55 47 31 35 55 58 4a 4b 5a 6e 4a 46 51 6d 67 31 52 6a 4a 55 55 58 6c 4f 56 32 39 49 4e 58 6c 76 4e 6c 4a 78 52 32 4e 6f 57 6e 52 76 62 6c 41 33 65 6d 64 4c 5a 58 70 58 62 33 68 72 53 79 74 30 4d 33 46 35 55 46 64 44 64 48 4e 6d 52 30 64 6e 65 45 74 36 4f 55 68 72 54 47 68 43 55 55 45 33 51 55 74 43 65 56 52 4f 59 56 68 6f 4d 6d 6c 53 51 58 56 58 61 58 51 33 4b 33 5a 47 5a 44 46 51 52 30 78 46 4b 32 46 54 51 31 4a 47 4d 30 67 79 Data Ascii: U5aMVF4UkdmWUZFWGZMbXFCYVFKU3hnK2NRRzg0U1NXbHYyQ29xZVFKUFJCbmhCSUJxZXd4S0pyVG5Ebmppbk42MVpBRjJyQ2ZHaU9wOFZyTzZtUG15UXJKZnJFQmg1RjJUUXlOV29INXlvNlJxR2NoWnRvblA3emdLZXpXb3hrSyt0M3F5UFdDdHNmR0dneEt6OUhrTGhCUUE3QUtCeVROYVhoMmlSQXVXaXQ3K3ZGZDFQR0xFK2FTQ1JGM0gy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49733	142.251.16.103	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 13:00:00 UTC	787	OUT	GET /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AM9qaELoax5VcKbFgGD2zLgg5666GoIPt1ziu1v46bVW_aERBX1MZoMkOvxTn9r2yJF_V2QAmP_emVD59HPG0QQ; NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 13:00:00 UTC	518	IN	HTTP/1.1 405 HTTP method GET is not supported by this URL Content-Type: text/html; charset=UTF-8 Date: Thu, 28 Mar 2024 13:00:00 GMT Expires: Thu, 28 Mar 2024 13:00:00 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 13:00:00 UTC	244	IN	Data Raw: 65 65 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 21 2d 2d 20 47 53 45 20 44 65 66 61 75 6c 74 20 45 72 72 6f 72 20 2d 2d 3e 0a 3c 48 31 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 48 31 3e 0a 3c 48 32 3e 45 72 72 6f 72 20 34 30 35 3c 2f 48 32 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 0d 0a Data Ascii: ee<HTML><HEAD><TITLE>HTTP method GET is not supported by this URL</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000">... GSE Default Error --><H1>HTTP method GET is not supported by this URL</H1><H2>Error 405</H2></BODY></HTML>
2024-03-28 13:00:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49737	142.251.16.106	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 13:00:00 UTC	1391	OUT	GET /recaptcha/api2/payload?p=06AFcWeA515YSWXZ2uQRU5C2JeMh2B8-jZ-CAvq3JQr6mWXq_fN_GXDbECH-0Xptke2wOEdHrE19WQQ0H3wFpuWUlCsH8Tvh7ENN34jier39833CXJ9n-3ZzcVq9GJzj5bh0SXf4iY_m2D_VzKyXiU4TAu_tcta1VKjMYNpX_qbbUpJmQ15qr24vg8IZElopJTLvc86gK_6hW1qLog7FjVAwDdaziTjnOQxA&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AM9qaELoax5VcKbFgGD2zLgg5666GoIPt1ziu1v46bVW_aERBX1MZoMkOvxTn9r2yJF_V2QAmP_emVD59HPG0QQ; NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 13:00:00 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 28 Mar 2024 13:00:00 GMT Date: Thu, 28 Mar 2024 13:00:00 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-28 13:00:00 UTC	1252	IN	Data Raw: 37 37 33 30 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 7730JFIFC!"$"$C,,"}!1AQa"q
