Edit tour

Windows Analysis Report
Documents.7z

Overview

General Information

Sample name:	Documents.7z
Analysis ID:	1428205
MD5:	a5b3ed5957de557e9ca4669bf306b809
SHA1:	66bd7f7fc6807e5e971420afd6a09bdd3aaa2f40
SHA256:	9c1f16a7649955f194d86d5c3aa88cc7e5b4a6c70a893446e24efcfe9bd4f13d
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OpenWith.exe (PID: 6940 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

rundll32.exe (PID: 6856 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

OpenWith.exe (PID: 6788 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

chrome.exe (PID: 1992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5920 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1896,i,2522147141678714913,16162524076685256105,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49743 version: TLS 1.2

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mAxnuSGHD3KYcLX&MD=OpGoY+BO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26oft%3D1%26pgcl%3D20%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgRRtTk0GObihLEGIjDQR5zrL8Z8FIe--7JmhwAOhhfkAQgrLLC7_vpIQAglsXqdjDqfhIkPDrbvTHmKgCIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRRtTk0GObihLEGIjAI7DtiS_GiN5bc9NLEssGbsC0oLSesQcn1J6SH9zJpOTjdzgSOLpnIbu-Pxo5sr8MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=A8jZ0OPhPeIqlDT7GmFF77vlgGETmxZbTXqHRxNl7JVr8QG2WMZ5ul-Bchthd27MpWaQ6URS-PVj-Ux8XnXL-CI8tBUpf72ShjyTdP8bBQCFosVwFW05YugaUF75D22ZXEfz3UeGwLMGgwjpYi1FqQqug9XyPXVMOpKbzQWuDJo
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRRtTk0GObihLEGIjCjYMa1_LGDVbrC5SvJmZkMYhY0iukalt9_KGlWf27Rj0MpZxY-3zG0gN8CvSCy_K8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7&oit=4&cp=1&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7z&oit=1&cp=2&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7zi&oit=1&cp=3&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7zip&oit=1&cp=4&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI
Source: global traffic	HTTP traffic detected: GET /search?q=7zip&oq=7zip&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&s=UmaxTijlJW5SKuCjeKiuht3d-cK_JbsmlNOyQxTFy5nd5IFHD6atAzmTR0rLo-BcJEqhyVZFVhj7UzxfIbWvz_DaqhxQk7YKW4V6sZzvzbYDMhfzwNoLw5lzf1texV1J0SVn5osV7V_T2-BtXAD5bSXvCsgcXGg-Vnhfv-YRq6R_u2ne50cYXEO1kTWw7TqUD6VdLSP3GPCIObFNRoi65NmxMW7_PilDEcN6LPU1Ql907VfeSmZlRuZ_nKxP1XM-1aT28hgtdu-lMA0bD9c6U7Q44McPV2w&cb=mr7m5vp8npo1 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /js/bg/IsHUla7t4cK5kOAb6cwcBiPQ5HnUjMTZuq5wUJJd2UM.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&s=UmaxTijlJW5SKuCjeKiuht3d-cK_JbsmlNOyQxTFy5nd5IFHD6atAzmTR0rLo-BcJEqhyVZFVhj7UzxfIbWvz_DaqhxQk7YKW4V6sZzvzbYDMhfzwNoLw5lzf1texV1J0SVn5osV7V_T2-BtXAD5bSXvCsgcXGg-Vnhfv-YRq6R_u2ne50cYXEO1kTWw7TqUD6VdLSP3GPCIObFNRoi65NmxMW7_PilDEcN6LPU1Ql907VfeSmZlRuZ_nKxP1XM-1aT28hgtdu-lMA0bD9c6U7Q44McPV2w&cb=mr7m5vp8npo1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&s=UmaxTijlJW5SKuCjeKiuht3d-cK_JbsmlNOyQxTFy5nd5IFHD6atAzmTR0rLo-BcJEqhyVZFVhj7UzxfIbWvz_DaqhxQk7YKW4V6sZzvzbYDMhfzwNoLw5lzf1texV1J0SVn5osV7V_T2-BtXAD5bSXvCsgcXGg-Vnhfv-YRq6R_u2ne50cYXEO1kTWw7TqUD6VdLSP3GPCIObFNRoi65NmxMW7_PilDEcN6LPU1Ql907VfeSmZlRuZ_nKxP1XM-1aT28hgtdu-lMA0bD9c6U7Q44McPV2w&cb=mr7m5vp8npo1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA6zzF3weexsGQsiWg04-ruhQ_tnzyde1vKlIfQTjXALVxjLUHt7ksR07qCbedVXCdf7altNdSUGcUkuXTtpWJYU1TmqYTGYMjngvfu5iz-u-r_yqaBbwk7wABh0-URfontoaNLPwu0FJLJ3KzNq-OXDV7kkFUISOHGokyjqXj72tyoda8Fi-G9Z9RyFs1grPBTrsdf7&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mAxnuSGHD3KYcLX&MD=OpGoY+BO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA5EkBAPcMOv8LoW-z9oBGkRrNwkqmrtq_175ZiAFCWhI-dyfruxwN0EDtkBtrIe45FR2B35vqjequ9u7h18hT0EZgUvvCNumA3qqc1Nn-xqxq27UAv_m_wGsMefQh0-uUR_Pqw0MRFz6NSBUxRcoRoZXH2Q2wOpxOB1syaPENODsWo-xZ2DDegCQOWtGbJF25CD4XKk&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=ad1303f5874012dd HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA7ZXw9uOkzALS2kTLha29HPHU16TQlZMx1pKUQ_7wrrt-sofC93B5Gzs09quO4b5SQJHCmYHReXfi5VGgdKJJAbCbCk-tgCCtCpA6KflzJKIdpjmWKDksHG1uX8pTnEgx7MlhKw9QEWgFjprGJNpLH_qpjPuN2JS_Cw43bf-dyuoA8h0Z5tkw6aMn_Crw32vrySkE60&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=9747b01ef597c89c HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA4frbWer0wKH0ZR6C82DbZps44nKxyxai6240hzAEw4slWjXUVJ3G1AUW3Y7SCTq-LwA_ygKzzLxwJlUwqwNlcl3_wi5JOCrgtg40cH6DJGZ1KhngUVXVffYTbAGm5AhZKzZt9feWlVBAu2j2Kye-blWt3VyTeXfK2TkZ7U2m_pU2d80hjh4I5LRFeyCpD9IVa-f_I9&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=58248a340f3c879f HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA49y5mejDfIItLfORTrCWMpwtXejgU5GCv958_nqMD5Zxylr-6zIx65ExHw1tpmotQ7Id4J-fYyfd4cyx0F-qJ09jcF7FAlBQXoal_B73_uydDY-r5s-DHQcgc0N5SMXpZpKkEPIZN4QyJ_FZeSXmOffxktGnHKIqywcNv4HybJbrC_vzHYAm1ddgiYyCAuBDRspTBM&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=2d8a8ce75c7ca037 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA4hugY_j6cLjsTq6ItB7G_7FlPQ9OasBoDJZI-uCF-q987pjHxm_7YGCRPVqOpYpw0ppSeNrVqJoqqm8xchQuabGTkM6aSjP-BS9CdlR7vK9V1cTgmj0DyYvHLV4aeRchnWmVXlCpfs6vZ_2UaD9uosQ-VQZmNKVoD1Rayxmqe25qq4nKvjQt97p5TjWMzvSoCMOLwq&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=d8fb9f57db980dec HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA6DWEmokBLWnQOYm0IsLW2NCAFj1c2miGD5eH2hsSm1OHz49c2N1MxVhKxDDtEEL2zZk2NK1bsbR1AyeFT-vRiVoiZRg1e25gAiEal0mju1vKctIGQ_5UdkqDGfcfqrme1y35dXtXt6qAOzD9phZba08Uo-Ffyw9mQ7k5rKJ135QuOWdPWi6ZyqtYbh6-oY7luoLg26&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA6DWEmokBLWnQOYm0IsLW2NCAFj1c2miGD5eH2hsSm1OHz49c2N1MxVhKxDDtEEL2zZk2NK1bsbR1AyeFT-vRiVoiZRg1e25gAiEal0mju1vKctIGQ_5UdkqDGfcfqrme1y35dXtXt6qAOzD9phZba08Uo-Ffyw9mQ7k5rKJ135QuOWdPWi6ZyqtYbh6-oY7luoLg26&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=2 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: unknown

HTTP traffic detected: POST /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 9688sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-protobufferAccept: */*Origin: https://www.google.comX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA

Source: chromecache_140.16.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_140.16.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_140.16.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_140.16.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_140.16.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_140.16.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_140.16.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_140.16.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_140.16.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_140.16.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_140.16.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_140.16.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: chromecache_137.16.dr, chromecache_140.16.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_140.16.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__.
Source: chromecache_129.16.dr, chromecache_137.16.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49743 version: TLS 1.2

Source: classification engine

Classification label: clean2.win7Z@31/52@2/3

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_03
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6940:120:WilError_03

Source: C:\Windows\System32\OpenWith.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1896,i,2522147141678714913,16162524076685256105,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1896,i,2522147141678714913,16162524076685256105,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ninput.dll	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Documents.7z

Static file information: File size 13680741 > 1048576

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe TID: 6944	Thread sleep count: 71 > 30			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe TID: 6792	Thread sleep count: 49 > 30			Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Rundll32	Security Account Manager	11 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://recaptcha.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	64.233.176.106	true	false		high

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7zi&oit=1&cp=3&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/recaptcha/api2/userverify?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA5EkBAPcMOv8LoW-z9oBGkRrNwkqmrtq_175ZiAFCWhI-dyfruxwN0EDtkBtrIe45FR2B35vqjequ9u7h18hT0EZgUvvCNumA3qqc1Nn-xqxq27UAv_m_wGsMefQh0-uUR_Pqw0MRFz6NSBUxRcoRoZXH2Q2wOpxOB1syaPENODsWo-xZ2DDegCQOWtGbJF25CD4XKk&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=ad1303f5874012dd	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC	false	high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA4frbWer0wKH0ZR6C82DbZps44nKxyxai6240hzAEw4slWjXUVJ3G1AUW3Y7SCTq-LwA_ygKzzLxwJlUwqwNlcl3_wi5JOCrgtg40cH6DJGZ1KhngUVXVffYTbAGm5AhZKzZt9feWlVBAu2j2Kye-blWt3VyTeXfK2TkZ7U2m_pU2d80hjh4I5LRFeyCpD9IVa-f_I9&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=58248a340f3c879f	false	high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA6zzF3weexsGQsiWg04-ruhQ_tnzyde1vKlIfQTjXALVxjLUHt7ksR07qCbedVXCdf7altNdSUGcUkuXTtpWJYU1TmqYTGYMjngvfu5iz-u-r_yqaBbwk7wABh0-URfontoaNLPwu0FJLJ3KzNq-OXDV7kkFUISOHGokyjqXj72tyoda8Fi-G9Z9RyFs1grPBTrsdf7&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/favicon.ico	false	high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA6DWEmokBLWnQOYm0IsLW2NCAFj1c2miGD5eH2hsSm1OHz49c2N1MxVhKxDDtEEL2zZk2NK1bsbR1AyeFT-vRiVoiZRg1e25gAiEal0mju1vKctIGQ_5UdkqDGfcfqrme1y35dXtXt6qAOzD9phZba08Uo-Ffyw9mQ7k5rKJ135QuOWdPWi6ZyqtYbh6-oY7luoLg26&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRRtTk0GObihLEGIjAI7DtiS_GiN5bc9NLEssGbsC0oLSesQcn1J6SH9zJpOTjdzgSOLpnIbu-Pxo5sr8MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/recaptcha/api.js	false	high
https://www.google.com/js/bg/IsHUla7t4cK5kOAb6cwcBiPQ5HnUjMTZuq5wUJJd2UM.js	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRRtTk0GObihLEGIjCjYMa1_LGDVbrC5SvJmZkMYhY0iukalt9_KGlWf27Rj0MpZxY-3zG0gN8CvSCy_K8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7zip&oit=1&cp=4&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26oft%3D1%26pgcl%3D20%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgRRtTk0GObihLEGIjDQR5zrL8Z8FIe--7JmhwAOhhfkAQgrLLC7_vpIQAglsXqdjDqfhIkPDrbvTHmKgCIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/search?q=7zip&oq=7zip&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8	false	high
https://www.google.com/recaptcha/api2/replaceimage?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA4hugY_j6cLjsTq6ItB7G_7FlPQ9OasBoDJZI-uCF-q987pjHxm_7YGCRPVqOpYpw0ppSeNrVqJoqqm8xchQuabGTkM6aSjP-BS9CdlR7vK9V1cTgmj0DyYvHLV4aeRchnWmVXlCpfs6vZ_2UaD9uosQ-VQZmNKVoD1Rayxmqe25qq4nKvjQt97p5TjWMzvSoCMOLwq&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=d8fb9f57db980dec	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7&oit=4&cp=1&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7z&oit=1&cp=2&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA7ZXw9uOkzALS2kTLha29HPHU16TQlZMx1pKUQ_7wrrt-sofC93B5Gzs09quO4b5SQJHCmYHReXfi5VGgdKJJAbCbCk-tgCCtCpA6KflzJKIdpjmWKDksHG1uX8pTnEgx7MlhKw9QEWgFjprGJNpLH_qpjPuN2JS_Cw43bf-dyuoA8h0Z5tkw6aMn_Crw32vrySkE60&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=9747b01ef597c89c	false	high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA6DWEmokBLWnQOYm0IsLW2NCAFj1c2miGD5eH2hsSm1OHz49c2N1MxVhKxDDtEEL2zZk2NK1bsbR1AyeFT-vRiVoiZRg1e25gAiEal0mju1vKctIGQ_5UdkqDGfcfqrme1y35dXtXt6qAOzD9phZba08Uo-Ffyw9mQ7k5rKJ135QuOWdPWi6ZyqtYbh6-oY7luoLg26&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=2	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_140.16.dr	false		high
https://support.google.com/recaptcha#6262736	chromecache_140.16.dr	false		high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_140.16.dr	false		high
https://recaptcha.net	chromecache_140.16.dr	false	URL Reputation: safe	unknown
https://www.apache.org/licenses/	chromecache_140.16.dr	false		high
https://www.gstatic.c..?/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__.	chromecache_140.16.dr	false		low
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_140.16.dr	false		high
https://cloud.google.com/contact	chromecache_140.16.dr	false		high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_140.16.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_140.16.dr	false		high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_140.16.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_140.16.dr	false		high
https://www.google.com/recaptcha/api2/	chromecache_137.16.dr, chromecache_140.16.dr	false		high
https://support.google.com/recaptcha	chromecache_140.16.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
64.233.176.106	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428205
Start date and time:	2024-04-18 16:41:40 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Documents.7z
Detection:	CLEAN
Classification:	clean2.win7Z@31/52@2/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 69.164.42.0, 142.250.105.94, 173.194.219.84, 172.217.215.101, 172.217.215.100, 172.217.215.139, 172.217.215.138, 172.217.215.102, 172.217.215.113, 34.104.35.123, 74.125.138.94, 142.250.9.95, 142.251.15.95, 142.250.105.95, 64.233.185.95, 74.125.138.95, 173.194.219.95, 64.233.176.95, 172.217.215.95, 172.253.124.95, 108.177.122.95, 64.233.177.95, 74.125.136.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Documents.7z