2024-03-28 13:00:00 UTC	1252	IN	Data Raw: fe 3d 6b 9e 9e f6 c6 0b 1b 15 4b bc 95 82 13 28 e5 99 24 e7 78 6c ff 00 10 38 e0 f6 35 e9 60 71 10 ab 79 da dd d1 85 5a b2 74 d2 ec 76 fe 35 d3 74 4b 9d 23 4f d3 f5 1d 52 e2 e8 b5 cc 67 c9 92 e3 c9 76 8d 8b 29 01 60 d9 c6 07 a7 4f ce ba 1f 19 f8 4b 43 bb d0 6d 6c b4 85 b6 86 48 19 88 7d a6 59 36 ec 61 b4 b7 de 3f 74 0e 4f 45 3e 95 e4 3e 35 f1 76 8d fd b7 63 79 69 79 14 b2 da 21 92 e0 09 50 0f 9d 76 b2 2e 3a b7 00 f3 ef d3 22 a1 d5 be 2b f8 49 74 2b cd 3c de dd ce 27 d8 e8 b1 c5 80 0a 9e e5 88 3e df 89 ad 95 6a ea 6a 36 76 ee 64 a5 0d 79 95 d1 c2 78 be f8 5c 5e a4 13 c1 b6 5b 72 c1 f1 f3 6e 76 0a c4 e0 67 a8 2a 7e a4 f0 2b 14 f9 39 f9 90 7b e5 6a ae ab e2 28 35 0b b9 6e 52 79 0b c8 72 54 46 0a c7 c0 50 07 39 3c 28 19 f6 e9 54 0e ad 21 db 82 07 66 ca 74 f7 Data Ascii: =kK($xl85`qyZtv5tK#ORgv)`OKCmlH}Y6a?tOE>>5vcyiy!Pv.:"+It+<'>jj6vdyx\^[rnvg*~+9{j(5nRyrTFP9<(T!ft
2024-03-28 13:00:00 UTC	1252	IN	Data Raw: fe 21 f8 4e 2d 16 7b 4f 11 6b 6c 65 5b b7 7d ac af 23 32 6f dd 1e 48 53 c6 00 18 27 3c 60 d7 cb 6f e1 5f 89 76 9a 38 8a e6 d2 48 0a 4f 85 66 ba 8d b6 28 19 21 88 63 c0 24 63 d3 e6 cf 4e 28 5b f8 13 c6 32 5f a4 72 5c 44 ef 32 34 8c ab 2b c8 4a e4 8e 70 bd c8 e3 1f d3 8d 29 d0 97 2e da 33 39 d7 8a 7b 9f 4b 6b bf 1c 7c 0f 63 af c5 a9 c1 3d f5 da 45 0b 5b 30 50 54 c8 0b 06 de 32 c3 ee 95 c6 08 e7 24 f6 19 e6 7c 63 fb 4c e8 33 e9 77 5a 65 9f 87 2e a6 8a e6 33 0c 8f 35 de d2 50 8c 36 00 07 92 09 19 cf 19 cf 35 e3 d0 7c 1c d7 1d 33 a8 ea 46 da 61 c7 94 f6 f8 2d 93 85 2a 5d 94 10 4f 19 ed df 18 35 b7 73 f0 36 0b 33 66 fa ae b8 e5 08 51 34 76 f8 f3 02 91 9d cb c3 06 c0 c9 c6 73 8e 9c f1 55 ee c7 a2 17 3b 7b 7e 43 a0 fd a0 fc 4e 9a 2b 69 96 89 67 15 b8 04 e7 cb cb Data Ascii: !N-{Okle[}#2oHS'<`o_v8HOf(!c$cN([2_r\D24+Jp).39{Kk\|c=E[0PT2$\|cL3wZe.35P65\|3Fa-*]O5s63fQ4vsU;{~CN+ig
2024-03-28 13:00:00 UTC	348	IN	Data Raw: 37 fc b4 67 62 7f e0 2b 9c 28 ac dd 6e 91 57 62 74 f5 bb d1 1c 77 83 bc 3f a5 b4 f7 6d 25 94 32 4b 6b 70 60 52 93 ac ca 42 f4 3e 5a 13 b4 f3 f7 5f 91 ed 5b 9e 3d b6 db e0 db bc 21 8c 6f 80 72 bf f4 d9 3f 2f c2 ab fc 25 86 34 6f 16 36 d1 b7 fe 12 2b 95 05 a2 2d c0 09 8e 7f 1a ea b5 5d 4e d6 3b 49 44 92 41 1d a4 63 74 b2 f9 5e 9d 80 e7 27 3d 3d e9 59 cb 59 b1 b6 a3 2b 41 18 3a ed b6 99 12 43 77 71 72 0c 50 37 98 db 01 06 46 db 80 a0 e6 b8 eb cb ff 00 ed 2b e3 3c c7 64 6a 02 c6 88 06 15 47 40 39 a7 78 8b 55 9b 57 bb f3 36 34 70 e4 f9 71 9e 4a 8f 53 fe d1 ef f9 76 aa 56 a9 ce 40 c8 15 d1 4e 1d 59 83 b4 55 a2 5e 0e 88 0e d3 9f a8 c5 5a 57 e0 7d df ca ab cd 71 6c d1 04 5b 04 49 3f be 1d c9 fc 89 c5 45 e6 1f 53 5b 10 54 d2 3f e2 4f e2 4b 79 b5 19 74 9d 33 49 9a Data Ascii: 7gb+(nWbtw?m%2Kkp`RB>Z_[=!or?/%4o6+-]N;IDAct^'==YY+A:CwqrP7F+<djG@9xUW64pqJSvV@NYU^ZW}ql[I?ES[T?OKyt3I
2024-03-28 13:00:00 UTC	1252	IN	Data Raw: fa 28 08 9a 40 a1 43 44 48 20 29 c0 ce dd c7 3e dd 38 c9 ad bd 8a 4e f7 bf a6 9e 86 2a a3 be d6 fc 4f a7 b5 bf 18 e8 ff 00 f0 8a 58 49 a6 40 f6 b3 a4 51 fc 97 36 0c 1a 5d ca 37 04 66 52 09 ea 77 64 83 91 d6 b3 2e b5 81 6f 69 6a b7 17 b7 36 86 e2 3f bb 1c a1 00 62 c0 94 70 4e 17 0b d3 8c 7d 08 19 f9 ea cf 55 f1 4d ea 3d a5 bc f2 34 f0 5b 16 61 b8 29 8b cb 1b 98 ed 3d 78 04 63 1d 7a 0e 94 db 68 3c 4b ac b5 9a b6 b1 1a 19 55 94 86 90 e7 e5 e7 24 28 24 03 c0 1e b8 a5 2a 52 e5 5c a3 8d 44 9e a7 bf f8 9f c4 7a 1d ca 5b cf 6b 71 1a 47 66 ac b6 ff 00 69 77 6f 31 db 70 3f 77 18 50 0e 77 75 07 1c 10 08 35 f5 2f 19 f8 57 5d d2 ac 2d ed 67 bd 82 ea 03 19 47 84 45 1e d7 41 b7 96 38 2c 3a 1f 7f 6c 1c 79 ce 9f f0 83 54 bd b7 84 f8 83 c4 d2 69 30 94 12 8d f6 af 33 14 60 Data Ascii: (@CDH )>8NOXI@Q6]7fRwd.oij6?bpN}UM=4[a)=xczh<KU$($R\Dz[kqGfiwo1p?wPwu5/W]-gGEA8,:lyTi03`
2024-03-28 13:00:00 UTC	1252	IN	Data Raw: 1f 89 89 1c a6 4b 55 77 86 3b 78 cf 4f 38 1d df f7 c9 00 fe 7f 95 11 26 c7 06 3b 69 14 75 f3 9e 22 4f e0 a3 a7 e9 53 db 5b 5c c2 de 61 8e 1b 87 c7 df 67 21 bf 0c 8c 0f c2 ac 0b b9 54 a8 7b 09 c9 e9 f2 32 b7 f5 a5 ec dc be 26 3f 68 97 c2 42 82 cc 30 77 92 4f 33 a6 f7 2c 87 f2 e3 15 76 db ec cc 73 fd a0 00 1d 71 22 9c 7e 74 c1 a8 da c4 a0 ce 92 44 71 8d ad 19 04 d6 5d e5 ea de c8 cf 71 34 76 d6 d1 0d c7 71 03 00 77 3e a6 b5 49 23 3b b6 50 d2 74 4b 2d 22 0d 56 45 d5 27 9a 0b 8b e9 6f e5 69 91 62 8a 32 f8 c9 3d 49 e1 7a e4 7d 05 71 9e 21 d6 8e a7 3a f9 7b 92 ce 23 98 23 e8 5c f4 de de fe 83 b0 a9 bc 4f ae 7f 6b 39 b6 b6 cc 7a 6c 47 2a 0f 06 62 3f 88 fb 7a 0f c6 b0 1c 86 6e 24 c8 ed 83 55 ec d3 92 7d 86 aa 35 16 bb 93 09 09 07 d4 d4 f1 3e c8 f0 3a f7 aa d0 21 Data Ascii: KUw;xO8&;iu"OS[\ag!T{2&?hB0wO3,vsq"~tDq]q4vqw>I#;PtK-"VE'oib2=Iz}q!:{##\Ok9zlG*b?zn$U}5>:!