Simulations

Behavior and APIs

Time	Type	Description
16:42:08	API Interceptor	2x Sleep call for process: OpenWith.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://recouvrement-assurance.fr/LKeZL	Get hash	malicious	Unknown	Browse
	https://recouvrement-assurance.fr/LKeZL	Get hash	malicious	Unknown	Browse
	https://t.airgears.org/r/?resource=120958450/4d9ac80/2a1170&e=dYRtX3NhcXBhbXduQUFjYW4kb26DYXK0LWQzJnV0bW9zb3WyY3V9YWNkJnV1bV9uAWRpdZ09ZW1ibWwmd39udW09OUT3MTNwMzQzMUYmd391cj0zJm1pX4U9eW5kZWApbmVlJmNpZD2yYURNNzV0NDgmYnlkPUE2MjBzN&ref_=1wy&ref=98k/&u=4jj4/&eid=xekc6v/DU5MjEnc2VoY29lZT11cmRlZnluZWQ&s=obI3r-q7de3Me3nnN3cpKfiix7CULJmXF7FuunFtjSx	Get hash	malicious	Unknown	Browse
	https://assets-gbr.mkt.dynamics.com/63445ada-d6fc-ee11-9046-002248c656ac/digitalassets/standaloneforms/4f16ddf0-7afd-ee11-a1fe-000d3ad499fa	Get hash	malicious	HTMLPhisher	Browse
	http://wechatunsuscribe.secure.force.com	Get hash	malicious	Unknown	Browse
	https://www.gourmetgirlsglutenfree.com/?utm_source=google&utm_medium=organic&utm_campaign=gmb	Get hash	malicious	Unknown	Browse
	notepad.txt	Get hash	malicious	HTMLPhisher	Browse
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FC2educate/aEFQv26188aEFQv26188aEFQv/anVsaWUubG9uZ2lub0BjMmVkdWNhdGUuY29t	Get hash	malicious	HTMLPhisher	Browse
	http://www.groweralliance.com	Get hash	malicious	Unknown	Browse
	https://u2355257.ct.sendgrid.net/ls/click?upn=u001.4YkCuNYTF3S1epm9KijHzHFfZe6RGn3F0umQQjG6fIb5h6U0n3Lap6J1hKqXi7Fiss-2Fnjz-2BcFRXpypvRmmfgWqO0slZGlTTOeSsAA0pI8tdrm-2F1TCZGVrUbz-2Fug83KSKfjVn_Ft8eY2PHa1awfrORAsIR9w84lhfuPmqFjQmDsVAH8hyK2jxcX4jAHKq6a8hoGITMOqGD3YxOAS6UCxAb-2BxR3uPyYHHRtPZbwpb00CqcBOzR0Iu2K8fB1VT-2Bkwb9kHAJPdhdLZAJG1dWDxv-2F3y0btEt8yJNPNzau03REICjJd-2BfU8x2dosq7VBZS-2BuuDa4hO6i8I2R8aw54LzuuGTyfjItw-3D-3D	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://recouvrement-assurance.fr/LKeZL	Get hash	malicious	Unknown	Browse	184.31.62.93 20.12.23.50
	https://recouvrement-assurance.fr/LKeZL	Get hash	malicious	Unknown	Browse	184.31.62.93 20.12.23.50
	https://t.airgears.org/r/?resource=120958450/4d9ac80/2a1170&e=dYRtX3NhcXBhbXduQUFjYW4kb26DYXK0LWQzJnV0bW9zb3WyY3V9YWNkJnV1bV9uAWRpdZ09ZW1ibWwmd39udW09OUT3MTNwMzQzMUYmd391cj0zJm1pX4U9eW5kZWApbmVlJmNpZD2yYURNNzV0NDgmYnlkPUE2MjBzN&ref_=1wy&ref=98k/&u=4jj4/&eid=xekc6v/DU5MjEnc2VoY29lZT11cmRlZnluZWQ&s=obI3r-q7de3Me3nnN3cpKfiix7CULJmXF7FuunFtjSx	Get hash	malicious	Unknown	Browse	184.31.62.93 20.12.23.50
	https://assets-gbr.mkt.dynamics.com/63445ada-d6fc-ee11-9046-002248c656ac/digitalassets/standaloneforms/4f16ddf0-7afd-ee11-a1fe-000d3ad499fa	Get hash	malicious	HTMLPhisher	Browse	184.31.62.93 20.12.23.50
	https://www.gourmetgirlsglutenfree.com/?utm_source=google&utm_medium=organic&utm_campaign=gmb	Get hash	malicious	Unknown	Browse	184.31.62.93 20.12.23.50
	http://www.groweralliance.com	Get hash	malicious	Unknown	Browse	184.31.62.93 20.12.23.50
	https://u2355257.ct.sendgrid.net/ls/click?upn=u001.4YkCuNYTF3S1epm9KijHzHFfZe6RGn3F0umQQjG6fIb5h6U0n3Lap6J1hKqXi7Fiss-2Fnjz-2BcFRXpypvRmmfgWqO0slZGlTTOeSsAA0pI8tdrm-2F1TCZGVrUbz-2Fug83KSKfjVn_Ft8eY2PHa1awfrORAsIR9w84lhfuPmqFjQmDsVAH8hyK2jxcX4jAHKq6a8hoGITMOqGD3YxOAS6UCxAb-2BxR3uPyYHHRtPZbwpb00CqcBOzR0Iu2K8fB1VT-2Bkwb9kHAJPdhdLZAJG1dWDxv-2F3y0btEt8yJNPNzau03REICjJd-2BfU8x2dosq7VBZS-2BuuDa4hO6i8I2R8aw54LzuuGTyfjItw-3D-3D	Get hash	malicious	HTMLPhisher	Browse	184.31.62.93 20.12.23.50
	http://Doggygangers.com/YfMv2QsjpCQl845BWSYNfNOQitweyze_Z6lIlrRr43MRjX_HrM/get_download_file_name.php	Get hash	malicious	Unknown	Browse	184.31.62.93 20.12.23.50
	http://Doggygangers.com/YfMv2QsjpCQl845BWSYNfNOQitweyze_Z6lIlrRr43MRjX_HrM/update_counter.php	Get hash	malicious	Unknown	Browse	184.31.62.93 20.12.23.50
	Bill-Transcript_6ZB6-IJYD3B-SEH0.html	Get hash	malicious	Unknown	Browse	184.31.62.93 20.12.23.50

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 13:42:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.984611261364816
Encrypted:	false
SSDEEP:	48:85OdOTqquHOidAKZdA1FehwiZUklqehhy+3:85Tvniy
MD5:	2BA0E8E279A4CF8A1516AA7ABF7B724E
SHA1:	453B8DAE659C3CCDB5D5E035D10E56ADFDAB3F23
SHA-256:	1873CFEF9DBB19517EFBC6F735553CF7D3DE2B0C49FEF11961B469A738C3401A
SHA-512:	A814D4C6DB5FB01763C2279C91A1AED467C1F2A405A073E42AF73735C7230B4D530706DD876953F1C6E6E687545A335B0CB6B666F30D89D0A33DB6137F271134
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....F.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X;u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XVu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XVu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XVu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XXu...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a[.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 13:42:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.001747355847028
Encrypted:	false
SSDEEP:	48:8bOdOTqquHOidAKZdA1seh/iZUkAQkqehSy+2:8bTvR9Q/y
MD5:	BACDF3DC111FBE317F785ED4A5BE6C4C
SHA1:	7C712D0D4E21CE3AC31F40382B0DE35F3FFC08B8
SHA-256:	E524651E092DF8B4F5596D45FF89F65435220762E286D121576EA4E676397068
SHA-512:	521A647D5BF47D8371F0CCEAA4041A3BC090B858C51862A4D3BA3E02904A51ADFE09A36BF4E94F34DB358EE75D408E14F2CBC82149AE2420C3EAD3DB32964679
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,..........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X;u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XVu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XVu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XVu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XXu...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a[.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.006945322530149
Encrypted:	false
SSDEEP:	48:8XOdOTqqAHOidAKZdA14meh7sFiZUkmgqeh7sgy+BX:8XTv/nmy
MD5:	B937D4F6C25A9F5A489234FA143F2F10
SHA1:	08CB59328B555A6B555AD0BCAB1CD8DB9A2F4CB1
SHA-256:	68F193EF0696232D15B5D716B5C02DA2E413337ACCCC107F14DAAE8AAC57AF39
SHA-512:	2DE4CE063028493D8A779B89B75AF0B8389559E5EB2EE4C905901D7E4F4EB3ECEA85303B1DF41C8C4D52FA8F24CBB2AB43C68A2FB3084CE4DEC2362127CBF372
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X;u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XVu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XVu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XVu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a[.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 13:42:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9990292297751933
Encrypted:	false
SSDEEP:	48:8yOdOTqquHOidAKZdA1TehDiZUkwqehuy+R:8yTvioy
MD5:	8277B1C93D857B7AFA61BD379A16C058
SHA1:	CA2F68C6D5E0B37F295BE5113DF66AC6CB4F24A5
SHA-256:	733982395FDA89D76C2199BF7B546F55F2A5C87A20FA9844F15659CF124D9746
SHA-512:	FF3E01739631C2BBDE281758B668184311361315B673DD935E6D065350BD19925984FD2497CDB7A7343FDF24A55B3C4F1566C84FA043C0AA841E4E75B412AF2F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X;u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XVu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XVu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XVu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XXu...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a[.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 13:42:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.986147247967806
Encrypted:	false
SSDEEP:	48:8POdOTqquHOidAKZdA1dehBiZUk1W1qehEy+C:8PTvy9ky
MD5:	C66E589D4370172874566EBE02EB852C
SHA1:	8DDD8FC6893E43B978C009C8966E876EDE81E6F6
SHA-256:	05B56C686F7B9B6413640529F8363DD9F3E613AB977D55D0E43C29F64B674603
SHA-512:	86C3EB3977063818A10931FE074A3A36C4A5857C58F2B72DBDFF9F7F8ECCF998FB6983AF5188E7E86903C8ABAD5A1ABF291BE4E1ED03AD9BEAC8E2456E6B58FD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....n......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X;u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XVu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XVu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XVu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XXu...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a[.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 13:42:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9976567086213044
Encrypted:	false
SSDEEP:	48:8YOdOTqquHOidAKZdA1duTeehOuTbbiZUk5OjqehOuTbmy+yT+:8YTvoTfTbxWOvTbmy7T
MD5:	44141C2BE432132F4740B0AFF16E9BB5
SHA1:	CD4D3DDAFD75628B94FD959147792A7E2BF91FFB
SHA-256:	5BE9969858269F9088A0E9F055EB9B20057C83AD6A264D020AE760C512F2A397
SHA-512:	880C47DB32675876ABC6CB37466E35D39B180F56504F62FEF50011D2A32107DBC4BEFD00E65B70351FC390508F76A2EB6990660EDCF6639C65B77C7C7B4C105F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....!......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X;u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XVu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XVu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XVu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XXu...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a[.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56412), with no line terminators
Category:	downloaded
Size (bytes):	56412
Entropy (8bit):	5.907540404138125
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKYlebyBblxRx54PHSGdXXwW7MFWwXVuE2:4UcW6v+0BbchXwW49z2
MD5:	2C00B9F417B688224937053CD0C284A5
SHA1:	17B4C18EBC129055DD25F214C3F11E03E9DF2D82
SHA-256:	1E754B107428162C65A26D399B66DB3DAAEA09616BF8620D9DE4BC689CE48EED
SHA-512:	8DC644D4C8E6DA600C751975AC4A9E620E26179167A4021DDB1DA81B452ECF420E459DD1C23D1F2E177685B4E1006DBC5C8736024C447D0FF65F75838A785F57
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.928019308351512
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKSbtQP5mwjWaee:PLKdXNQK+QP51L
MD5:	C193745DEB63FE67F3AA6B578C40DD99
SHA1:	8A3ECC2696074E71D3B011C99B98CB25229E1A31
SHA-256:	D41E076366E4207D57A5FD1725C2024F751C43AE4A3A8E93CC46DFB8462A3E5B
SHA-512:	A2FD9573CF80C9D14F9DCEAA1940407E88F7B35BDD01B1FF34891929DC5528A134E851B29CC2205EF8CE5F81A8DFAFED5D7A6A93A304C7B8844981844BA73A8E
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__en.js');

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	1954
Entropy (8bit):	7.707553977882687
Encrypted:	false
SSDEEP:	48:IvmuERARglZW+4o0ZJKUw9qZlyy9BmeFvXBeeJ5:yErZlr0Z4/IN9Bme/BpT
MD5:	49640F29CA25B8F2501A581AD7A18E94
SHA1:	06903A53EAB21BBDDFBEC0C2507EE49B22C81374
SHA-256:	D2E9E7AF7200401B2911FE18AB3D39E734D6DA3186BD3AD7A0BAA4BD812F0396
SHA-512:	0EAF46AA759A42211182F17E4A2BF9E151BB8C911CCBC184EF09D906D8457C01DF3D914029FF4E3AD2408B8BF1E5ED7436BACB52A19924C4F150FF0823768730
Malicious:	false
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA49y5mejDfIItLfORTrCWMpwtXejgU5GCv958_nqMD5Zxylr-6zIx65ExHw1tpmotQ7Id4J-fYyfd4cyx0F-qJ09jcF7FAlBQXoal_B73_uydDY-r5s-DHQcgc0N5SMXpZpKkEPIZN4QyJ_FZeSXmOffxktGnHKIqywcNv4HybJbrC_vzHYAm1ddgiYyCAuBDRspTBM&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=2d8a8ce75c7ca037
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...5,c.T%.=..F%..(,1Q.....W.ok,.D.A.....A.#.AW-.....o6....A8... ...Z..".4..i..0i.1..S...)x..`QN..w....N...?.'...h..QU.J_34..z{>..#.\..=A;.....T...?....."..j@..&.j0...!.(U..85..w..=..zQPy.y...=...h....Z\.O...\D.4..F...=sE.2..n...!V.U-4.\g.{...{...a...f.F[..K{.Xqc.q.....4\.JU.../..v~c....L..}.}....x.x.pj..@;q....`F.j3....).G...M..+T....I..4\,S.X.q...=Y&.i...G..

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	5964
Entropy (8bit):	7.910902995162395
Encrypted:	false
SSDEEP:	96:yE9/ubSa5kYPAr5E130JUG2Kb4EBwPKAP8+RA2qkMshnLyKpTTYuENEWFf3:y62mMboVW30Jd2KMEBELxRACLyWTYVjd
MD5:	FD90B6A90D410238D537B6B4F2FB11CC
SHA1:	9DD6BDF36AF163ED9CF3B6C2250CEB0BC5CC50B1
SHA-256:	FDD8946F387DB7C482AC561EB3AD3571364D180082D50337E07BBB7A87499BCC
SHA-512:	6D454426DADDC0818A746C6050C154B8A7C276C62AF109E2FA4C54D3CDC36996E284B1D65A5D84E9AA7A3C6A02AFE402593D72F84FF98894E8823C84B60CA2F7
Malicious:	false
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA4frbWer0wKH0ZR6C82DbZps44nKxyxai6240hzAEw4slWjXUVJ3G1AUW3Y7SCTq-LwA_ygKzzLxwJlUwqwNlcl3_wi5JOCrgtg40cH6DJGZ1KhngUVXVffYTbAGm5AhZKzZt9feWlVBAu2j2Kye-blWt3VyTeXfK2TkZ7U2m_pU2d80hjh4I5LRFeyCpD9IVa-f_I9&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=58248a340f3c879f
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....1HdX..H...d.....8..:S.h.H.-...`B.q.qP...#.~v.aV.ktU......C..X.......~..{9". .)X).+..r.G=.-.##.'...$.....]:....B.k.#.a.P..y.....2}0;.l..D.Q>......8$.IR0.........s$..!...a..U.........E3..`.C.M..9.I.'.>n....\|......KM^...O...r6...I8.r.#.px.N.z......y.0..$.x....%.:.I..O.f.[w@F...R...$.....\|....n._......A.p......N2........4n..W.>....(Ml..t....,dy...).s.....89

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	5500
Entropy (8bit):	7.900162982960254
Encrypted:	false
SSDEEP:	96:yEKpHaz5xPn9rXBL/lL6Pc/8yEx7PrtCr3BrgC4l0xw:yVZU5XXBL/lWk/lEx7P4zBRw
MD5:	1D3B0F948E3FBF5F108D4288F7EB912A
SHA1:	3263316CA47EA597BC7FF6571B6999324CC69AB0
SHA-256:	681E7CC516B2D8ADC1DE26FC4DFF7AB3F69E380B9257267EB8C0475B6417A6C8
SHA-512:	97CF4C33D5E08EEE59A84950DDF26A43649455FCA5EC08F249E0C61858C89D49592372DDCB21ADEB7C8ACA7F9DBBF82A93D9026981FBED7B95729B3C15D4A640
Malicious:	false
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA7ZXw9uOkzALS2kTLha29HPHU16TQlZMx1pKUQ_7wrrt-sofC93B5Gzs09quO4b5SQJHCmYHReXfi5VGgdKJJAbCbCk-tgCCtCpA6KflzJKIdpjmWKDksHG1uX8pTnEgx7MlhKw9QEWgFjprGJNpLH_qpjPuN2JS_Cw43bf-dyuoA8h0Z5tkw6aMn_Crw32vrySkE60&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=9747b01ef597c89c
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......%...T.../....H.pwg....a.{.1....!.s.......b.O..wE.X:...ss...c'..5..?...dRB....u....s.O..6.?........_.n........R.....\|...0.O.=..}.}..5.g....$....\.......%;.D..UE.2w.....g.....1l-.....v....\w..s.3.3..o%.w..../....~%...X..a...R}?w....H....Z.. .....Y.w.F.G....NO..jx...l...(....d;\..~C.>`>.z..Z...f.......!.. .?....M.%n......%}Z..}.5i.b.xeFG.$.P7}.r:...@.....R.R#

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17688)
Category:	downloaded
Size (bytes):	18283
Entropy (8bit):	5.647651525005327
Encrypted:	false
SSDEEP:	384:xz0pAgPpP7gxzDQ8uXM1kEaTLl0BzTj9KL0jQpPBr1eaetrbWjowdFu0:QAk2OXpib9+0jgPBQaet+E8
MD5:	193FAF4CCBFF651AFBDAB44C730688E6
SHA1:	D0F7A7137497933524C9C1ED7CB2347BF2C0419B
SHA-256:	22C1D495AEEDE1C2B990E01BE9CC1C0623D0E479D48CC4D9BAAE7050925DD943
SHA-512:	BCC7AFFD07786235EBA5C39A9A2BECCBDF2E8A70C832E5718829EFC7D8407E5ECC993AD751EEDDFA5B8A98D99E6CA40CCDC1E97D6ECD22E607E58C486C86E5A1
Malicious:	false
URL:	https://www.google.com/js/bg/IsHUla7t4cK5kOAb6cwcBiPQ5HnUjMTZuq5wUJJd2UM.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var f=function(F,Y){if((F=(Y=x.trustedTypes,null),!Y)\|\|!Y.createPolicy)return F;try{F=Y.createPolicy("bg",{createHTML:g,createScript:g,createScriptURL:g})}catch(U){x.console&&x.console.error(U.message)}return F},g=function(F){return F},x=this\|\|self;(0,eval)(function(F,Y){return(Y=f())&&1===F.eval(Y.createScript("1"))?function(U){return Y.createScript(U)}:function(U){return""+U}}(x)(Array(7824Math.random()\|0).join("\n")+['(function(){/',.'',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var Fh=function(Y,F,x,g){try{g=Y[((F\|0)+2)%3],Y[F]=(Y[F]\|0)-(Y[((F\|0)+1)%3]\|0)-(g\|0)^(1==F?g<<x:g>>>x)}catch(f){throw f;}},Y0=function(Y,F){return[function(){return Y},(F(function(x){x(Y)}),function(){})]},x0=function(Y,F){if(!(Y=(F=Q.trustedTypes,null),F)\|\|!F.createPolicy)return Y;try{Y=F.createPolicy("bg",{createHTML:UI,createScript:UI,createScriptURL:UI})}catch(x){Q.console&&Q.console.error(x.messa