2024-03-28 13:00:00 UTC	1252	IN	Data Raw: 98 67 68 52 e2 35 21 d1 98 21 ca 92 a7 8f c3 f5 a9 77 c4 1f 67 99 6f 9c 75 12 e7 1f a5 70 fe 21 92 e7 c6 9e 2c d4 e2 d3 10 da e9 f6 44 47 25 dc 6d 83 f2 92 a5 8f b7 27 f0 15 bf a2 fc 35 f0 cb 5b 18 6f 56 ed ef 13 02 42 6e 0e 49 f5 18 ea a7 a8 3f d4 11 5d 51 ab 7d 14 6f f3 39 e5 04 95 db 35 2e ae 6d ac ed 1e ea 69 70 8a 07 00 67 e6 ec 07 3d 6a 56 56 d9 bb 1d 7b d7 3b a9 fc 35 78 a7 41 e1 fd 62 65 75 02 51 15 db 6e 4c 83 c7 cc 30 47 1b 8f 43 f7 4d 5b f0 ff 00 88 a4 b7 bf 1a 2f 8a ed a4 b3 bd e3 63 f1 b5 c7 3c 83 8c 30 e3 b5 5a 95 dd 9a b0 34 b9 7d dd 59 ae 41 03 95 ef f5 a6 91 93 ef 5a f7 5a 7a 8b 53 34 57 0a 10 2e e0 c5 37 02 31 ec 45 54 fe cb be 30 02 26 80 bb 73 bb ca 6c 7d 3e f5 3b d8 94 51 20 02 39 39 f7 a3 6f 42 5b 03 ad 5d 87 49 d4 0b 1f 32 4b 57 5e Data Ascii: ghR5!!wgoup!,DG%m'5[oVBnI?]Q}o95.mipg=jVV{;5xAbeuQnL0GCM[/c<0Z4}YAZZzS4W.71ET0&sl}>;Q 99oB[]I2KW^
2024-03-28 13:00:00 UTC	1252	IN	Data Raw: c8 1b 0a 49 c1 04 7a fb 56 86 9a a6 72 42 84 11 49 1b 07 32 b7 ca 83 be ec 7a 1f e9 5e 2c a5 29 ca e7 a4 92 8e c6 9e 91 63 79 7d 73 0e 9d 64 a5 ee 3c dc b0 e8 b8 ef 9f 41 ef eb ea 6b aa d5 2f b4 8d 12 fd 66 d3 d9 5f 55 78 c2 49 12 a0 d9 6a ca 81 4b 2f 62 72 32 7b 7c c3 be 6b 8a b8 d5 a2 b7 8d ec b4 a9 5c 44 40 12 4c 17 6b c9 8e fd f0 39 3c 77 07 dc d3 f4 f8 ee 27 3e 52 2c 93 19 9c 7e e8 0d c5 db 90 31 8e 4f 5e 9d ff 00 5a a8 c5 2d 01 b7 1d 4d 3f 15 dc 5d de 68 7a 54 17 d2 3c c2 06 96 de 16 df 92 a8 16 3c 03 db 00 1c 64 72 78 f4 cd 79 ab 5f 49 a4 ea 72 5c 08 70 f6 f3 7c bf 3f 07 83 8e 7e 84 1a f4 0f 11 c1 7f 69 69 a7 25 da b2 2b a3 b4 31 32 90 ca 0e de 70 7b 1e dd f8 f6 15 e7 9e 2a 4b b5 be f3 da ce 49 63 65 01 b6 8c e4 8e 99 1f d7 de bd 3a 6e d4 23 24 71 Data Ascii: IzVrBI2z^,)cy}sd<Ak/f_UxIjK/br2{\|k\D@Lk9<w'>R,~1O^Z-M?]hzT<<drxy_Ir\p\|?~ii%+12p{*KIce:n#$q
2024-03-28 13:00:00 UTC	1252	IN	Data Raw: 83 ef 90 be c0 70 07 4e 3d f8 d3 94 15 96 a7 97 3b 4f 56 ec 77 52 ff 00 69 59 5c 49 71 6b 67 e4 5a dd 95 8e 2b 70 76 94 6e dd 4f 01 bb 8e d8 1f 85 58 74 db b9 c8 be 37 09 e7 30 e3 78 38 61 e8 0f 65 3d 8f 6e bd c8 3e 7d 6b f0 e3 5a b9 91 26 b3 9e 12 ca 16 56 8e 5b 89 cb 44 e0 9c 13 f3 f7 e4 e3 db d8 65 96 ff 00 0e 2f 86 b1 1d 92 4f 74 2f 42 0b 89 fc bb b3 e5 60 92 38 5e bc 91 d3 35 2e b3 5b c4 15 15 d1 9d db 5a 36 ac 89 2a