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, components 3
Category:	downloaded
Size (bytes):	42644
Entropy (8bit):	7.9567762026359885
Encrypted:	false
SSDEEP:	768:at8/+fXUm6FyY7vPu1utR2+NdT1TkEwQYR7NxiXeNTHsx38hMrPg5OL3dcq:attUm6EIqn+NdTm3QYRZxPVsB8mrZLeq
MD5:	BB39EB799B80671474A389DD10C59033
SHA1:	7BCF4982140F02360F5D3282E0170575F82BAB40
SHA-256:	3BCE9DED7BFF4963D08F48D1531CCA63A4477C7C7FC3C03DB72A7976661552C2
SHA-512:	A9FEDD0220E02CDD10F0AE024D3E82456834670D2DBBE99F8EE608C95F485AB86D8F951FCB4E396DAB688266B92E5E71FDA4F81EA66FF2E2C0E8F60C08724C7E
Malicious:	false
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA6zzF3weexsGQsiWg04-ruhQ_tnzyde1vKlIfQTjXALVxjLUHt7ksR07qCbedVXCdf7altNdSUGcUkuXTtpWJYU1TmqYTGYMjngvfu5iz-u-r_yqaBbwk7wABh0-URfontoaNLPwu0FJLJ3KzNq-OXDV7kkFUISOHGokyjqXj72tyoda8Fi-G9Z9RyFs1grPBTrsdf7&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................,.,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....X..c....r...S.......x..Z\]....'.Y. .X.....1..#M...I.2j...Y%..n$.@8..=O'9...A.d.K..C...l',......unz.........Mk.....{..%.D}>..N.]...E,0.....<d.CDa..C...9......N.u.._V...v.-gy........7ewm'....y..X.;4....b.1 ..Xt.^..G.ZT..6...Vr.....?.B.6.,..^5w%K...'!v..6.o...%..2.X.T....r........j.QI*.K...dq.m..v.......x...~.k.......O.{.H..H.;NA..z.7..>....t

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:	12:6v/7OEUelyuRs56fyKgIEInu5VLJBZInmJhd/3VqQXD8GBm1:belFRs56fuIEIu5VNBZInMTICfBO
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/info_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1222), with no line terminators
Category:	downloaded
Size (bytes):	1222
Entropy (8bit):	5.820160639060783
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCLTLv138EgFB5vtTGJTlWtX5l1A4fsLqo40RWUnYN:VKEctKonR3evtTA8h1mLrwUnG
MD5:	E9AD011280352C75C6F9CF212C42AACD
SHA1:	05A41AC3A9E296E1D9E6251E6908EABFE9697D04
SHA-256:	B5E1FFD95251B13685BD867DFB1759CEB8DE9E5FB874E052C856022B29DDA862
SHA-512:	3FEFD42D4070B6BCDBC59C54CF45D48273B740604E3AE4428DA23E092709C970575204DA64D19EBC14A555ADD41CA32D2CE3912B043FEC51017FD901E3EC5D9B
Malicious:	false
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-A236J/ZUgU+0/O6b/VC6BQicPcdW8QQ1ITyp6reT

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3
Category:	downloaded
Size (bytes):	61037
Entropy (8bit):	7.975894074348612
Encrypted:	false
SSDEEP:	1536:e1cHxMYqvThuYnUJRkp+/Sp44YSGPvcCyytbf1:CcRaqRy0SphYS6vcCdN1
MD5:	365489D7311410DF71E31995B84EDC03
SHA1:	99050E09C052BFB6A4C79975601F384127F95BBE
SHA-256:	024DF123E892D3B54B5170B2E30DE52C4E819634AEA4CAA427893B4B5C5BAD24
SHA-512:	2ED3DEF88EAEA86426887A365A8479E1EBD92606CDF3458E99D4551810558BBC1A6C30C602607B2B66C6375E4C457F3B14DFCFD2AAE99E5329FA3AD62D79D49F
Malicious:	false
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA6DWEmokBLWnQOYm0IsLW2NCAFj1c2miGD5eH2hsSm1OHz49c2N1MxVhKxDDtEEL2zZk2NK1bsbR1AyeFT-vRiVoiZRg1e25gAiEal0mju1vKctIGQ_5UdkqDGfcfqrme1y35dXtXt6qAOzD9phZba08Uo-Ffyw9mQ7k5rKJ135QuOWdPWi6ZyqtYbh6-oY7luoLg26&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=2
Preview:	......JFIF.............C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..[Nba.Z..'.^LK..X.....w'........tj.R.n-.!.C+..A..R....Z.i.+....8.OV?d.6J....r.#.....+.\|=..b...%.!.<...S..q.k..b...D.0..b.... .........:..O...U.e.?2.s.H#.z..........U..H.l..$....H.F.p.p9...........Y..E..o.........d...:.u....k....ci...b...{...H....PX^xsZ..-.Uyb.......o...........Y.!....2.n.....~'....5....^.3../...o....c.o....5..F..........mG9.$..]suml..n!.}

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (597)
Category:	downloaded
Size (bytes):	518479
Entropy (8bit):	5.683759340720687
Encrypted:	false
SSDEEP:	12288:wTJtYdv7tmjTEyw+Z8ML8Vo1ukBO1N34PS+H7wIqBG7iIXXON2R+:kEcLVuN2R+
MD5:	8326C23D6B3EED35BC3E62F3294587FD
SHA1:	EDDA17E74E53E85073E5EAC9CB6BE2163DBFA23C
SHA-256:	57F03D3BA66117EDC152646341120DD3A1D7D71B9A98A3723AF5A8AE61BCB3AB
SHA-512:	F63FAEEA0ACCAC3FA74CF6168B319D901EDE869A83E7E6129158A120008E70E5B239BBBFF3159917F8AEEFCF997916A778AE21900B22035657E05AAAE9EBAAC0
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././.. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././*.. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that contro

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:	12:6v/7OEUT9vceKKNtY3kM8O+mucROzZbJOAjPBE2Iq8AnxT9:bTdcVIM8tfHzzjy2IdKT9
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/refresh_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0
Category:	downloaded
Size (bytes):	15340
Entropy (8bit):	7.983406336508752
Encrypted:	false
SSDEEP:	384:F2gPJde0V2iGrQyD8b3k/tigCdeNqOUd47SH0tsGm:4gPVV2NQE8b3ldeNWH0Wb
MD5:	19B7A0ADFDD4F808B53AF7E2CE2AD4E5
SHA1:	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA
SHA-256:	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
SHA-512:	49DA16000687AC81FC4CA9E9112BDCA850BB9F32E0AF2FE751ABC57A8E9C3382451B50998CEB9DE56FC4196F1DC7EF46BBA47933FC47EB4538124870B7630036
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Preview:	wOF2......;........d..;..........................d..z..J.`..L.Z..<.....\..`..^...x.6.$..6. ..\|. ..8..z%......Q.{..q...FF.kd .8.(..d..).!C...Y.JA...r. ..GH8F......nW...".2&....2<..+C...p...b..SC.......J......z.-..Q..#6&1zUe../\...l.....<.....9s...E~.]B-..B.wY..o......Q..A.F..1j.......-.`P% .. ,..@1.0..~.....WWW.d.u<c{..^.R.+..w....&.........A......+C....(.N.....0.~..0.J.;.Nu..7....]..m.H.....[h.GL3....?)....c.H...2.3.}y........SXI\|..iVN'%E.D.W....r..<`....i....6;E$.....U.$j.@...._.......R2....WS...k.vz.R.'a9!^...N....h.._.....c.%."..S.2.16B...o.2}.pmU[.\|.LI....2.....OWQLO1-....s..8.(...".\|6...6R.. ..M-.zO.}w)..v..mXxX...c..3#.+.v....F`.Z;.zQ.......r,....Yo.....g.h....+.....O.3Y..)Y.8.!....elX......._.3.}k~u.{ C..H.z..FP........@...d..)T.R...L.H.J.j.@..............$...E......y...3.b...I.h u.+%.HA.\..9..8..X.!....gx...].:..V..C...._..X..!....6..)...GM:E.....O.Z.}k.;.T.k..D.k.O..D5.r..."......?..T.Q.A...CF...3g.5.Dn<.QPy..G..1.9..Q..0..

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	4927
Entropy (8bit):	7.8959920423112
Encrypted:	false
SSDEEP:	96:yEk1tzcLbgf87T2xOE0ImsnNq16GnFg6X5ByzioLalqzxzwQ:yr1cbimWxZRuSg5kGdMwQ
MD5:	B2F6EA50EC8A913F591A5174159E2591
SHA1:	D7F8F13F0ADECECB0E42E04C59FB84DE29F56EA1
SHA-256:	EC8FF631AE5C0D9328BA1E66653219B19FDDE2CE36D3C755769EBEAD1BC7FB34
SHA-512:	AE60C193397BCD20315E764936ABF190571B3C61712332A66E4523F941C5CBF3A84F1CADC832076AB3C56387F921BECDF50654054687FB7E25412093C877294F
Malicious:	false
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA5EkBAPcMOv8LoW-z9oBGkRrNwkqmrtq_175ZiAFCWhI-dyfruxwN0EDtkBtrIe45FR2B35vqjequ9u7h18hT0EZgUvvCNumA3qqc1Nn-xqxq27UAv_m_wGsMefQh0-uUR_Pqw0MRFz6NSBUxRcoRoZXH2Q2wOpxOB1syaPENODsWo-xZ2DDegCQOWtGbJF25CD4XKk&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=ad1303f5874012dd
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...[.Ybx..]......c.rF.q....PKm4..$!V=.A^ws...*.J..5..O#%rq.^.g.J.......=y....56k`......sIs.H.. ..'.......].-.. 7.(6.@cww.~\`.x.......Vl..%C/..z....R........q.#9...{..C.3...;.}..?]..\|......%..%K&r.2...r=s_2..v.C.cT..U-56...,......;..1.....;J!!.`..].~u,........Y.R..G_..T.Y...y<p).M...{.M..[...]D.<wJTG.........7O;9.,...I.'$p9.9....y....y.r...9 ..;s..^.~,x......h..

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	4906
Entropy (8bit):	7.868352194697231
Encrypted:	false
SSDEEP:	96:yEhROhEaLA6IG8xhiyc1E5yExS5IcHNq0yt+jgFoN1WvhTQGmWMm0RK:yCROhVAZxhinE5CVNg+zORQlW2K
MD5:	A7EF61130FF459EB4FCAE4E6BA57A685
SHA1:	C24CCDD144E88B7593CD13D6E1ABA780528BF2C1
SHA-256:	21F5EC5B5E12474B438033683E87EAC62DF87B1196F1D38E3835A81CDBE61A27
SHA-512:	1A2B39109DD96FFBAA25C58F032C910C37199E1989634DC9657005BD25EE07406FE4F9DE0301FB09257CF9414B77DBEF87CC78E361C29B55DB3B3B3ECB84DE6B
Malicious:	false
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA4hugY_j6cLjsTq6ItB7G_7FlPQ9OasBoDJZI-uCF-q987pjHxm_7YGCRPVqOpYpw0ppSeNrVqJoqqm8xchQuabGTkM6aSjP-BS9CdlR7vK9V1cTgmj0DyYvHLV4aeRchnWmVXlCpfs6vZ_2UaD9uosQ-VQZmNKVoD1Rayxmqe25qq4nKvjQt97p5TjWMzvSoCMOLwq&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=d8fb9f57db980dec
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....s;..,`.p7...8......5R...v....2..A....\.x.......1H..H[.......z..T..........~..j...)<.3.8.;..Pm..]=u^W.l.$......E.J.s..Rz...~4uV0.)E.P.C9#w...c.......V.x..lm..T...R:.s..Pk.._$..m.....q...y.....Z.......H....[..C...G.fe... f;Al`..9....y..+...J(d.....Fq.....;.^I.....'....T....t..F.au.j0...%..L.F......s...u.:....$wzo..lk....C.;...D#..r.9.....X:...8gf.6$.

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 98 x 90, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	11174
Entropy (8bit):	7.97758318268209
Encrypted:	false
SSDEEP:	192:b4JEM/GnDNmhq6mokMiqF/RhAUYaYL39w/RA1A4m63ux+9Tyv7RyRJgBHWHOYa7z:b4b4ghdiqFJyVpr9A63p9TG0RCZWH/K
MD5:	A4741C6089E163F0E5C0CDB2C698A03E
SHA1:	03B190C8D9350802CBABBCCD2757CFF1FB7115F0
SHA-256:	C9685B413894B0647B42EDF9CAC1FC0B2ED044C1FE238D843B9CA3D29DB1B805
SHA-512:	8F16410EDBC8893D9982CCAA1F2BA73BB1E7189B8101CE8EF3167D4663E5580A0BD2462295052A5DD86FA83AB3A0C4ED889204052951F8C6FA71E564D3EDCAFB
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/canonical_car.png
Preview:	.PNG........IHDR...b...Z...........+mIDATx..O.a.A.3.....@....YY.5`......#B...\|...)F3S..8..H._.......N......v..i..k{D..r..wKhO...V$..XD..(...4]8......t...Q..f!C.{...o.:.sNJ!.~R.....GFG.$.o.a..m...S.a...("..uu1....h......V...).....V...+....@rd9b.. ........5..7.]...........,CD./.......K.; ......v......H..`..$.p.E.I/.{....5....`..........O_...H.c.."G.Jp}LB.....OU.$..%....=..+..P` .....vR..^.._...a. ..vX.LIH..-..F..x.?......bRr..@.1....b...`#.L".........\|....M.8$....IV.9s...;.WL....Q......8..h.....HIje.....a{.......:\...U.."...AYs.f.:.?RU.C5.,......Q.j..y...Nx.J....1.>.>-R.L.>.q?.H;.Z`.o...}...sN....k.........P.&>w.0".u.$.l.W2.q.=I.H......2.......I.H.x..> [.,.t7..$$....W.`..D..#).......sfv..A_.....{....cy-..H.x.U5...Ew`....JxB..\.o..\|........)..?~..D.A/...y0.%.D.;...0.K..d.v......;..x6B...Hg^E.6..~....g...'-.5.].c.[C2.$A.......!..b.d..U..$w:/.$B. )..P....Hq..3.!.l}]y.....`..s>.7.t.P.s.%d..E{M.m.....$.%...v..W..T:-........... 0....D4a".K...

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:	12:6v/7OEUhUxzPKmghSn8nazyk+k8/OzxQcxNMvVb:bhUxzlvWkT8FcxK1
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/audio_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3
Category:	downloaded
Size (bytes):	40322
Entropy (8bit):	7.976323672424713
Encrypted:	false
SSDEEP:	768:e9l2NbWeRP1L5c21YmwL1JdIUo0NYWbvm/E1PlKN0YhX/L3TVMAq1BuJ:eX2zZ5Tfwio+WTNKZhX/rT6Aq1Bu
MD5:	33C29E5E81C4A93662E156D1CD6F5F37
SHA1:	A52EB04E62A333A6BD932E72DEDA378D42B4B369
SHA-256:	2573DB158CF7CF96A96162E8EF3171895AA809E2E3B5C6FB4A919F872D6C0AAC
SHA-512:	7CB95BEE4EB242218A35ADDA15DEE84D5D323C4E5C8913F7594980144DB148FBE394FBB29FC1DA4FA2D255996B4B777ED0D625A5A3EC66137B06D276C304DBD8
Malicious:	false
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA6DWEmokBLWnQOYm0IsLW2NCAFj1c2miGD5eH2hsSm1OHz49c2N1MxVhKxDDtEEL2zZk2NK1bsbR1AyeFT-vRiVoiZRg1e25gAiEal0mju1vKctIGQ_5UdkqDGfcfqrme1y35dXtXt6qAOzD9phZba08Uo-Ffyw9mQ7k5rKJ135QuOWdPWi6ZyqtYbh6-oY7luoLg26&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b
Preview:	......JFIF.............C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.\bP.a{.]......Ly.G..9....3..N{...,h......n9........-1.h..;z......9c.. ...)..?w....0FB./.y.....X.....njVP\....K..\|..\S....UU....x.f.6...Q.`K6X.(=....}84.R....s...RMM.6....wz..\..E<I %.'8...F"=..7s..p..>U.6..>`.!...I..#r/8..4..B.....).....,A.N....V..moz7......k....!T9..R3.n8.....3#3.W...q.W.s...G.....i.Fs...(.O.[.u;....~Km...........'.[.E.. ..{S......=..K.

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk8dqZYMe7mkRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Static File Info

General

File type:	7-zip archive data, version 0.4
Entropy (8bit):	7.999986586701363
TrID:	7-Zip compressed archive (6006/1) 100.00%
File name:	Documents.7z
File size:	13'680'741 bytes
MD5:	a5b3ed5957de557e9ca4669bf306b809
SHA1:	66bd7f7fc6807e5e971420afd6a09bdd3aaa2f40
SHA256:	9c1f16a7649955f194d86d5c3aa88cc7e5b4a6c70a893446e24efcfe9bd4f13d
SHA512:	40f7ed9b251e335abc771bbdbae533f522f6d66fb61697cc3423227a8ac0db8c7252e2c88cd907b33cd3632daa11dad012b5957795a4ced961d93bed089a84d9
SSDEEP:	393216:SDdSTcMfoBQ3VDN4tBOans38vgyqfoxWMol3Q7IM5MhQH05eY:SBSgJBXznssvgyqQxWMol3XMpO9
TLSH:	F9D633D8B35937F2A53E8B26FF11271315A545A0F93A5DD6BA22499BFE0B81F0C73900
File Content Preview:	7z..'.....P. .......%.......A..%...PK.........t.X.'+.W...K.....$.Stardock_Fences_v4.21.7z.. .........)^V2....(^V2....#^V2.......\g.:.Z@...sK...+Cz_.../.R...7gsc..cK.........n8.[d0&.....U..Y-...&7..+.....WN.s.'.oL9 ..0..c.0..........Ad.....{.....-q.^....."

File Icon


Icon Hash:	72e2a2a292a2a2b2

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 16:42:14.569793940 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 16:42:14.873358011 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 16:42:15.477396011 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 16:42:16.681363106 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 16:42:19.088355064 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 16:42:20.899310112 CEST	49701	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:20.899393082 CEST	443	49701	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:20.899523973 CEST	49701	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:20.902200937 CEST	49701	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:20.902230024 CEST	443	49701	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.125274897 CEST	443	49701	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.125487089 CEST	49701	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.131443977 CEST	49701	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.131462097 CEST	443	49701	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.131907940 CEST	443	49701	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.181269884 CEST	49701	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.228116989 CEST	443	49701	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.323417902 CEST	443	49701	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.323591948 CEST	443	49701	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.323707104 CEST	49701	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.323748112 CEST	49701	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.323761940 CEST	443	49701	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.323779106 CEST	49701	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.323785067 CEST	443	49701	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.366462946 CEST	49702	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.366559982 CEST	443	49702	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.366705894 CEST	49702	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.367007017 CEST	49702	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.367039919 CEST	443	49702	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.583925009 CEST	443	49702	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.584172964 CEST	49702	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.585474014 CEST	49702	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.585527897 CEST	443	49702	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.586050034 CEST	443	49702	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.587306976 CEST	49702	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.632126093 CEST	443	49702	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.791080952 CEST	443	49702	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.791256905 CEST	443	49702	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.791357040 CEST	49702	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.792164087 CEST	49702	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.792182922 CEST	443	49702	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:21.792196035 CEST	49702	443	192.168.2.16	184.31.62.93
Apr 18, 2024 16:42:21.792203903 CEST	443	49702	184.31.62.93	192.168.2.16
Apr 18, 2024 16:42:22.734663963 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 16:42:22.848733902 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:22.848795891 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:22.848890066 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:22.850045919 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:22.850061893 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.036402941 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 16:42:23.227073908 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.227185965 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.229873896 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.229887962 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.230386019 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.274368048 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.296396971 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.344122887 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.565443993 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.565481901 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.565495968 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.565519094 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.565563917 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.565568924 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.565599918 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.565617085 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.565638065 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.565659046 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.565670013 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.565692902 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.565715075 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.565718889 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.565742970 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.565783978 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.579679012 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.579704046 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.579715014 CEST	49703	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:42:23.579721928 CEST	443	49703	20.12.23.50	192.168.2.16
Apr 18, 2024 16:42:23.641412973 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 16:42:23.895400047 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 16:42:24.855384111 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 16:42:27.200809002 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 16:42:27.264413118 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 16:42:27.504463911 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 16:42:28.110433102 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 16:42:29.325402975 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 16:42:31.733469009 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 16:42:32.067481995 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 16:42:33.499442101 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 16:42:36.544435024 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 16:42:41.668433905 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 16:42:45.916837931 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:45.916879892 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:45.916950941 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:45.917205095 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:45.917217016 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.135210037 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.135510921 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.135534048 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.136565924 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.136641979 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.137820959 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.137892008 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.138299942 CEST	49708	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.138340950 CEST	443	49708	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.138417959 CEST	49708	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.138535976 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.138603926 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.138672113 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.138695002 CEST	49710	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.138755083 CEST	443	49710	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.138783932 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.138797045 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.138820887 CEST	49710	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.139055967 CEST	49708	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.139071941 CEST	443	49708	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.139255047 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.139290094 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.139429092 CEST	49710	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.139456034 CEST	443	49710	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.146455050 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 16:42:46.178781986 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.355367899 CEST	443	49708	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.355629921 CEST	49708	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.355642080 CEST	443	49708	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.356317043 CEST	443	49708	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.356738091 CEST	49708	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.356828928 CEST	443	49708	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.356894016 CEST	49708	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.357748032 CEST	443	49710	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.357975960 CEST	49710	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.358006954 CEST	443	49710	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.358952045 CEST	443	49710	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.359039068 CEST	49710	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.359401941 CEST	49710	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.359487057 CEST	443	49710	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.359592915 CEST	49710	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.359608889 CEST	443	49710	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.362071037 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.362315893 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.362379074 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.363543034 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.364089012 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.364321947 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.400142908 CEST	443	49708	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.400494099 CEST	49710	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.416474104 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.607424021 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.607598066 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.607670069 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.607729912 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.607780933 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.607844114 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.608710051 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.608748913 CEST	443	49707	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.608772039 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.608810902 CEST	49707	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.610627890 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.652158976 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.717710018 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.717776060 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.717816114 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.717859030 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.717921019 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.717991114 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.718010902 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.718050957 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.718102932 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.718933105 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.718933105 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.718966961 CEST	443	49709	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.719033957 CEST	49709	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.856508970 CEST	443	49710	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.856636047 CEST	49710	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.856651068 CEST	443	49710	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.856712103 CEST	49710	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.857486010 CEST	49710	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.857501984 CEST	443	49710	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.859046936 CEST	49711	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.859086037 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.859309912 CEST	49711	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.859592915 CEST	49711	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.859607935 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.973020077 CEST	443	49708	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.973155022 CEST	49708	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.973185062 CEST	443	49708	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.973368883 CEST	443	49708	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.973433018 CEST	49708	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.973850012 CEST	49708	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.973869085 CEST	443	49708	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:46.973881960 CEST	49708	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:46.973922014 CEST	49708	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.074208021 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.074590921 CEST	49711	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.074623108 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.075084925 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.075470924 CEST	49711	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.075547934 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.075993061 CEST	49712	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.076024055 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.076086998 CEST	49711	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.076348066 CEST	49712	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.076348066 CEST	49712	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.076383114 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.116120100 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.289865017 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.290016890 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.290128946 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.290194035 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.290344000 CEST	49711	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.290344954 CEST	49712	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.290376902 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.290394068 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.290453911 CEST	49711	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.290677071 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.290808916 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.290858984 CEST	49711	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.290879011 CEST	49711	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.290893078 CEST	443	49711	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.290923119 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.291522980 CEST	49712	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.291596889 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.291830063 CEST	49712	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.336126089 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.504925013 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.504973888 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.505019903 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.505076885 CEST	49712	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.505089045 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.505778074 CEST	49712	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.505789042 CEST	443	49712	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:47.505805969 CEST	49712	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:47.505848885 CEST	49712	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.263202906 CEST	49713	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.263288021 CEST	443	49713	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.263431072 CEST	49713	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.263794899 CEST	49713	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.263849020 CEST	443	49713	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.484366894 CEST	443	49713	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.484693050 CEST	49713	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.484755993 CEST	443	49713	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.485873938 CEST	443	49713	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.486191034 CEST	49713	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.486334085 CEST	49713	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.486349106 CEST	443	49713	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.486375093 CEST	443	49713	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.534476042 CEST	49713	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.536602020 CEST	49713	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.536700964 CEST	443	49713	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.536778927 CEST	49713	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.537415028 CEST	49714	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.537497044 CEST	443	49714	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.537599087 CEST	49714	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.537810087 CEST	49714	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.537843943 CEST	443	49714	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.752016068 CEST	443	49714	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.752366066 CEST	49714	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.752425909 CEST	443	49714	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.753439903 CEST	443	49714	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.753526926 CEST	49714	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.753868103 CEST	49714	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.753948927 CEST	443	49714	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.754007101 CEST	49714	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.800146103 CEST	443	49714	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.805473089 CEST	49714	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.805496931 CEST	443	49714	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.807665110 CEST	49714	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.807816029 CEST	443	49714	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.807910919 CEST	49714	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.808526993 CEST	49715	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.808577061 CEST	443	49715	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:49.808665991 CEST	49715	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.808868885 CEST	49715	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:49.808887005 CEST	443	49715	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.027724028 CEST	443	49715	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.028146029 CEST	49715	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.028170109 CEST	443	49715	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.031147957 CEST	443	49715	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.031240940 CEST	49715	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.031609058 CEST	49715	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.031666040 CEST	443	49715	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.031774998 CEST	49715	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.031783104 CEST	443	49715	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.046612024 CEST	49715	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.046785116 CEST	443	49715	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.046860933 CEST	49715	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.047645092 CEST	49716	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.047738075 CEST	443	49716	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.047844887 CEST	49716	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.048053026 CEST	49716	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.048090935 CEST	443	49716	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.265589952 CEST	443	49716	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.265918016 CEST	49716	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.265980959 CEST	443	49716	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.269534111 CEST	443	49716	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.269644976 CEST	49716	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.270111084 CEST	49716	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.270190954 CEST	443	49716	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.270294905 CEST	49716	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.270302057 CEST	443	49716	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.314465046 CEST	49716	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.524777889 CEST	49716	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.524964094 CEST	443	49716	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.525049925 CEST	49716	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.526412010 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.526457071 CEST	443	49717	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.526535034 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.526869059 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.526890039 CEST	443	49717	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.740804911 CEST	443	49717	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.741143942 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.741170883 CEST	443	49717	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.742079020 CEST	443	49717	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.742175102 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.742440939 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.742506027 CEST	443	49717	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.742645979 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:50.742652893 CEST	443	49717	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:50.794506073 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.466384888 CEST	443	49717	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.466451883 CEST	443	49717	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.466521978 CEST	443	49717	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.466536999 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.466609001 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.467144966 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.467166901 CEST	443	49717	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.467190981 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.467235088 CEST	49717	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.470411062 CEST	49718	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.470460892 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.470551014 CEST	49718	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.470777988 CEST	49718	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.470798969 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.690452099 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.690761089 CEST	49718	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.690774918 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.691073895 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.691369057 CEST	49718	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.691421032 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.691765070 CEST	49718	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.736112118 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.902854919 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.902898073 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.902920961 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.902996063 CEST	49718	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.903017044 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.903074026 CEST	49718	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.903563976 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.903624058 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.903661966 CEST	49718	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.904211998 CEST	49718	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.904232979 CEST	443	49718	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.911120892 CEST	49719	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.911173105 CEST	443	49719	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:51.911247969 CEST	49719	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.911638021 CEST	49719	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:51.911655903 CEST	443	49719	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:52.123857975 CEST	443	49719	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:52.124211073 CEST	49719	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:52.124238014 CEST	443	49719	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:52.124691963 CEST	443	49719	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:52.124991894 CEST	49719	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:52.125065088 CEST	443	49719	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:52.125129938 CEST	49719	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:52.168117046 CEST	443	49719	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:52.355387926 CEST	443	49719	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:52.355504036 CEST	443	49719	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:52.355593920 CEST	49719	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:52.356300116 CEST	49719	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:52.356327057 CEST	443	49719	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.463987112 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.464047909 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.464200020 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.464673042 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.464690924 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.676304102 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.676696062 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.676717997 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.677041054 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.677359104 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.677428961 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.677542925 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.677567959 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.919961929 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.920006037 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.920032978 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.920080900 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.920093060 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.920133114 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.920154095 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.927097082 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.927118063 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.927206039 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.927216053 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.927277088 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.934360027 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.939647913 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.939915895 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.939924955 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.943286896 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.944406986 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:53.944415092 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:53.992470026 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.024106026 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.027478933 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.027510881 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.027580976 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.027617931 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.027668953 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.034796953 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.042089939 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.042289019 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.042349100 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.049360991 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.049448013 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.049459934 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.056792974 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.056853056 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.056863070 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.064160109 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.064228058 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.064237118 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.070498943 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.070604086 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.070632935 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.076865911 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.076950073 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.076976061 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.083436012 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.083508015 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.083534002 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.089571953 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.089729071 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.089751005 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.095932961 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.096003056 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.096013069 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.096044064 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.096096039 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.102215052 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.105685949 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.105758905 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.105878115 CEST	49721	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.105901003 CEST	443	49721	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.621386051 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.621439934 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.621514082 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.621756077 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.621767998 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.834561110 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.834780931 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.834793091 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.835231066 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.835519075 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.835601091 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.835899115 CEST	49727	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.835959911 CEST	443	49727	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.835975885 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.835984945 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:54.836040020 CEST	49727	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.836365938 CEST	49727	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:54.836380959 CEST	443	49727	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.054363966 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.054410934 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.054440975 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.054456949 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.054469109 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.054495096 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.054503918 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.054511070 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.054550886 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.054553986 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.055071115 CEST	443	49727	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.055392981 CEST	49727	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.055412054 CEST	443	49727	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.056590080 CEST	443	49727	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.057040930 CEST	49727	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.057212114 CEST	443	49727	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.057216883 CEST	49727	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.057389021 CEST	443	49727	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.061465979 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.061517000 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.061525106 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.068767071 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.068814039 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.068820000 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.076138020 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.076181889 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.076188087 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.108459949 CEST	49727	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.124459028 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.124469995 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.158444881 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.158513069 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.158523083 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.162022114 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.162077904 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.162257910 CEST	49725	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.162276030 CEST	443	49725	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.219794035 CEST	49728	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.219841003 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.219922066 CEST	49728	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.220133066 CEST	49728	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.220149994 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.281829119 CEST	443	49727	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.281977892 CEST	443	49727	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.282031059 CEST	49727	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.283570051 CEST	49727	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.283588886 CEST	443	49727	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.438230038 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.438707113 CEST	49728	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.438730955 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.439899921 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.440274000 CEST	49728	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.440442085 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.440748930 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.440793037 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.440819979 CEST	49728	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.440871954 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.441205025 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.441217899 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.488122940 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.653356075 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.653395891 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.653418064 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.653439999 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.653482914 CEST	49728	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.653484106 CEST	49728	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.653507948 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.654656887 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.654933929 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.654947042 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.655288935 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.655318022 CEST	49728	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.655358076 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.655519962 CEST	443	49728	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.655759096 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.655817032 CEST	49728	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.655817032 CEST	49728	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.655828953 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.656147003 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.656158924 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.710478067 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.897898912 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.897937059 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.897960901 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.898001909 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.898046017 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.898065090 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.898071051 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.899426937 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.904845953 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.907505989 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:55.911768913 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:55.911768913 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:56.221527100 CEST	49729	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:56.221550941 CEST	443	49729	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.055690050 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.055753946 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.055866957 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.056149960 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.056173086 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.269171000 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.269743919 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.269787073 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.270203114 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.270613909 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.270688057 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.270806074 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.270898104 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.270926952 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.566174030 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.575335979 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.575376034 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.575484991 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.575512886 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.575577021 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.576838970 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.583019018 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.583066940 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.583111048 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.583128929 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.583184004 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.590329885 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.597659111 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.597696066 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.597752094 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.597771883 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.597834110 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.670387983 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.673943996 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.673975945 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.674045086 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.674087048 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.674148083 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.681390047 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.681664944 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.681761026 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.681837082 CEST	49730	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.681870937 CEST	443	49730	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.710361958 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.710377932 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.710484028 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.710851908 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.710863113 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.924599886 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.924921036 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.924946070 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.925498009 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.925939083 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.926014900 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:57.926115036 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:57.926131010 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.155347109 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.155391932 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.155425072 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.155455112 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.155487061 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.155530930 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.155539036 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.162497997 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.162552118 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.162573099 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.166122913 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.166184902 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.166198015 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.173525095 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.173572063 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.173588037 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.180807114 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.180890083 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.180902958 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.221535921 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.259627104 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.263184071 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.263217926 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.263262033 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.263288021 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.263336897 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.270416975 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.277689934 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.277719021 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.277762890 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.277781010 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.277825117 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.284965038 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.292439938 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.292514086 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.292536020 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.292545080 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.292587042 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.299640894 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.306598902 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.306632996 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.306658030 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.306669950 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.306714058 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.313602924 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.320594072 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.320626020 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.320683002 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.320708990 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.320753098 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.327575922 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.327627897 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.327680111 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.327691078 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.327814102 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:42:58.327855110 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.327892065 CEST	49735	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:42:58.327903032 CEST	443	49735	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.085853100 CEST	49741	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.085947037 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.086055994 CEST	49741	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.086422920 CEST	49741	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.086457014 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.109199047 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.109268904 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.109390020 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.110126972 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.110146999 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.299907923 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.300178051 CEST	49741	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.300199986 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.300550938 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.301317930 CEST	49741	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.301393986 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.301501036 CEST	49741	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.301585913 CEST	49741	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.301629066 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.482274055 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.482398987 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.484350920 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.484381914 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.484741926 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.486140966 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.532125950 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.538028002 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.538073063 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.538125038 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.538132906 CEST	49741	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.538167000 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.538213968 CEST	49741	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.538222075 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.544455051 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.544524908 CEST	49741	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.544668913 CEST	49741	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.544682026 CEST	443	49741	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.549097061 CEST	49745	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.549180984 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.549279928 CEST	49745	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.549576044 CEST	49745	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.549612045 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.764882088 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.765290976 CEST	49745	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.765315056 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.765662909 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.766139030 CEST	49745	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.766216040 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.766386032 CEST	49745	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.766415119 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.838939905 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.838973045 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.838993073 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.839061022 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.839076996 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.839119911 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.839143991 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.839159012 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.839183092 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.839200020 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.839229107 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.849951029 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.849981070 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.849999905 CEST	49743	443	192.168.2.16	20.12.23.50
Apr 18, 2024 16:43:00.850008965 CEST	443	49743	20.12.23.50	192.168.2.16
Apr 18, 2024 16:43:00.994220018 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.994267941 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.994294882 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.994323015 CEST	49745	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.994332075 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.994343042 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.994379997 CEST	49745	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.996495008 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.996542931 CEST	49745	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.996579885 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.996646881 CEST	49745	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:00.996661901 CEST	443	49745	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:00.996707916 CEST	49745	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.217143059 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.217184067 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.217255116 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.217569113 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.217580080 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.433372021 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.433598995 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.433620930 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.433984995 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.434391022 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.434458971 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.434683084 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.434722900 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.434767962 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.661309004 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.661360979 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.661412001 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.661438942 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.661442041 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.661456108 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.661528111 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.664738894 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.664819002 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.667443037 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.667536020 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.667593956 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.667617083 CEST	443	49746	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.667634010 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.667663097 CEST	49746	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.670042992 CEST	49748	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.670090914 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.670336008 CEST	49748	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.670526981 CEST	49748	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.670547962 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.883505106 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.885334015 CEST	49748	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.885360003 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.885714054 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.886261940 CEST	49748	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.886261940 CEST	49748	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:01.886296034 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.886342049 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:01.932125092 CEST	49748	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.117855072 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.118380070 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.118416071 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.118451118 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.118499994 CEST	49748	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.118516922 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.118943930 CEST	49748	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.121310949 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.121412992 CEST	49748	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.121841908 CEST	49748	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.121857882 CEST	443	49748	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.515089035 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.515182972 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.515290976 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.515505075 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.515543938 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.741664886 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.741914034 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.741947889 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.743052959 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.743441105 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.743588924 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.743599892 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.743624926 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.743633986 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.743740082 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.790494919 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.969578981 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.969650030 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.969701052 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.969717026 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.969934940 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.969990015 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.970002890 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.976389885 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.976474047 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.976634979 CEST	49751	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.976667881 CEST	443	49751	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.979378939 CEST	49752	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.979415894 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:02.979495049 CEST	49752	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.980118990 CEST	49752	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:02.980129957 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.195234060 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.195604086 CEST	49752	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:03.195632935 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.196089983 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.196434021 CEST	49752	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:03.196512938 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.196687937 CEST	49752	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:03.196700096 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.422333002 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.422672987 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.422745943 CEST	49752	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:03.422760010 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.422790051 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.422929049 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.423008919 CEST	49752	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:03.423022985 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.423078060 CEST	49752	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:03.426491022 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.428606987 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:03.428679943 CEST	49752	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:03.428760052 CEST	49752	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:03.428771973 CEST	443	49752	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:04.819953918 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:04.820008039 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:04.820125103 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:04.820348978 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:04.820367098 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.033191919 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.033487082 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.033519030 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.033854961 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.034152031 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.034219980 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.034286022 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.034341097 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.034365892 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.261977911 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.262032986 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.262079000 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.262089014 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.262128115 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.262161016 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.262176037 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.262183905 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.262222052 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.268098116 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.268192053 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.268239021 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.268268108 CEST	443	49753	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.268280029 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.268280029 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.268317938 CEST	49753	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.270637989 CEST	49754	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.270689964 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.270785093 CEST	49754	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.271037102 CEST	49754	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.271054983 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.484071016 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.484411001 CEST	49754	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.484428883 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.484790087 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.485100985 CEST	49754	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.485161066 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.485255003 CEST	49754	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.485263109 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.709670067 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.709728003 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.709780931 CEST	49754	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.709791899 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.711267948 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:05.711333036 CEST	49754	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.711431980 CEST	49754	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:05.711443901 CEST	443	49754	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.066513062 CEST	49755	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.066601038 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.066706896 CEST	49755	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.066972017 CEST	49755	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.067008972 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.280276060 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.280567884 CEST	49755	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.280627966 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.280997992 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.281346083 CEST	49755	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.281424046 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.281523943 CEST	49755	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.281579971 CEST	49755	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.281621933 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.507280111 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.507329941 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.507379055 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.507402897 CEST	49755	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.507411957 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.507473946 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.507513046 CEST	49755	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.513600111 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.513668060 CEST	49755	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.513748884 CEST	49755	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.513782978 CEST	443	49755	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.515811920 CEST	49756	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.515849113 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.515928030 CEST	49756	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.516134977 CEST	49756	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.516144991 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.729027033 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.729300022 CEST	49756	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.729324102 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.729654074 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.730161905 CEST	49756	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.730211973 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.730401993 CEST	49756	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.730410099 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.955840111 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.955971003 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.956027031 CEST	49756	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.956052065 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.956162930 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.956207991 CEST	49756	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.956212997 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.958187103 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:06.958256960 CEST	49756	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.958476067 CEST	49756	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:06.958491087 CEST	443	49756	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:07.244771004 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:07.244848967 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:07.244970083 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:07.245206118 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:07.245238066 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:07.465270042 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:07.465636969 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:07.465689898 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:07.466803074 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:07.467166901 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:07.467308998 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:07.467322111 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:07.467349052 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:07.467369080 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:07.467436075 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:07.513509035 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.061608076 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.073669910 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.073756933 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.073771000 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.073818922 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.073889017 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.073892117 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.073914051 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.073961973 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.077903986 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.085087061 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.085124969 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.085164070 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.085177898 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.085237980 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.089994907 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.097302914 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.097343922 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.097366095 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.097371101 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.097522974 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.165697098 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.169218063 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.169251919 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.169302940 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.169368982 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.169433117 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.178003073 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.183861971 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.183897972 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.183928967 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.183948040 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.184004068 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.191191912 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.191370010 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.191443920 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.191548109 CEST	49757	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.191586971 CEST	443	49757	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.203286886 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.203325033 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.203419924 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.203619957 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.203633070 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.416285992 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.416667938 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.416685104 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.417212009 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.417521954 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.417589903 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.417676926 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.417689085 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.644071102 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.644172907 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.644206047 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.644248009 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.644273996 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.644316912 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.648447037 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.655772924 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.655796051 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.655864000 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.655889988 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.655939102 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.663084030 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.670352936 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.670384884 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.670428991 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.670454979 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.670598984 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.748260021 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.751662016 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.751701117 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.751760960 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.751794100 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.751840115 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.758970022 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.766288996 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.766330004 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.766396999 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.766428947 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.766493082 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.773575068 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.780883074 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.780921936 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.781099081 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.781117916 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.781169891 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.788136959 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.795391083 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.795423031 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.795550108 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.795563936 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.795607090 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.802057981 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.808430910 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.808468103 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.808522940 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.808535099 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.808573961 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.814990044 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.815228939 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:08.815299988 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.815448046 CEST	49758	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:08.815464973 CEST	443	49758	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:14.621934891 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:14.621979952 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:14.622056007 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:14.622348070 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:14.622365952 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:14.835061073 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:14.835388899 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:14.835410118 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:14.835757971 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:14.836052895 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:14.836126089 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:14.836518049 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:14.836554050 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:14.836623907 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:14.836739063 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:14.836739063 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:14.836770058 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:14.836965084 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:14.836981058 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.055618048 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.055933952 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.055960894 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.057180882 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.057490110 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.057631969 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.057640076 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.057682037 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.064610958 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.064742088 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.064811945 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.064826012 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.064905882 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.064954996 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.064960957 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.067820072 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.067948103 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.067954063 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.068871975 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.068949938 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.069013119 CEST	49759	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.069030046 CEST	443	49759	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.111529112 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.283169985 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.283277035 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.283318043 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.283332109 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.283370972 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.283555031 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.283571959 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.291270018 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.291333914 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.291368008 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.294954062 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.295011044 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.295027018 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.302320957 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.302380085 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.302413940 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.309658051 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.309727907 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.309771061 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.351543903 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.387574911 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.391033888 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.391094923 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.391128063 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.398658037 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.398741007 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.398746967 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.398778915 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.398838043 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.405626059 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.412843943 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.412904024 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.412924051 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.412949085 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.412996054 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.420165062 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.427445889 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.427509069 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.427527905 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.434710979 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.434777975 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.434813023 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.441746950 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.441817999 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.441837072 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.448760986 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.448829889 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.448836088 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.448867083 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.448920965 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.455818892 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.462918997 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.462994099 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.463027000 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.466491938 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.466561079 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.466583967 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.473542929 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.473628044 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.473639011 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.491853952 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.491938114 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.491950989 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.495256901 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.495321989 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.495333910 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.501877069 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.501982927 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.501992941 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.508182049 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.508270979 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.508284092 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.514075041 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.514169931 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.514183044 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.519916058 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:15.520054102 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.520236969 CEST	49760	443	192.168.2.16	64.233.176.106
Apr 18, 2024 16:43:15.520257950 CEST	443	49760	64.233.176.106	192.168.2.16
Apr 18, 2024 16:43:16.467590094 CEST	49688	443	192.168.2.16	204.79.197.200