ee 36 51 b7 dd 20 ab 4a c3 b8 c1 e3 69 1c 1e e7 3d b0 4b 35 08 6e c2 41 16 04 df 36 f8 65 65 3b 65 0b 8c 83 e9 8d c3 77 d4 71 93 81 cb df f8 1f c4 da 02 db 49 0e ab 3d a3 97 1b 4b 80 73 96 e7 00 9e 3a 8e 31 df df 15 bf 0f 87 35 48 2d a2 9b 59 d7 63 ba 21 d9 63 30 6f 6f 2d dc ee 29 82 70 77 37 5c 77 c6 7b 10 e3 5d 3e 82 74 1a ea 3e e7 cc Data Ascii: pN=;OVwRiY\IqkgZ+pvnOXt70x8ae=n>}kZ&V[De/Ot/B`8^5.[Z6*6Q Ji=K5nA6ee;ewqI=Ks:15H-Yc!c0oo-)pw7\w{]>t>
2024-03-28 13:00:00 UTC	1252	IN	Data Raw: 54 c8 c6 38 71 9e 4f 26 ab d8 89 d7 45 c7 d4 89 38 48 01 1e a5 b1 49 f6 c9 1b 91 1e 3e ad 8f e9 54 63 60 46 01 a9 0c a4 1c 67 a5 68 e9 25 b1 92 ae de ac c7 d6 7e 0c f8 aa ec 1c 7c 47 85 09 50 37 26 8a 72 a3 b2 83 e7 f4 1f e7 35 8b 1f c0 0f 11 24 22 31 f1 42 75 f9 89 24 69 6d 83 93 9e 9e 7f af 35 f4 21 04 0d a4 0c 53 d4 41 80 1a 23 f5 cd 7c ec 63 18 ad 0f a6 75 67 2d d9 e0 f6 3f 03 bc 4b 1c ae ef f1 52 e5 e4 75 0b b9 b4 a2 49 fa fe ff 00 9a da b0 f8 0d ae a0 59 1b e2 05 b3 4c 0e e1 29 d1 b0 f9 ef cf 9d d3 b6 3a 62 bd 79 ad 83 1c c3 92 3d 31 48 8f 2c 67 e5 62 08 a9 9c 14 f6 63 8d 47 1d cf 30 7f 80 b7 57 b2 09 2f bc 65 04 a5 33 b4 1d 24 11 9f 53 99 0e 69 6e 7e 04 ea b3 5b a4 07 c7 31 cc 91 ff 00 ab f3 34 70 db 71 d3 fe 5a f3 8f 5f ff 00 5d 7a aa dc cd 8f 53 Data Ascii: T8qO&E8HI>Tc`Fgh%~\|GP7&r5$"1Bu$im5!SA#\|cug-?KRuIYL):by=1H,gbcG0W/e3$Sin~[14pqZ_]zS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49743	142.251.16.103	443	2452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 13:00:00 UTC	1019	OUT	GET /recaptcha/api2/payload?p=06AFcWeA515YSWXZ2uQRU5C2JeMh2B8-jZ-CAvq3JQr6mWXq_fN_GXDbECH-0Xptke2wOEdHrE19WQQ0H3wFpuWUlCsH8Tvh7ENN34jier39833CXJ9n-3ZzcVq9GJzj5bh0SXf4iY_m2D_VzKyXiU4TAu_tcta1VKjMYNpX_qbbUpJmQ15qr24vg8IZElopJTLvc86gK_6hW1qLog7FjVAwDdaziTjnOQxA&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AM9qaELoax5VcKbFgGD2zLgg5666GoIPt1ziu1v46bVW_aERBX1MZoMkOvxTn9r2yJF_V2QAmP_emVD59HPG0QQ; NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2024-03-28 13:00:01 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 28 Mar 2024 13:00:00 GMT Date: Thu, 28 Mar 2024 13:00:00 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-28 13:00:01 UTC	6	IN	Data Raw: 37 37 33 30 0d 0a Data Ascii: 7730
2024-03-28 13:00:01 UTC	1252	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC!"$"$C,,"}!1AQa"q2