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 16:42:45.810122967 CEST	53335	53	192.168.2.16	1.1.1.1
Apr 18, 2024 16:42:45.810513973 CEST	60433	53	192.168.2.16	1.1.1.1
Apr 18, 2024 16:42:45.810770035 CEST	53	56230	1.1.1.1	192.168.2.16
Apr 18, 2024 16:42:45.822643042 CEST	53	58930	1.1.1.1	192.168.2.16
Apr 18, 2024 16:42:45.915014029 CEST	53	53335	1.1.1.1	192.168.2.16
Apr 18, 2024 16:42:45.915407896 CEST	53	60433	1.1.1.1	192.168.2.16
Apr 18, 2024 16:42:46.447210073 CEST	53	49625	1.1.1.1	192.168.2.16
Apr 18, 2024 16:42:52.465053082 CEST	53	61033	1.1.1.1	192.168.2.16
Apr 18, 2024 16:42:53.671159029 CEST	53	60315	1.1.1.1	192.168.2.16
Apr 18, 2024 16:42:54.751097918 CEST	53	51949	1.1.1.1	192.168.2.16
Apr 18, 2024 16:42:58.423149109 CEST	53	54611	1.1.1.1	192.168.2.16
Apr 18, 2024 16:43:03.490163088 CEST	53	62398	1.1.1.1	192.168.2.16
Apr 18, 2024 16:43:18.902017117 CEST	138	138	192.168.2.16	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 16:42:45.810122967 CEST	192.168.2.16	1.1.1.1	0xc651	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:42:45.810513973 CEST	192.168.2.16	1.1.1.1	0x1c4f	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 16:42:45.915014029 CEST	1.1.1.1	192.168.2.16	0xc651	No error (0)	www.google.com	64.233.176.106	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:42:45.915014029 CEST	1.1.1.1	192.168.2.16	0xc651	No error (0)	www.google.com	64.233.176.104	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:42:45.915014029 CEST	1.1.1.1	192.168.2.16	0xc651	No error (0)	www.google.com	64.233.176.105	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:42:45.915014029 CEST	1.1.1.1	192.168.2.16	0xc651	No error (0)	www.google.com	64.233.176.103	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:42:45.915014029 CEST	1.1.1.1	192.168.2.16	0xc651	No error (0)	www.google.com	64.233.176.99	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:42:45.915014029 CEST	1.1.1.1	192.168.2.16	0xc651	No error (0)	www.google.com	64.233.176.147	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:42:45.915407896 CEST	1.1.1.1	192.168.2.16	0x1c4f	No error (0)	www.google.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

slscr.update.microsoft.com

www.google.com

https:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49701	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-18 14:42:21 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=231660 Date: Thu, 18 Apr 2024 14:42:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49702	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-18 14:42:21 UTC	805	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 52EA27DBDE0C4533B819423583F6692E Ref B: CH1AA2040902052 Ref C: 2023-07-09T23:10:08Z X-MSEdge-Ref: Ref A: 528BB8D443C042AA9AEA4EC3F75C7762 Ref B: CHI30EDGE0111 Ref C: 2023-07-09T23:11:11Z Content-Type: application/octet-stream X-Azure-Ref: 01uvbYwAAAACkqWtaEMjWQL/4cpisZkorTUVNMzBFREdFMDgxMQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=231681 Date: Thu, 18 Apr 2024 14:42:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-18 14:42:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49703	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mAxnuSGHD3KYcLX&MD=OpGoY+BO HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-18 14:42:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b1f64a74-54c9-4e07-b8ac-685fbf33f0fc MS-RequestId: 5861fc3c-531c-4771-8cdf-28b8cdf037b5 MS-CV: aoCeePd2EkSS9Pmb.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 14:42:22 GMT Connection: close Content-Length: 24490
2024-04-18 14:42:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-18 14:42:23 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49707	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:46 UTC	627	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 14:42:46 UTC	2194	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26oft%3D1%26pgcl%3D20%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgRRtTk0GObihLEGIjDQR5zrL8Z8FIe--7JmhwAOhhfkAQgrLLC7_vpIQAglsXqdjDqfhIkPDrbvTHmKgCIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI5uKEsQYQ35WK_wESBFG1OTQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-N_MTc5RzlIvFDQO9kovr5A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Thu, 18 Apr 2024 14:42:46 GMT Server: gws Content-Length: 576 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-18-14; expires=Sat, 18-May-2024 14:42:46 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=oexGWiXJ83Lpdq_jaUpeuzeYvdX2a7J-7m9G1zPn5IbRs8GTHAOfnRgHgJyX6xu4Do3adnQgaYiQdrG2X69elqRdPH0hO3oE7ZL7Db9D_MfPXI9-XCf0lk7DHxUEpe6WlYkHVlHTxJKyagPRPazI6aLyqkgqiajzNEG_HvfpfKI; expires=Fri, 18-Oct-2024 14:42:46 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:42:46 UTC	576	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 25 33 46 63 6c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fcl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49708	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:46 UTC	530	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 14:42:46 UTC	1843	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRRtTk0GObihLEGIjCjYMa1_LGDVbrC5SvJmZkMYhY0iukalt9_KGlWf27Rj0MpZxY-3zG0gN8CvSCy_K8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI5uKEsQYQ2tmwrgMSBFG1OTQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Thu, 18 Apr 2024 14:42:46 GMT Server: gws Content-Length: 458 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-18-14; expires=Sat, 18-May-2024 14:42:46 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; expires=Fri, 18-Oct-2024 14:42:46 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:42:46 UTC	458	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49710	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:46 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 14:42:46 UTC	1761	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRRtTk0GObihLEGIjAI7DtiS_GiN5bc9NLEssGbsC0oLSesQcn1J6SH9zJpOTjdzgSOLpnIbu-Pxo5sr8MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI5uKEsQYQtcHt9QISBFG1OTQ Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Thu, 18 Apr 2024 14:42:46 GMT Server: gws Content-Length: 417 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-18-14; expires=Sat, 18-May-2024 14:42:46 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=A8jZ0OPhPeIqlDT7GmFF77vlgGETmxZbTXqHRxNl7JVr8QG2WMZ5ul-Bchthd27MpWaQ6URS-PVj-Ux8XnXL-CI8tBUpf72ShjyTdP8bBQCFosVwFW05YugaUF75D22ZXEfz3UeGwLMGgwjpYi1FqQqug9XyPXVMOpKbzQWuDJo; expires=Fri, 18-Oct-2024 14:42:46 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:42:46 UTC	417	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49709	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:46 UTC	837	OUT	GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26oft%3D1%26pgcl%3D20%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgRRtTk0GObihLEGIjDQR5zrL8Z8FIe--7JmhwAOhhfkAQgrLLC7_vpIQAglsXqdjDqfhIkPDrbvTHmKgCIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 14:42:46 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 18 Apr 2024 14:42:46 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3576 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:42:46 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 3f 63 6c 69 65 6e 74 3d 63 68 72 6f 6d 65 2d 6f 6d 6e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/complete/search?client=chrome-omn
2024-04-18 14:42:46 UTC	1255	IN	Data Raw: 61 62 6c 65 20 6a 61 76 61 73 63 72 69 70 74 20 6f 6e 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 2e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 22 20 61 73 79 6e 63 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 Data Ascii: able javascript on your web browser.</div></noscript><script src="https://www.google.com/recaptcha/api.js" async defer></script><script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="reca
2024-04-18 14:42:46 UTC	1255	IN	Data Raw: 72 65 73 73 65 64 20 61 62 75 73 65 20 63 6f 6d 70 6c 61 69 6e 74 73 20 61 62 6f 75 74 20 6d 61 6c 69 63 69 6f 75 73 20 62 65 68 61 76 69 6f 72 2e 20 54 68 69 73 20 70 61 67 65 20 63 68 65 63 6b 73 20 74 6f 20 73 65 65 20 69 66 20 69 74 27 73 20 72 65 61 6c 6c 79 20 61 20 68 75 6d 61 6e 20 73 65 6e 64 69 6e 67 20 74 68 65 20 72 65 71 75 65 73 74 73 20 61 6e 64 20 6e 6f 74 20 61 20 72 6f 62 6f 74 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 74 68 69 73 20 6e 65 74 77 6f 72 6b 2e 20 3c 62 72 3e 3c 62 72 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 66 6f 44 69 76 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 20 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 20 6d 61 72 67 69 6e 3a 30 20 30 Data Ascii: ressed abuse complaints about malicious behavior. This page checks to see if it's really a human sending the requests and not a robot coming from this network. <br><br><div id="infoDiv" style="display:none; background-color:#eee; padding:10px; margin:0 0
2024-04-18 14:42:46 UTC	167	IN	Data Raw: 72 69 3d 63 68 72 6f 6d 65 2d 65 78 74 2d 61 6e 73 67 26 61 6d 70 3b 78 73 73 69 3d 74 26 61 6d 70 3b 71 3d 26 61 6d 70 3b 6f 69 74 3d 30 26 61 6d 70 3b 6f 66 74 3d 31 26 61 6d 70 3b 70 67 63 6c 3d 32 30 26 61 6d 70 3b 67 73 5f 72 6e 3d 34 32 26 61 6d 70 3b 73 75 67 6b 65 79 3d 41 49 7a 61 53 79 42 4f 74 69 34 6d 4d 2d 36 78 39 57 44 6e 5a 49 6a 49 65 79 45 55 32 31 4f 70 42 58 71 57 42 67 77 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw<br></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49711	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:47 UTC	738	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRRtTk0GObihLEGIjAI7DtiS_GiN5bc9NLEssGbsC0oLSesQcn1J6SH9zJpOTjdzgSOLpnIbu-Pxo5sr8MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=A8jZ0OPhPeIqlDT7GmFF77vlgGETmxZbTXqHRxNl7JVr8QG2WMZ5ul-Bchthd27MpWaQ6URS-PVj-Ux8XnXL-CI8tBUpf72ShjyTdP8bBQCFosVwFW05YugaUF75D22ZXEfz3UeGwLMGgwjpYi1FqQqug9XyPXVMOpKbzQWuDJo
2024-04-18 14:42:47 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 18 Apr 2024 14:42:47 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3111 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:42:47 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_promos</title></head
2024-04-18 14:42:47 UTC	1255	IN	Data Raw: 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 64 67 54 59 59 35 58 66 31 44 32 32 30 46 54 6c 54 74 39 41 59 61 4f 46 4b 5f 55 6d 52 38 5f 2d 52 Data Ascii: ack = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="dgTYY5Xf1D220FTlTt9AYaOFK_UmR8_-R
2024-04-18 14:42:47 UTC	957	IN	Data Raw: 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e Data Ascii: ogle automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solvin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49712	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:47 UTC	932	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRRtTk0GObihLEGIjCjYMa1_LGDVbrC5SvJmZkMYhY0iukalt9_KGlWf27Rj0MpZxY-3zG0gN8CvSCy_K8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI
2024-04-18 14:42:47 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 18 Apr 2024 14:42:47 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3183 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:42:47 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 3f 68 6c 3d 65 6e 2d 55 53 26 61 6d 70 3b 61 73 79 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_ogb?hl=en-US&asy
2024-04-18 14:42:47 UTC	1255	IN	Data Raw: 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 63 57 41 36 62 79 5f 69 72 Data Ascii: <script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="cWA6by_ir
2024-04-18 14:42:47 UTC	1029	IN	Data Raw: 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 Data Ascii: ; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly aft

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49713	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:49 UTC	858	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7&oit=4&cp=1&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49714	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:49 UTC	859	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7z&oit=1&cp=2&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49715	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:50 UTC	860	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7zi&oit=1&cp=3&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49716	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:50 UTC	861	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=7zip&oit=1&cp=4&pgcl=7&gs_rn=42&psi=RNf-2vw-scF0IRoG&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49717	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:50 UTC	1124	OUT	GET /search?q=7zip&oq=7zip&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI
2024-04-18 14:42:51 UTC	1948	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI6-KEsQYQlZTKvAESBFG1OTQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-BFDJWtMZzpy_Nq2-UKXhyg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Thu, 18 Apr 2024 14:42:51 GMT Server: gws Content-Length: 517 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-18-14; expires=Sat, 18-May-2024 14:42:51 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA; expires=Tue, 15-Oct-2024 14:42:51 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:42:51 UTC	517	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 25 33 46 71 25 33 44 37 7a 69 70 25 32 36 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49718	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:51 UTC	1382	OUT	GET /sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:42:51 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 18 Apr 2024 14:42:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3399 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:42:51 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 37 7a 69 70 26 61 6d 70 3b 6f 71 3d 37 7a 69 70 26 61 6d 70 3b 67 73 5f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/search?q=7zip&oq=7zip&gs_
2024-04-18 14:42:51 UTC	1255	IN	Data Raw: 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 22 20 61 73 79 6e 63 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 Data Ascii: ript src="https://www.google.com/recaptcha/api.js" async defer></script><script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS
2024-04-18 14:42:51 UTC	1245	IN	Data Raw: 61 6e 64 20 6e 6f 74 20 61 20 72 6f 62 6f 74 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 74 68 69 73 20 6e 65 74 77 6f 72 6b 2e 20 3c 62 72 3e 3c 62 72 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 66 6f 44 69 76 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 20 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 20 6d 61 72 67 69 6e 3a 30 20 30 20 31 35 70 78 20 30 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e Data Ascii: and not a robot coming from this network. <br><br><div id="infoDiv" style="display:none; background-color:#eee; padding:10px; margin:0 0 15px 0; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49719	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:52 UTC	1254	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:42:52 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Thu, 18 Apr 2024 14:42:52 GMT Date: Thu, 18 Apr 2024 14:42:52 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:42:52 UTC	727	IN	Data Raw: 34 63 36 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 4c6/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-04-18 14:42:52 UTC	502	IN	Data Raw: 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 3b 70 6f 2e 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 41 32 33 36 4a 2f 5a 55 67 55 2b 30 2f 4f 36 62 2f Data Ascii: cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-A236J/ZUgU+0/O6b/
2024-04-18 14:42:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49721	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:53 UTC	1861	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&s=UmaxTijlJW5SKuCjeKiuht3d-cK_JbsmlNOyQxTFy5nd5IFHD6atAzmTR0rLo-BcJEqhyVZFVhj7UzxfIbWvz_DaqhxQk7YKW4V6sZzvzbYDMhfzwNoLw5lzf1texV1J0SVn5osV7V_T2-BtXAD5bSXvCsgcXGg-Vnhfv-YRq6R_u2ne50cYXEO1kTWw7TqUD6VdLSP3GPCIObFNRoi65NmxMW7_PilDEcN6LPU1Ql907VfeSmZlRuZ_nKxP1XM-1aT28hgtdu-lMA0bD9c6U7Q44McPV2w&cb=mr7m5vp8npo1 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:42:53 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 18 Apr 2024 14:42:53 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-CJIyuSodTgRgWFVJMqRIEQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:42:53 UTC	364	IN	Data Raw: 32 61 63 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2acb<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-04-18 14:42:53 UTC	1255	IN	Data Raw: 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 Data Ascii: 18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//font
2024-04-18 14:42:53 UTC	1255	IN	Data Raw: 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 Data Ascii: 0AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00
2024-04-18 14:42:53 UTC	1255	IN	Data Raw: 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 Data Ascii: +04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-18 14:42:53 UTC	1255	IN	Data Raw: 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 Data Ascii: e { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0
2024-04-18 14:42:53 UTC	1255	IN	Data Raw: 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a Data Ascii: ic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2024-04-18 14:42:53 UTC	1255	IN	Data Raw: 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 43 4a 49 79 75 53 6f 64 54 67 52 67 57 46 56 4a 4d 71 52 49 45 51 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d Data Ascii: </style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/styles__ltr.css"><script nonce="CJIyuSodTgRgWFVJMqRIEQ" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com
2024-04-18 14:42:53 UTC	1255	IN	Data Raw: 79 30 4e 72 6f 71 64 4c 78 74 5a 65 4f 49 71 61 70 57 6a 71 72 33 38 38 50 49 4d 51 6e 75 5a 6c 6d 6f 63 7a 2d 4e 44 30 6f 70 77 2d 68 4c 41 52 65 2d 77 62 64 72 78 76 69 65 36 63 6a 46 78 63 43 4c 54 79 59 56 64 55 7a 4d 53 51 57 38 39 43 6e 6d 59 78 43 4c 72 43 55 5f 5a 58 53 73 55 62 4d 74 70 67 65 54 6c 46 38 77 71 47 30 4e 30 53 4a 4d 34 65 41 6a 54 72 65 49 6a 73 76 4f 37 6b 51 32 37 57 5a 45 69 45 61 44 58 72 46 4c 63 37 5a 45 61 32 44 73 30 6b 79 77 75 68 49 36 6e 57 69 78 76 71 36 48 69 37 39 64 51 70 6c 34 68 68 74 75 43 45 41 52 43 7a 56 6a 67 63 5f 46 54 4a 77 39 72 31 65 49 54 52 4b 4f 62 51 48 78 4d 4e 5a 33 57 4d 38 39 33 4f 4c 64 64 37 4a 57 75 4f 33 38 69 38 79 43 71 30 36 6a 48 33 61 39 4d 48 7a 4f 4a 76 68 47 56 6e 63 36 79 56 5f 46 66 Data Ascii: y0NroqdLxtZeOIqapWjqr388PIMQnuZlmocz-ND0opw-hLARe-wbdrxvie6cjFxcCLTyYVdUzMSQW89CnmYxCLrCU_ZXSsUbMtpgeTlF8wqG0N0SJM4eAjTreIjsvO7kQ27WZEiEaDXrFLc7ZEa2Ds0kywuhI6nWixvq6Hi79dQpl4hhtuCEARCzVjgc_FTJw9r1eITRKObQHxMNZ3WM893OLdd7JWuO38i8yCq06jH3a9MHzOJvhGVnc6yV_Ff
2024-04-18 14:42:53 UTC	1255	IN	Data Raw: 50 72 44 4f 44 2d 4d 46 75 65 50 65 69 6d 57 4b 6e 4f 75 37 4d 70 6c 66 55 31 70 42 75 32 67 37 6c 2d 70 4d 59 33 70 6d 46 66 7a 4a 44 6c 5f 64 73 65 66 4e 5a 4b 71 47 4e 4c 4c 46 49 75 59 69 62 73 4f 49 47 33 6a 65 66 6d 6e 33 74 37 36 43 2d 30 4b 74 58 66 31 73 57 47 4c 5a 45 6f 5a 70 47 41 61 67 63 38 57 59 42 75 30 53 67 50 32 54 5f 4e 41 5f 63 4b 53 54 70 45 46 2d 74 58 6f 48 6b 35 74 63 38 6c 2d 4d 5a 63 37 57 33 68 4d 74 6b 74 37 65 58 65 6c 4e 4d 38 4e 30 58 32 5f 76 6d 6b 35 4e 38 36 36 4c 6b 38 39 74 66 52 4d 32 73 35 35 2d 39 53 4b 78 47 78 2d 43 44 65 65 36 63 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 43 4a 49 79 75 53 6f 64 54 67 52 67 57 46 56 4a 4d 71 52 49 45 Data Ascii: PrDOD-MFuePeimWKnOu7MplfU1pBu2g7l-pMY3pmFfzJDl_dsefNZKqGNLLFIuYibsOIG3jefmn3t76C-0KtXf1sWGLZEoZpGAagc8WYBu0SgP2T_NA_cKSTpEF-tXoHk5tc8l-MZc7W3hMtkt7eXelNM8N0X2_vmk5N866Lk89tfRM2s55-9SKxGx-CDee6c"><script type="text/javascript" nonce="CJIyuSodTgRgWFVJMqRIE
2024-04-18 14:42:53 UTC	559	IN	Data Raw: 57 53 39 57 4f 47 55 79 54 44 4e 55 52 46 6f 78 4c 7a 42 48 59 56 70 53 62 44 64 32 4e 58 59 34 5a 32 64 5a 63 47 39 6c 61 47 6c 48 52 7a 4e 58 64 7a 46 42 51 6a 52 48 54 47 73 30 59 57 6c 59 4e 30 78 46 62 54 4a 75 65 43 39 6c 51 6e 6c 58 54 45 5a 72 62 55 31 6a 61 6c 6c 76 55 58 4d 78 4f 55 74 58 4d 57 39 30 57 54 4a 33 52 6e 46 79 4f 56 4e 75 54 6b 31 79 4c 33 64 5a 5a 48 5a 35 4d 6c 4a 74 55 56 52 57 65 6d 31 6b 4e 6a 64 55 62 6d 5a 57 4e 7a 6c 36 64 31 4e 70 63 45 6c 6a 52 31 52 45 56 33 52 50 57 6a 68 77 4d 48 4a 4f 4d 57 6c 42 64 56 6c 42 4c 31 49 7a 4e 32 56 46 52 7a 56 79 55 30 5a 46 62 6e 41 7a 63 6b 31 75 61 48 6c 7a 64 31 56 5a 54 7a 5a 4a 4e 30 46 6b 52 6a 56 78 4b 33 68 71 4e 6a 52 43 63 55 64 6e 52 43 74 72 64 54 4a 54 53 6d 4d 79 55 57 6f Data Ascii: WS9WOGUyTDNURFoxLzBHYVpSbDd2NXY4Z2dZcG9laGlHRzNXdzFBQjRHTGs0YWlYN0xFbTJueC9lQnlXTEZrbU1jallvUXMxOUtXMW90WTJ3RnFyOVNuTk1yL3dZZHZ5MlJtUVRWem1kNjdUbmZWNzl6d1NpcEljR1REV3RPWjhwMHJOMWlBdVlBL1IzN2VFRzVyU0ZFbnAzck1uaHlzd1VZTzZJN0FkRjVxK3hqNjRCcUdnRCtrdTJTSmMyUWo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49725	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:54 UTC	1457	OUT	GET /js/bg/IsHUla7t4cK5kOAb6cwcBiPQ5HnUjMTZuq5wUJJd2UM.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&s=UmaxTijlJW5SKuCjeKiuht3d-cK_JbsmlNOyQxTFy5nd5IFHD6atAzmTR0rLo-BcJEqhyVZFVhj7UzxfIbWvz_DaqhxQk7YKW4V6sZzvzbYDMhfzwNoLw5lzf1texV1J0SVn5osV7V_T2-BtXAD5bSXvCsgcXGg-Vnhfv-YRq6R_u2ne50cYXEO1kTWw7TqUD6VdLSP3GPCIObFNRoi65NmxMW7_PilDEcN6LPU1Ql907VfeSmZlRuZ_nKxP1XM-1aT28hgtdu-lMA0bD9c6U7Q44McPV2w&cb=mr7m5vp8npo1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:42:55 UTC	799	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18283 Date: Thu, 18 Apr 2024 14:42:54 GMT Expires: Fri, 18 Apr 2025 14:42:54 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 04 Apr 2024 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:42:55 UTC	456	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 66 3d 66 75 6e 63 74 69 6f 6e 28 46 2c 59 29 7b 69 66 28 28 46 3d 28 59 3d 78 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 6e 75 6c 6c 29 2c 21 59 29 7c 7c 21 59 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 46 3b 74 72 79 7b 46 3d 59 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 67 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 67 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 67 7d Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var f=function(F,Y){if((F=(Y=x.trustedTypes,null),!Y)\|\|!Y.createPolicy)return F;try{F=Y.createPolicy("bg",{createHTML:g,createScript:g,createScriptURL:g}
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 55 29 7b 72 65 74 75 72 6e 22 22 2b 55 7d 7d 28 78 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 5b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 27 2c 0a 27 27 2c 0a 27 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 46 68 3d 66 75 6e 63 74 69 6f 6e 28 59 2c 46 2c 78 2c 67 29 7b 74 72 79 7b 67 3d 59 5b 28 28 46 7c 30 29 2b 32 29 25 33 5d 2c 59 5b 46 5d 3d 28 59 5b 46 5d 7c 30 29 2d 28 59 5b 28 28 46 7c 30 29 2b 31 29 25 33 5d 7c 30 29 2d 28 67 7c 30 29 5e 28 31 3d 3d 46 3f 67 3c 3c 78 3a 67 3e 3e 3e 78 29 7d 63 61 74 63 68 28 66 29 7b 74 68 72 Data Ascii: )}:function(U){return""+U}}(x)(Array(7824Math.random()\|0).join("\n")+['(function(){/','',' SPDX-License-Identifier: Apache-2.0','*/','var Fh=function(Y,F,x,g){try{g=Y[((F\|0)+2)%3],Y[F]=(Y[F]\|0)-(Y[((F\|0)+1)%3]\|0)-(g\|0)^(1==F?g<<x:g>>>x)}catch(f){thr