2024-03-28 13:00:01 UTC	1252	IN	Data Raw: c6 0b 1b 15 4b bc 95 82 13 28 e5 99 24 e7 78 6c ff 00 10 38 e0 f6 35 e9 60 71 10 ab 79 da dd d1 85 5a b2 74 d2 ec 76 fe 35 d3 74 4b 9d 23 4f d3 f5 1d 52 e2 e8 b5 cc 67 c9 92 e3 c9 76 8d 8b 29 01 60 d9 c6 07 a7 4f ce ba 1f 19 f8 4b 43 bb d0 6d 6c b4 85 b6 86 48 19 88 7d a6 59 36 ec 61 b4 b7 de 3f 74 0e 4f 45 3e 95 e4 3e 35 f1 76 8d fd b7 63 79 69 79 14 b2 da 21 92 e0 09 50 0f 9d 76 b2 2e 3a b7 00 f3 ef d3 22 a1 d5 be 2b f8 49 74 2b cd 3c de dd ce 27 d8 e8 b1 c5 80 0a 9e e5 88 3e df 89 ad 95 6a ea 6a 36 76 ee 64 a5 0d 79 95 d1 c2 78 be f8 5c 5e a4 13 c1 b6 5b 72 c1 f1 f3 6e 76 0a c4 e0 67 a8 2a 7e a4 f0 2b 14 f9 39 f9 90 7b e5 6a ae ab e2 28 35 0b b9 6e 52 79 0b c8 72 54 46 0a c7 c0 50 07 39 3c 28 19 f6 e9 54 0e ad 21 db 82 07 66 ca 74 f7 1c d7 bd 86 b2 a6 Data Ascii: K($xl85`qyZtv5tK#ORgv)`OKCmlH}Y6a?tOE>>5vcyiy!Pv.:"+It+<'>jj6vdyx\^[rnvg*~+9{j(5nRyrTFP9<(T!ft
2024-03-28 13:00:01 UTC	1252	IN	Data Raw: 7b 4f 11 6b 6c 65 5b b7 7d ac af 23 32 6f dd 1e 48 53 c6 00 18 27 3c 60 d7 cb 6f e1 5f 89 76 9a 38 8a e6 d2 48 0a 4f 85 66 ba 8d b6 28 19 21 88 63 c0 24 63 d3 e6 cf 4e 28 5b f8 13 c6 32 5f a4 72 5c 44 ef 32 34 8c ab 2b c8 4a e4 8e 70 bd c8 e3 1f d3 8d 29 d0 97 2e da 33 39 d7 8a 7b 9f 4b 6b bf 1c 7c 0f 63 af c5 a9 c1 3d f5 da 45 0b 5b 30 50 54 c8 0b 06 de 32 c3 ee 95 c6 08 e7 24 f6 19 e6 7c 63 fb 4c e8 33 e9 77 5a 65 9f 87 2e a6 8a e6 33 0c 8f 35 de d2 50 8c 36 00 07 92 09 19 cf 19 cf 35 e3 d0 7c 1c d7 1d 33 a8 ea 46 da 61 c7 94 f6 f8 2d 93 85 2a 5d 94 10 4f 19 ed df 18 35 b7 73 f0 36 0b 33 66 fa ae b8 e5 08 51 34 76 f8 f3 02 91 9d cb c3 06 c0 c9 c6 73 8e 9c f1 55 ee c7 a2 17 3b 7b 7e 43 a0 fd a0 fc 4e 9a 2b 69 96 89 67 15 b8 04 e7 cb cb ed ed 92 78 c8 c0 Data Ascii: {Okle[}#2oHS'<`o_v8HOf(!c$cN([2_r\D24+Jp).39{Kk\|c=E[0PT2$\|cL3wZe.35P65\|3Fa-*]O5s63fQ4vsU;{~CN+igx
2024-03-28 13:00:01 UTC	342	IN	Data Raw: e0 2b 9c 28 ac dd 6e 91 57 62 74 f5 bb d1 1c 77 83 bc 3f a5 b4 f7 6d 25 94 32 4b 6b 70 60 52 93 ac ca 42 f4 3e 5a 13 b4 f3 f7 5f 91 ed 5b 9e 3d b6 db e0 db bc 21 8c 6f 80 72 bf f4 d9 3f 2f c2 ab fc 25 86 34 6f 16 36 d1 b7 fe 12 2b 95 05 a2 2d c0 09 8e 7f 1a ea b5 5d 4e d6 3b 49 44 92 41 1d a4 63 74 b2 f9 5e 9d 80 e7 27 3d 3d e9 59 cb 59 b1 b6 a3 2b 41 18 3a ed b6 99 12 43 77 71 72 0c 50 37 98 db 