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 67 3d 28 66 3d 46 5b 33 5d 7c 30 2c 30 29 2c 46 5b 32 5d 7c 30 29 3b 31 36 3e 67 3b 67 2b 2b 29 59 3d 59 3e 3e 3e 38 7c 59 3c 3c 32 34 2c 59 2b 3d 78 7c 30 2c 66 3d 66 3e 3e 3e 38 7c 66 3c 3c 32 34 2c 59 5e 3d 46 2b 33 38 36 39 2c 66 2b 3d 46 7c 30 2c 78 3d 78 3c 3c 33 7c 78 3e 3e 3e 32 39 2c 46 3d 46 3c 3c 33 7c 46 3e 3e 3e 32 39 2c 66 5e 3d 67 2b 33 38 36 39 2c 46 5e 3d 66 2c 78 5e 3d 59 3b 72 65 74 75 72 6e 5b 78 3e 3e 3e 32 34 26 32 35 35 2c 78 3e 3e 3e 31 36 26 32 35 35 2c 78 3e 3e 3e 38 26 32 35 35 2c 78 3e 3e 3e 30 26 32 35 35 2c 59 3e 3e 3e 32 34 26 32 35 35 2c 59 3e 3e 3e 31 36 26 32 35 35 2c 59 3e 3e 3e 38 26 32 35 35 2c 59 3e 3e 3e 30 26 32 35 35 5d 7d 2c 50 38 3d 66 75 6e 63 74 69 6f 6e 28 59 2c 46 2c 78 29 7b 69 66 28 33 3d 3d 59 2e 6c 65 6e Data Ascii: g=(f=F[3]\|0,0),F[2]\|0);16>g;g++)Y=Y>>>8\|Y<<24,Y+=x\|0,f=f>>>8\|f<<24,Y^=F+3869,f+=F\|0,x=x<<3\|x>>>29,F=F<<3\|F>>>29,f^=g+3869,F^=f,x^=Y;return[x>>>24&255,x>>>16&255,x>>>8&255,x>>>0&255,Y>>>24&255,Y>>>16&255,Y>>>8&255,Y>>>0&255]},P8=function(Y,F,x){if(3==Y.len
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 47 28 28 71 28 29 2c 63 29 29 7d 29 7d 2c 70 65 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 67 26 26 67 28 6e 29 7d 7d 7d 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 59 2c 46 2c 78 29 7b 69 66 28 38 36 3d 3d 59 7c 7c 34 32 30 3d 3d 59 29 46 2e 46 5b 59 5d 3f 46 2e 46 5b 59 5d 2e 63 6f 6e 63 61 74 28 78 29 3a 46 2e 46 5b 59 5d 3d 64 33 28 78 2c 46 29 3b 65 6c 73 65 7b 69 66 28 46 2e 72 71 26 26 36 34 21 3d 59 29 72 65 74 75 72 6e 3b 33 35 35 3d 3d 59 7c 7c 38 3d 3d 59 7c 7c 34 35 3d 3d 59 7c 7c 34 36 30 3d 3d 59 7c 7c 32 39 32 3d 3d 59 7c 7c 33 38 33 3d 3d 59 7c 7c 32 31 35 3d 3d 59 7c 7c 32 36 32 3d 3d 59 7c 7c 34 30 33 3d 3d 59 3f 46 2e 46 5b 59 5d 7c 7c 28 46 2e 46 5b 59 5d 3d 7a 36 28 46 2c 59 2c 78 2c 31 34 29 29 3a 46 2e 46 5b Data Ascii: function(){nG((q(),c))})},pe:function(n){g&&g(n)}}},I=function(Y,F,x){if(86==Y\|\|420==Y)F.F[Y]?F.F[Y].concat(x):F.F[Y]=d3(x,F);else{if(F.rq&&64!=Y)return;355==Y\|\|8==Y\|\|45==Y\|\|460==Y\|\|292==Y\|\|383==Y\|\|215==Y\|\|262==Y\|\|403==Y?F.F[Y]\|\|(F.F[Y]=z6(F,Y,x,14)):F.F[
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 57 28 46 2c 66 75 6e 63 74 69 6f 6e 28 55 2c 44 2c 71 2c 63 2c 74 29 7b 28 44 3d 28 63 3d 28 71 3d 5a 28 55 29 2c 5a 29 28 55 29 2c 5a 28 55 29 29 2c 55 29 2e 58 3d 3d 55 26 26 28 44 3d 64 28 55 2c 44 29 2c 74 3d 64 28 55 2c 71 29 2c 63 3d 64 28 55 2c 63 29 2c 74 5b 63 5d 3d 44 2c 36 34 3d 3d 71 26 26 28 55 2e 67 3d 76 6f 69 64 20 30 2c 32 3d 3d 63 26 26 28 55 2e 57 3d 58 28 55 2c 33 32 2c 66 61 6c 73 65 29 2c 55 2e 67 3d 76 6f 69 64 20 30 29 29 29 7d 2c 28 46 2e 4a 36 3d 28 49 28 34 36 30 2c 46 2c 28 49 28 32 31 35 2c 46 2c 28 57 28 46 2c 66 75 6e 63 74 69 6f 6e 28 55 2c 44 2c 71 2c 63 2c 74 29 7b 30 21 3d 3d 28 44 3d 64 28 28 74 3d 28 63 3d 28 71 3d 28 63 3d 5a 28 28 44 3d 28 74 3d 28 71 3d 5a 28 55 29 2c 5a 28 55 29 29 2c 5a 28 55 29 29 2c 55 29 29 2c Data Ascii: W(F,function(U,D,q,c,t){(D=(c=(q=Z(U),Z)(U),Z(U)),U).X==U&&(D=d(U,D),t=d(U,q),c=d(U,c),t[c]=D,64==q&&(U.g=void 0,2==c&&(U.W=X(U,32,false),U.g=void 0)))},(F.J6=(I(460,F,(I(215,F,(W(F,function(U,D,q,c,t){0!==(D=d((t=(c=(q=(c=Z((D=(t=(q=Z(U),Z(U)),Z(U)),U)),
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 2c 42 28 34 29 29 29 2c 66 75 6e 63 74 69 6f 6e 28 55 2c 44 2c 71 2c 63 2c 74 2c 7a 2c 4c 29 7b 66 6f 72 28 74 3d 28 44 3d 28 7a 3d 64 28 55 2c 28 4c 3d 28 63 3d 4c 47 28 28 71 3d 5a 28 55 29 2c 55 29 29 2c 22 22 29 2c 35 29 29 2c 7a 2e 6c 65 6e 67 74 68 29 2c 30 29 3b 63 2d 2d 3b 29 74 3d 28 28 74 7c 30 29 2b 28 4c 47 28 55 29 7c 30 29 29 25 44 2c 4c 2b 3d 6e 5b 7a 5b 74 5d 5d 3b 49 28 71 2c 55 2c 4c 29 7d 29 2c 34 35 30 29 2c 66 75 6e 63 74 69 6f 6e 28 55 2c 44 2c 71 2c 63 2c 74 2c 7a 29 7b 6b 28 74 72 75 65 2c 55 2c 66 61 6c 73 65 2c 44 29 7c 7c 28 7a 3d 5a 61 28 55 2e 58 29 2c 71 3d 7a 2e 6f 4e 2c 44 3d 7a 2e 57 6f 2c 63 3d 7a 2e 6b 6a 2c 7a 3d 7a 2e 53 2c 74 3d 7a 2e 6c 65 6e 67 74 68 2c 71 3d 30 3d 3d 74 3f 6e 65 77 20 63 5b 71 5d 3a 31 3d 3d 74 3f Data Ascii: ,B(4))),function(U,D,q,c,t,z,L){for(t=(D=(z=d(U,(L=(c=LG((q=Z(U),U)),""),5)),z.length),0);c--;)t=((t\|0)+(LG(U)\|0))%D,L+=n[z[t]];I(q,U,L)}),450),function(U,D,q,c,t,z){k(true,U,false,D)\|\|(z=Za(U.X),q=z.oN,D=z.Wo,c=z.kj,z=z.S,t=z.length,q=0==t?new c[q]:1==t?
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 34 38 32 29 29 2c 33 30 39 29 29 2c 34 36 32 29 29 2c 46 29 2c 66 75 6e 63 74 69 6f 6e 28 55 29 7b 76 38 28 33 2c 55 29 7d 2c 33 36 38 29 2c 30 29 2c 30 5d 29 2c 46 29 2c 31 39 38 29 2c 66 75 6e 63 74 69 6f 6e 28 55 2c 44 2c 71 2c 63 2c 74 2c 7a 2c 4c 2c 6d 2c 62 2c 53 2c 48 2c 56 29 7b 66 75 6e 63 74 69 6f 6e 20 4d 28 75 2c 4a 29 7b 66 6f 72 28 3b 44 3c 75 3b 29 48 7c 3d 6c 28 55 29 3c 3c 44 2c 44 2b 3d 38 3b 72 65 74 75 72 6e 20 44 2d 3d 75 2c 4a 3d 48 26 28 31 3c 3c 75 29 2d 31 2c 48 3e 3e 3d 75 2c 4a 7d 66 6f 72 28 53 3d 28 62 3d 28 63 3d 28 44 3d 28 7a 3d 5a 28 55 29 2c 48 3d 30 29 2c 6d 3d 28 4d 28 33 29 7c 30 29 2b 31 2c 4d 28 35 29 29 2c 30 29 2c 5b 5d 29 2c 4c 3d 30 3b 4c 3c 63 3b 4c 2b 2b 29 71 3d 4d 28 31 29 2c 53 2e 70 75 73 68 28 71 29 2c 62 Data Ascii: 482)),309)),462)),F),function(U){v8(3,U)},368),0),0]),F),198),function(U,D,q,c,t,z,L,m,b,S,H,V){function M(u,J){for(;D<u;)H\|=l(U)<<D,D+=8;return D-=u,J=H&(1<<u)-1,H>>=u,J}for(S=(b=(c=(D=(z=Z(U),H=0),m=(M(3)\|0)+1,M(5)),0),[]),L=0;L<c;L++)q=M(1),S.push(q),b
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 5b 38 5d 3c 3c 32 34 7c 59 5b 39 5d 3c 3c 31 36 7c 59 5b 31 30 5d 3c 3c 38 7c 59 5b 31 31 5d 29 7d 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 59 2c 46 2c 78 2c 67 29 7b 66 6f 72 28 78 3d 28 46 7c 28 67 3d 5b 5d 2c 30 29 29 2d 31 3b 30 3c 3d 78 3b 78 2d 2d 29 67 5b 28 46 7c 30 29 2d 31 2d 28 78 7c 30 29 5d 3d 59 3e 3e 38 2a 78 26 32 35 35 3b 72 65 74 75 72 6e 20 67 7d 2c 67 33 3d 66 75 6e 63 74 69 6f 6e 28 59 2c 46 2c 78 2c 67 29 7b 66 6f 72 28 3b 59 2e 55 2e 6c 65 6e 67 74 68 3b 29 7b 78 3d 28 59 2e 50 3d 6e 75 6c 6c 2c 59 2e 55 2e 70 6f 70 28 29 29 3b 74 72 79 7b 67 3d 61 6c 28 78 2c 59 29 7d 63 61 74 63 68 28 66 29 7b 61 28 66 2c 59 29 7d 69 66 28 46 26 26 59 2e 50 29 7b 28 46 3d 59 2e 50 2c 46 29 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4b 28 59 2c 74 72 75 65 2c Data Ascii: [8]<<24\|Y[9]<<16\|Y[10]<<8\|Y[11])},r=function(Y,F,x,g){for(x=(F\|(g=[],0))-1;0<=x;x--)g[(F\|0)-1-(x\|0)]=Y>>8*x&255;return g},g3=function(Y,F,x,g){for(;Y.U.length;){x=(Y.P=null,Y.U.pop());try{g=al(x,Y)}catch(f){a(f,Y)}if(F&&Y.P){(F=Y.P,F)(function(){K(Y,true,
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 2a 28 44 3d 46 25 31 36 2b 31 2c 46 29 2a 66 2b 28 50 28 29 7c 30 29 2a 44 2b 33 37 2a 66 2a 66 2d 44 2a 66 2b 6e 2d 31 31 31 2a 46 2a 46 2a 66 2b 78 5b 6e 2b 35 39 26 37 5d 2a 46 2a 44 2b 33 2a 46 2a 46 2a 44 2c 66 3d 76 6f 69 64 20 30 2c 44 3d 78 5b 44 5d 2c 78 29 5b 28 6e 2b 32 31 26 37 29 2b 28 67 26 32 29 5d 3d 44 2c 78 29 5b 6e 2b 28 67 26 32 29 5d 3d 36 34 2c 44 7d 2c 55 7d 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 59 29 7b 72 65 74 75 72 6e 20 59 2e 68 3f 66 47 28 59 2e 6c 2c 59 29 3a 58 28 59 2c 38 2c 74 72 75 65 29 7d 2c 47 36 3d 66 75 6e 63 74 69 6f 6e 28 59 2c 46 2c 78 2c 67 29 7b 72 65 74 75 72 6e 20 64 28 46 2c 28 49 28 38 36 2c 46 2c 28 44 61 28 46 2c 28 28 67 3d 64 28 46 2c 38 36 29 2c 46 29 2e 42 26 26 67 3c 46 2e 4b 3f 28 49 28 38 36 2c 46 2c Data Ascii: (D=F%16+1,F)f+(P()\|0)D+37ff-Df+n-111FFf+x[n+59&7]FD+3FFD,f=void 0,D=x[D],x)[(n+21&7)+(g&2)]=D,x)[n+(g&2)]=64,D},U},l=function(Y){return Y.h?fG(Y.l,Y):X(Y,8,true)},G6=function(Y,F,x,g){return d(F,(I(86,F,(Da(F,((g=d(F,86),F).B&&g<F.K?(I(86,F,
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 3d 28 59 2e 63 68 61 72 43 6f 64 65 41 74 28 67 2b 31 29 26 36 34 35 31 32 29 3f 28 66 3d 36 35 35 33 36 2b 28 28 66 26 31 30 32 33 29 3c 3c 31 30 29 2b 28 59 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 67 29 26 31 30 32 33 29 2c 46 5b 78 2b 2b 5d 3d 66 3e 3e 31 38 7c 32 34 30 2c 46 5b 78 2b 2b 5d 3d 66 3e 3e 31 32 26 36 33 7c 31 32 38 29 3a 46 5b 78 2b 2b 5d 3d 66 3e 3e 31 32 7c 32 32 34 2c 46 5b 78 2b 2b 5d 3d 66 3e 3e 36 26 36 33 7c 31 32 38 29 2c 46 5b 78 2b 2b 5d 3d 66 26 36 33 7c 31 32 38 29 3b 72 65 74 75 72 6e 20 46 7d 2c 41 30 3d 66 75 6e 63 74 69 6f 6e 28 59 2c 46 29 7b 66 75 6e 63 74 69 6f 6e 20 78 28 29 7b 74 68 69 73 2e 6a 3d 74 68 69 73 2e 5a 3d 74 68 69 73 2e 6e 3d 30 7d 72 65 74 75 72 6e 5b 66 75 6e 63 74 69 6f 6e 28 67 29 7b 59 2e 56 62 28 Data Ascii: =(Y.charCodeAt(g+1)&64512)?(f=65536+((f&1023)<<10)+(Y.charCodeAt(++g)&1023),F[x++]=f>>18\|240,F[x++]=f>>12&63\|128):F[x++]=f>>12\|224,F[x++]=f>>6&63\|128),F[x++]=f&63\|128);return F},A0=function(Y,F){function x(){this.j=this.Z=this.n=0}return[function(g){Y.Vb(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49727	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:55 UTC	1469	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&s=UmaxTijlJW5SKuCjeKiuht3d-cK_JbsmlNOyQxTFy5nd5IFHD6atAzmTR0rLo-BcJEqhyVZFVhj7UzxfIbWvz_DaqhxQk7YKW4V6sZzvzbYDMhfzwNoLw5lzf1texV1J0SVn5osV7V_T2-BtXAD5bSXvCsgcXGg-Vnhfv-YRq6R_u2ne50cYXEO1kTWw7TqUD6VdLSP3GPCIObFNRoi65NmxMW7_PilDEcN6LPU1Ql907VfeSmZlRuZ_nKxP1XM-1aT28hgtdu-lMA0bD9c6U7Q44McPV2w&cb=mr7m5vp8npo1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:42:55 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Thu, 18 Apr 2024 14:42:55 GMT Date: Thu, 18 Apr 2024 14:42:55 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:42:55 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__en.js');
2024-04-18 14:42:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49728	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:55 UTC	1309	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:42:55 UTC	706	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 18 Apr 2024 09:07:01 GMT Expires: Fri, 26 Apr 2024 09:07:01 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 20154 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:42:55 UTC	549	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C;I
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4S4S
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-04-18 14:42:55 UTC	1116	IN	Data Raw: 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49729	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:55 UTC	1498	OUT	GET /recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D7zip%26oq%3D7zip%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOdIBCDEyNjJqMGo3qAIAsAIA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRRtTk0GOrihLEGIjDncaOX7h5agDML-_J39PqAZeZyl4N1vdca56wLBd_o0sqwelo3iqnzIfwGjYHh1C8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:42:55 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 18 Apr 2024 14:42:55 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-3fqYsJR6-EVcz79IDqESFg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:42:55 UTC	364	IN	Data Raw: 31 64 31 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 Data Ascii: 1d11<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e Data Ascii: v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fon
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 Data Ascii: 20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E0
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b Data Ascii: U+04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b Data Ascii: ce { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+
2024-04-18 14:42:55 UTC	1255	IN	Data Raw: 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 Data Ascii: tic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight
2024-04-18 14:42:55 UTC	810	IN	Data Raw: 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 33 66 71 59 73 4a 52 36 2d 45 56 63 7a 37 39 49 44 71 45 53 46 67 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f Data Ascii: }</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/styles__ltr.css"><script nonce="3fqYsJR6-EVcz79IDqESFg" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.co