01 06 46 db 80 a0 e6 b8 eb cb ff 00 ed 2b e3 3c c7 64 6a 02 c6 88 06 15 47 40 39 a7 78 8b 55 9b 57 bb f3 36 34 70 e4 f9 71 9e 4a 8f 53 fe d1 ef f9 76 aa 56 a9 ce 40 c8 15 d1 4e 1d 59 83 b4 55 a2 5e 0e 88 0e d3 9f a8 c5 5a 57 e0 7d df ca ab cd 71 6c d1 04 5b 04 49 3f be 1d c9 fc 89 c5 45 e6 1f 53 5b 10 54 d2 3f e2 4f e2 4b 79 b5 19 74 9d 33 49 9a 58 d6 f8 c6 d1 b8 Data Ascii: +(nWbtw?m%2Kkp`RB>Z_[=!or?/%4o6+-]N;IDAct^'==YY+A:CwqrP7F+<djG@9xUW64pqJSvV@NYU^ZW}ql[I?ES[T?OKyt3IX
2024-03-28 13:00:01 UTC	1252	IN	Data Raw: fa 28 08 9a 40 a1 43 44 48 20 29 c0 ce dd c7 3e dd 38 c9 ad bd 8a 4e f7 bf a6 9e 86 2a a3 be d6 fc 4f a7 b5 bf 18 e8 ff 00 f0 8a 58 49 a6 40 f6 b3 a4 51 fc 97 36 0c 1a 5d ca 37 04 66 52 09 ea 77 64 83 91 d6 b3 2e b5 81 6f 69 6a b7 17 b7 36 86 e2 3f bb 1c a1 00 62 c0 94 70 4e 17 0b d3 8c 7d 08 19 f9 ea cf 55 f1 4d ea 3d a5 bc f2 34 f0 5b 16 61 b8 29 8b cb 1b 98 ed 3d 78 04 63 1d 7a 0e 94 db 68 3c 4b ac b5 9a b6 b1 1a 19 55 94 86 90 e7 e5 e7 24 28 24 03 c0 1e b8 a5 2a 52 e5 5c a3 8d 44 9e a7 bf f8 9f c4 7a 1d ca 5b cf 6b 71 1a 47 66 ac b6 ff 00 69 77 6f 31 db 70 3f 77 18 50 0e 77 75 07 1c 10 08 35 f5 2f 19 f8 57 5d d2 ac 2d ed 67 bd 82 ea 03 19 47 84 45 1e d7 41 b7 96 38 2c 3a 1f 7f 6c 1c 79 ce 9f f0 83 54 bd b7 84 f8 83 c4 d2 69 30 94 12 8d f6 af 33 14 60 Data Ascii: (@CDH )>8NOXI@Q6]7fRwd.oij6?bpN}UM=4[a)=xczh<KU$($R\Dz[kqGfiwo1p?wPwu5/W]-gGEA8,:lyTi03`
2024-03-28 13:00:01 UTC	1252	IN	Data Raw: 1f 89 89 1c a6 4b 55 77 86 3b 78 cf 4f 38 1d df f7 c9 00 fe 7f 95 11 26 c7 06 3b 69 14 75 f3 9e 22 4f e0 a3 a7 e9 53 db 5b 5c c2 de 61 8e 1b 87 c7 df 67 21 bf 0c 8c 0f c2 ac 0b b9 54 a8 7b 09 c9 e9 f2 32 b7 f5 a5 ec dc be 26 3f 68 97 c2 42 82 cc 30 77 92 4f 33 a6 f7 2c 87 f2 e3 15 76 db ec cc 73 fd a0 00 1d 71 22 9c 7e 74 c1 a8 da c4 a0 ce 92 44 71 8d ad 19 04 d6 5d e5 ea de c8 cf 71 34 76 d6 d1 0d c7 71 03 00 77 3e a6 b5 49 23 3b b6 50 d2 74 4b 2d 22 0d 56 45 d5 27 9a 0b 8b e9 6f e5 69 91 62 8a 32 f8 c9 3d 49 e1 7a e4 7d 05 71 9e 21 d6 8e a7 3a f9 7b 92 ce 23 98 23 e8 5c f4 de de fe 83 b0 a9 bc 4f ae 7f 6b 39 b6 b6 cc 7a 6c 47 2a 0f 06 62 3f 88 fb 7a 0f c6 b0 1c 86 6e 24 c8 ed 83 55 ec d3 92 7d 86 aa 35 16 bb 93 09 09 07 d4 d4 f1 3e c8 f0 3a f7 aa d0 21 Data Ascii: KUw;xO8&;iu"OS[\ag!T{2&?hB0wO3,vsq"~tDq]q4vqw>I#;PtK-"VE'oib2=Iz}q!:{##\Ok9zlG*b?zn$U}5>:!
2024-03-28 13:00:01 UTC	1252	IN	Data Raw: 98 67 68 52 e2 35 21 d1 98 21 ca 92 a7 8f c3 f5 a9 77 c4 1f 67 99 6f 9c 75 12 e7 1f a5 70 fe 21 92 e7 c6 9e 2c d4 e2 d3 10 da e9 f6 44 47 25 dc 6d 83 f2 92 a5 8f b7 27 f0 15 bf a2 fc 35 f0 cb 5b 18 6f 56 ed ef 13 02 42 6e 0e 49 f5 18 ea a7 a8 3f d4 11 5d 51 ab 7d 14 6f f3 39 e5 04 95 db 35 2e ae 6d ac ed 1e ea 69 70 8a 07 00 67 e6 ec 07 3d 6a 56 56 d9 bb 1d 7b d7 3b a9 fc 35 78 a7 41 e1 fd 62 65 75 02 51 15 db 6e 4c 83 c7 cc 30 47 1b 8f 43 f7 4d 5b f0 ff 00 88 a4 b7 bf 1a 2f 8a ed a4 b3 bd e3 63 f1 b5 c7 3c 83 8c 30 e3 b5 5a 95 dd 9a b0 34 b9 7d dd 59 ae 41 03 95 ef f5 a6 91 93 ef 5a f7 5a 7a 8b 53 34 57 0a 10 2e e0 c5 37 02 31 ec 45 54 fe cb be 30 02 26 80 bb 73 bb ca 6c 7d 3e f5 3b d8 94 51 20 02 39 39 f7 a3 6f 42 5b 03 ad 5d 87 49 d4 0b 1f 32 4b 57 5e Data Ascii: ghR5!!wgoup!,DG%m'5[oVBnI?]Q}o95.mipg=jVV{;5xAbeuQnL0GCM[/c<0Z4}YAZZzS4W.71ET0&sl}>;Q 99oB[]I2KW^
2024-03-28 13:00:01 UTC	1252	IN	Data Raw: c8 1b 0a 49 c1 04 7a fb 56 86 9a a6 72 42 84 11 49 1b 07 32 b7 ca 83 be ec 7a 1f e9 5e 2c a5 29 ca e7 a4 92 8e c6 9e 91 63 79 7d 73 0e 9d 64 a5 ee 3c dc b0 e8 b8 ef 9f 41 ef eb ea 6b aa d5 2f b4 8d 12 fd 66 d3 d9 5f 55 78 c2 49 12 a0 d9 6a ca 81 4b 2f 62 72 32 7b 7c c3 be 6b 8a b8 d5 a2 b7 8d ec b4 a9 5c 44 40 12 4c 17 6b c9 8e fd f0 39 3c 77 07 dc d3 f4 f8 ee 27 3e 52 2c 93 19 9c 7e e8 0d c5 db 90 31 8e 4f 5e 9d ff 00 5a a8 c5 2d 01 b7 1d 4d 3f 15 dc 5d de 68 7a 54 17 d2 3c c2 06 96 de 16 df 92 a8 16 3c 03 db 00 1c 64 72 78 f4 cd 79 ab 5f 49 a4 ea 72 5c 08 70 f6 f3 7c bf 3f 07 83 8e 7e 84 1a f4 0f 11 c1 7f 69 69 a7 25 da b2 2b a3 b4 31 32 90 ca 0e de 70 7b 1e dd f8 f6 15 e7 9e 2a 4b b5 be f3 da ce 49 63 65 01 b6 8c e4 8e 99 1f d7 de bd 3a 6e d4 23 24 71 Data Ascii: IzVrBI2z^,)cy}sd<Ak/f_UxIjK/br2{\|k\D@Lk9<w'>R,~1O^Z-M?]hzT<<drxy_Ir\p\|?~ii%+12p{*KIce:n#$q
2024-03-28 13:00:01 UTC	1252	IN	Data Raw: 83 ef 90 be c0 70 07 4e 3d f8 d3 94 15 96 a7 97 3b 4f 56 ec 77 52 ff 00 69 59 5c 49 71 6b 67 e4 5a dd 95 8e 2b 70 76 94 6e dd 4f 01 bb 8e d8 1f 85 58 74 db b9 c8 be 37 09 e7 30 e3 78 38 61 e8 0f 65 3d 8f 6e bd c8 3e 7d 6b f0 e3 5a b9 91 26 b3 9e 12 ca 16 56 8e 5b 89 cb 44 e0 9c 13 f3 f7 e4 e3 db d8 65 96 ff 00 0e 2f 86 b1 1d 92 4f 74 2f 42 0b 89 fc bb b3 e5 60 92 38 5e bc 91 d3 35 2e b3 5b c4 15 15 d1 9d db 5a 36 ac 89 2a ee 36 51 b7 dd 20 ab 4a c3 b8 c1 e3 69 1c 1e e7 3d b0 4b 35 08 6e c2 41 16 04 df 36 f8 65 65 3b 65 0b 8c 83 e9 8d c3 77 d4 71 93 81 cb df f8 1f c4 da 02 db 49 0e ab 3d a3 97 1b 4b 80 73 96 e7 00 9e 3a 8e 31 df df 15 bf 0f 87 35 48 2d a2 9b 59 d7 63 ba 21 d9 63 30 6f 6f 2d dc ee 29 82 70 77 37 5c 77 c6 7b 10 e3 5d 3e 82 74 1a ea 3e e7 cc Data Ascii: pN=;OVwRiY\IqkgZ+pvnOXt70x8ae=n>}kZ&V[De/Ot/B`8^5.[Z6*6Q Ji=K5nA6ee;ewqI=Ks:15H-Yc!c0oo-)pw7\w{]>t>

Target ID:	0
Start time:	13:59:34
Start date:	28/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:59:36
Start date:	28/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2004,i,858439363166866708,11796472518649460152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:59:39
Start date:	28/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://tinyurl.com/4cbr8n8t"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://tinyurl.com/4cbr8n8t

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Windows Analysis Report
http://tinyurl.com/4cbr8n8t