2024-04-18 14:42:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49730	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:57 UTC	1198	OUT	POST /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 9688 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:42:57 UTC	9688	OUT	Data Raw: 0a 18 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 12 ce 10 30 33 41 46 63 57 65 41 37 68 73 46 43 44 30 42 58 72 73 4c 6d 32 39 39 69 49 71 78 51 66 32 4d 52 6e 56 41 6d 64 39 6c 51 51 57 41 65 34 69 51 4b 41 6b 34 71 74 58 4c 61 65 64 78 53 4c 50 6b 57 4f 52 59 70 5f 6d 5a 79 57 2d 35 77 74 71 35 55 53 30 78 55 77 6f 70 48 45 51 5f 4b 54 37 31 58 44 45 62 49 59 32 32 58 45 31 36 34 4d 44 6d 67 4e 57 50 69 6c 4a 67 6e 44 32 6d 51 47 77 56 63 4c 65 5f 76 54 66 6a 39 51 46 76 58 55 35 38 59 71 4e 34 4a 6f 69 6b 39 57 45 36 52 48 47 31 58 6f 55 65 4b 62 78 46 5f 71 4e 55 67 56 4e 51 4f 62 43 73 34 67 77 35 56 64 64 4e 65 65 4d 35 64 35 41 6d 4a 36 30 6c 75 6e 78 44 37 36 33 6b 70 78 31 45 53 41 6b 30 68 63 72 37 52 70 73 74 4e 48 Data Ascii: QoukH5jSO3sKFzVEA7Vc8VgC03AFcWeA7hsFCD0BXrsLm299iIqxQf2MRnVAmd9lQQWAe4iQKAk4qtXLaedxSLPkWORYp_mZyW-5wtq5US0xUwopHEQ_KT71XDEbIY22XE164MDmgNWPilJgnD2mQGwVcLe_vTfj9QFvXU58YqN4Joik9WE6RHG1XoUeKbxF_qNUgVNQObCs4gw5VddNeeM5d5AmJ60lunxD763kpx1ESAk0hcr7RpstNH
2024-04-18 14:42:57 UTC	696	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Thu, 18 Apr 2024 14:42:57 GMT Expires: Thu, 18 Apr 2024 14:42:57 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts;Path=/recaptcha;Expires=Tue, 15-Oct-2024 14:42:57 GMT;Secure;HttpOnly;Priority=HIGH;SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:42:57 UTC	559	IN	Data Raw: 32 33 35 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 35 4e 54 4f 5f 6a 44 49 48 4b 36 78 4d 44 31 58 4f 32 51 35 6c 52 6f 63 4e 77 43 52 6b 76 49 6e 49 6b 79 70 56 66 78 2d 4a 54 6a 31 55 6f 46 31 41 73 6e 4f 36 4e 4b 6d 5f 6a 73 64 76 5a 70 65 59 6d 5f 70 39 53 6f 72 30 44 46 72 36 56 7a 45 42 61 55 35 78 72 48 79 75 52 6b 73 49 59 74 48 4e 32 79 4e 74 6a 2d 4b 66 37 4b 75 6c 4a 36 74 63 4a 78 7a 68 44 6d 43 5a 44 56 41 46 54 53 6a 30 71 58 50 59 32 71 6b 7a 47 39 54 30 50 68 57 6a 70 73 76 34 53 68 39 50 54 68 6c 30 67 71 51 79 76 79 51 74 6f 52 2d 4b 31 69 36 44 36 4b 55 75 77 77 72 57 6b 39 56 37 2d 34 36 70 39 2d 70 74 4a 52 5f 64 4f 61 46 43 47 35 54 55 7a 34 74 34 43 73 31 42 45 48 2d 71 65 4b 37 78 66 39 45 63 6a 76 Data Ascii: 235)]}'["rresp","03AFcWeA5NTO_jDIHK6xMD1XO2Q5lRocNwCRkvInIkypVfx-JTj1UoF1AsnO6NKm_jsdvZpeYm_p9Sor0DFr6VzEBaU5xrHyuRksIYtHN2yNtj-Kf7KulJ6tcJxzhDmCZDVAFTSj0qXPY2qkzG9T0PhWjpsv4Sh9PThl0gqQyvyQtoR-K1i6D6KUuwwrWk9V7-46p9-ptJR_dOaFCG5TUz4t4Cs1BEH-qeK7xf9Ecjv
2024-04-18 14:42:57 UTC	13	IN	Data Raw: 78 53 41 61 35 39 5f 51 6a 4d 34 0d 0a Data Ascii: xSAa59_QjM4
2024-04-18 14:42:57 UTC	1255	IN	Data Raw: 61 34 37 0d 0a 7a 77 30 55 61 4a 47 34 70 57 70 44 78 4c 77 49 73 2d 4b 57 36 4e 45 42 50 6a 51 76 32 44 74 58 4f 4d 31 7a 44 6a 65 33 6d 2d 44 4e 34 4d 6d 64 54 69 56 47 4b 63 6b 69 74 58 63 42 64 72 56 41 4b 34 71 54 31 4c 5f 42 46 62 48 6c 34 31 74 47 6d 33 55 79 55 61 36 31 57 54 34 73 6c 4e 30 45 68 6c 42 53 50 4b 77 4e 77 69 6c 43 53 47 4e 36 6e 65 62 50 47 54 67 63 43 4b 61 49 55 44 58 59 36 78 4e 56 6e 55 4a 30 79 46 35 59 6a 73 71 51 54 6c 73 50 30 55 4b 52 70 51 63 5f 76 59 57 6b 79 64 5f 33 4a 33 6b 6b 4c 48 42 78 4c 67 48 4c 4b 78 74 50 47 5a 68 38 31 4b 4b 56 71 53 4e 4d 42 67 73 72 62 54 53 79 55 38 47 76 70 77 50 74 52 36 6d 76 4c 33 67 47 38 49 69 64 35 66 5f 53 46 62 54 67 59 46 4c 32 76 62 69 70 54 75 2d 65 55 44 65 7a 77 57 47 7a 42 45 Data Ascii: a47zw0UaJG4pWpDxLwIs-KW6NEBPjQv2DtXOM1zDje3m-DN4MmdTiVGKckitXcBdrVAK4qT1L_BFbHl41tGm3UyUa61WT4slN0EhlBSPKwNwilCSGN6nebPGTgcCKaIUDXY6xNVnUJ0yF5YjsqQTlsP0UKRpQc_vYWkyd_3J3kkLHBxLgHLKxtPGZh81KKVqSNMBgsrbTSyU8GvpwPtR6mvL3gG8Iid5f_SFbTgYFL2vbipTu-eUDezwWGzBE
2024-04-18 14:42:57 UTC	1255	IN	Data Raw: 4b 56 4b 6a 54 58 49 41 34 46 77 4c 66 64 34 77 36 63 2d 49 54 62 49 64 76 4e 39 39 6e 50 7a 45 68 52 67 30 47 55 78 34 64 69 47 6c 6d 79 6a 78 43 41 71 36 63 49 41 64 74 78 33 70 6c 2d 58 76 66 6a 30 49 67 41 66 42 66 63 34 4a 6c 69 63 49 6e 56 33 57 33 34 43 46 57 6a 51 64 4d 32 44 52 6b 79 47 36 46 2d 79 5a 50 71 50 33 4a 6d 54 76 6b 78 45 49 75 6a 55 67 57 39 46 4f 52 6f 61 79 55 68 65 79 43 32 32 77 41 41 59 78 5f 76 49 58 45 32 56 37 6a 56 46 62 78 6a 57 37 78 63 49 64 50 79 56 47 79 62 41 6a 65 46 6f 68 75 38 4b 50 62 37 36 5a 67 50 44 76 70 59 31 36 63 4c 61 6d 64 64 41 2d 42 4a 66 6e 68 61 4b 76 6d 78 45 4a 6b 34 74 58 37 7a 33 49 57 45 75 53 46 6f 38 49 6b 32 70 6b 67 37 79 69 5a 67 52 30 50 6f 4b 39 76 7a 45 52 5a 41 6a 47 6f 61 55 4c 66 71 6c Data Ascii: KVKjTXIA4FwLfd4w6c-ITbIdvN99nPzEhRg0GUx4diGlmyjxCAq6cIAdtx3pl-Xvfj0IgAfBfc4JlicInV3W34CFWjQdM2DRkyG6F-yZPqP3JmTvkxEIujUgW9FORoayUheyC22wAAYx_vIXE2V7jVFbxjW7xcIdPyVGybAjeFohu8KPb76ZgPDvpY16cLamddA-BJfnhaKvmxEJk4tX7z3IWEuSFo8Ik2pkg7yiZgR0PoK9vzERZAjGoaULfql
2024-04-18 14:42:57 UTC	128	IN	Data Raw: 31 51 79 53 32 4a 49 49 74 62 6b 46 46 32 6a 2d 55 6c 45 6d 31 45 4f 31 71 6d 70 53 5f 59 49 67 47 6e 31 6a 6f 67 31 43 33 35 4c 52 2d 71 77 45 39 45 66 45 62 4b 39 6a 4e 53 61 5a 50 6a 63 45 42 4b 37 46 77 55 39 61 4d 4c 43 6d 65 42 4e 73 49 73 34 51 75 78 5f 56 38 56 43 6c 65 77 37 4e 6b 4c 70 79 68 4f 36 6c 50 58 41 5a 68 52 62 61 51 6b 49 39 65 34 73 43 74 6f 71 71 71 62 0d 0a Data Ascii: 1QyS2JIItbkFF2j-UlEm1EO1qmpS_YIgGn1jog1C35LR-qwE9EfEbK9jNSaZPjcEBK7FwU9aMLCmeBNsIs4Qux_V8VClew7NkLpyhO6lPXAZhRbaQkI9e4sCtoqqqb
2024-04-18 14:42:57 UTC	1255	IN	Data Raw: 34 34 32 30 0d 0a 36 59 76 53 76 36 5f 37 2d 39 33 45 52 70 33 48 6a 72 58 31 30 71 4a 4a 36 57 76 34 37 35 6e 6f 46 66 70 52 37 34 43 53 45 6b 31 78 2d 32 50 72 4b 6d 37 63 33 6f 4f 72 49 4d 6b 45 65 63 54 64 32 59 6b 74 52 39 48 65 36 52 49 43 4b 57 61 57 51 41 47 72 48 33 70 48 73 54 4a 6d 52 63 76 46 52 6d 64 4a 4b 4c 32 45 74 67 41 55 61 57 48 4e 31 6f 68 58 6f 4d 77 44 31 71 4a 46 72 48 6f 34 6f 58 72 63 35 39 39 76 36 73 46 79 4f 64 42 64 75 4a 63 34 59 31 54 66 42 53 41 42 4f 77 70 65 6d 5a 39 45 6b 65 32 6d 68 46 6c 4b 4a 56 30 41 74 46 4d 30 72 62 30 2d 46 79 44 78 58 56 67 30 69 30 7a 79 6f 51 49 66 79 59 49 55 4b 55 4b 50 4f 66 4a 7a 50 79 46 69 4d 66 49 6f 48 37 74 42 34 75 6c 32 32 73 37 46 57 36 6c 53 4e 73 6a 79 6f 79 45 69 7a 30 46 2d 6c Data Ascii: 44206YvSv6_7-93ERp3HjrX10qJJ6Wv475noFfpR74CSEk1x-2PrKm7c3oOrIMkEecTd2YktR9He6RICKWaWQAGrH3pHsTJmRcvFRmdJKL2EtgAUaWHN1ohXoMwD1qJFrHo4oXrc599v6sFyOdBduJc4Y1TfBSABOwpemZ9Eke2mhFlKJV0AtFM0rb0-FyDxXVg0i0zyoQIfyYIUKUKPOfJzPyFiMfIoH7tB4ul22s7FW6lSNsjyoyEiz0F-l
2024-04-18 14:42:57 UTC	1255	IN	Data Raw: 53 6f 5f 77 38 2d 6f 72 78 35 57 36 75 68 4a 62 66 2d 56 65 49 77 71 67 37 54 53 35 65 53 73 48 35 68 42 4a 57 6f 5f 75 46 38 61 31 56 4d 54 4f 6c 39 6a 4c 57 4f 66 58 50 4c 78 31 2d 63 6e 7a 37 6c 57 4b 35 6b 58 51 65 66 72 72 7a 48 73 4e 4c 76 42 71 74 45 53 39 59 32 69 6a 6c 66 42 58 41 75 6d 6a 31 55 2d 75 71 75 59 52 33 41 4b 49 71 2d 4c 67 6d 71 65 77 4d 30 6c 77 46 5f 42 5f 7a 54 79 6b 4f 57 4f 73 6e 4f 32 41 50 63 5f 78 4d 66 54 71 6f 71 6c 57 53 63 33 41 65 4f 59 43 36 36 4c 35 58 4f 61 58 37 69 65 45 2d 36 41 30 46 72 43 71 6d 76 63 33 7a 38 46 42 78 62 79 62 6c 69 32 54 42 32 47 5f 5a 56 64 43 6a 79 6b 65 59 62 44 49 32 55 5a 68 4d 54 78 61 65 6b 32 2d 58 58 63 57 78 2d 66 50 50 62 74 53 57 2d 44 57 36 67 53 63 7a 65 73 7a 34 31 5a 71 70 44 37 Data Ascii: So_w8-orx5W6uhJbf-VeIwqg7TS5eSsH5hBJWo_uF8a1VMTOl9jLWOfXPLx1-cnz7lWK5kXQefrrzHsNLvBqtES9Y2ijlfBXAumj1U-uquYR3AKIq-LgmqewM0lwF_B_zTykOWOsnO2APc_xMfTqoqlWSc3AeOYC66L5XOaX7ieE-6A0FrCqmvc3z8FBxbybli2TB2G_ZVdCjykeYbDI2UZhMTxaek2-XXcWx-fPPbtSW-DW6gSczesz41ZqpD7
2024-04-18 14:42:57 UTC	1255	IN	Data Raw: 4e 42 61 63 6f 36 6f 67 68 6b 43 4f 56 54 38 70 54 72 5f 2d 41 6c 6c 73 43 36 72 43 6f 67 50 4e 6b 65 61 47 7a 6e 69 47 78 52 43 64 62 31 34 77 59 64 46 6b 68 33 64 35 58 51 44 43 67 46 38 63 4a 5a 59 44 49 4b 41 6d 4f 6b 6c 44 4b 6d 62 66 52 49 77 32 30 4a 59 70 57 22 2c 6e 75 6c 6c 2c 31 32 30 2c 5b 22 70 6d 65 74 61 22 2c 5b 22 2f 6d 2f 30 6b 34 6a 22 2c 6e 75 6c 6c 2c 33 2c 33 2c 33 2c 6e 75 6c 6c 2c 22 62 75 73 22 5d 2c 6e 75 6c 6c 2c 5b 31 5d 5d 2c 22 64 79 6e 61 6d 69 63 22 2c 6e 75 6c 6c 2c 5b 22 62 67 64 61 74 61 22 2c 22 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 4a 63 30 68 56 62 47 45 33 64 44 52 6a 53 7a 56 72 54 30 46 69 4e 6d 4e 33 59 30 4a 70 55 46 45 31 53 47 35 56 61 6b 31 55 57 6e 56 78 Data Ascii: NBaco6oghkCOVT8pTr_-AllsC6rCogPNkeaGzniGxRCdb14wYdFkh3d5XQDCgF8cJZYDIKAmOklDKmbfRIw20JYpW",null,120,["pmeta",["/m/0k4j",null,3,3,3,null,"bus"],null,[1]],"dynamic",null,["bgdata","Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9Jc0hVbGE3dDRjSzVrT0FiNmN3Y0JpUFE1SG5Vak1UWnVx
2024-04-18 14:42:57 UTC	1255	IN	Data Raw: 46 48 51 6b 39 4b 63 6a 5a 56 55 57 64 78 61 79 73 7a 4d 6b 31 30 63 6c 68 33 59 6b 31 45 59 6d 59 77 54 58 6f 76 5a 47 6c 48 56 44 64 76 56 47 52 52 59 58 46 69 53 6e 70 53 65 6b 4a 4f 55 48 6f 30 54 6d 56 32 65 6d 46 4f 63 33 55 31 56 47 56 71 55 33 42 4c 65 48 6b 76 51 55 6c 4c 52 58 6c 49 4e 31 4a 6b 5a 57 52 30 4b 7a 4e 31 65 56 42 52 64 54 46 43 4e 57 74 55 62 33 56 47 63 30 68 71 64 56 70 79 5a 46 5a 54 4e 30 31 76 5a 54 49 33 5a 6d 6c 55 55 33 4a 70 65 46 52 36 55 56 42 53 55 32 6f 72 62 32 35 74 55 45 78 4b 53 6c 68 56 4e 47 78 71 63 6c 6b 72 59 32 39 72 56 43 39 6d 64 30 46 49 62 45 70 31 53 6d 6c 35 4e 30 78 33 61 6c 5a 79 55 6b 52 50 55 48 59 79 4f 54 45 76 53 45 74 61 55 57 5a 61 54 69 38 77 63 32 77 78 64 44 42 35 52 54 4d 72 57 55 39 70 61 Data Ascii: FHQk9KcjZVUWdxayszMk10clh3Yk1EYmYwTXovZGlHVDdvVGRRYXFiSnpSekJOUHo0TmV2emFOc3U1VGVqU3BLeHkvQUlLRXlIN1JkZWR0KzN1eVBRdTFCNWtUb3VGc0hqdVpyZFZTN01vZTI3ZmlUU3JpeFR6UVBSU2orb25tUExKSlhVNGxqclkrY29rVC9md0FIbEp1Sml5N0x3alZyUkRPUHYyOTEvSEtaUWZaTi8wc2wxdDB5RTMrWU9pa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49735	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:42:57 UTC	1479	OUT	GET /recaptcha/api2/payload?p=06AFcWeA6zzF3weexsGQsiWg04-ruhQ_tnzyde1vKlIfQTjXALVxjLUHt7ksR07qCbedVXCdf7altNdSUGcUkuXTtpWJYU1TmqYTGYMjngvfu5iz-u-r_yqaBbwk7wABh0-URfontoaNLPwu0FJLJ3KzNq-OXDV7kkFUISOHGokyjqXj72tyoda8Fi-G9Z9RyFs1grPBTrsdf7&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:42:58 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 18 Apr 2024 14:42:58 GMT Date: Thu, 18 Apr 2024 14:42:58 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:42:58 UTC	836	IN	Data Raw: 41 36 39 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: A694JFIFC!"$"$C,,"}!1AQa"q
2024-04-18 14:42:58 UTC	1255	IN	Data Raw: 37 65 77 6d 27 0f 9d dc f0 79 e4 e6 a2 58 cd 3b 34 92 83 e6 cb 95 62 84 31 20 93 80 58 74 18 5e 9c 12 47 d2 bd 5a 54 e1 08 36 9e 87 8f 56 72 9c ae f4 fe bd 3f af 42 9c 36 f3 2c d2 c6 5e 35 77 25 4b a6 1c c8 a7 27 21 76 81 b5 36 b7 6f e2 eb d6 9d 25 b7 12 32 94 58 ce 54 a8 dd 93 b4 1c 72 a3 ef 0d a4 0c 0e 80 f3 82 6a e4 51 49 2a bb 4b 94 2e de 64 71 e0 6d 04 00 76 91 db 07 03 9e 00 1d 78 c1 d9 f0 7e 8d 6b ab de b5 bd e6 e1 08 8c 4f 1c 7b d1 48 c6 06 48 18 3b 4e 41 ed db a7 7a a9 37 08 b9 3e 9f d7 f5 d0 74 e9 39 cd 28 bd ff 00 cf f1 ff 00 80 d1 80 d1 c1 6f 73 13 cf 24 52 c4 5c b1 90 af cb 71 b4 a9 39 e7 38 60 48 c1 07 18 6e d9 07 42 f3 55 bd 85 16 26 d8 93 2a 86 8f 0a 36 29 38 18 f9 78 e8 40 c9 c9 c9 38 e4 e6 bb 7f 13 43 60 9e 45 b9 b3 8e d9 0e d5 57 41 87 Data Ascii: 7ewm'yX;4b1 Xt^GZT6Vr?B6,^5w%K'!v6o%2XTrjQIK.dqmvx~kO{HH;NAz7>t9(os$R\q98`HnBU&6)8x@8C`EWA
2024-04-18 14:42:58 UTC	1255	IN	Data Raw: 38 e3 8e b5 1c b2 c2 6d 86 cf 31 15 99 54 27 96 1b e5 fb a1 71 8c 29 c1 cf e0 32 72 05 63 ea 5e 24 d3 ad 66 37 42 58 9c a4 0e cf e5 b8 79 06 ec b2 b6 00 e3 96 ea 0f b7 1d 2a c5 ae bf 05 fd bc 77 36 2e 6d d2 e1 03 79 33 0c 30 05 b3 92 a3 ef 6e 04 90 09 1c 9e c4 9a 6e ee 76 fe bf af f8 03 a7 06 e4 92 5a 7f 5e be ba 76 21 f8 a3 b9 7e 1f 6a 6a b3 08 80 58 dd a3 5c f6 74 f9 4a 9e c0 00 73 9c 0c 60 77 35 a2 d1 dc dd 24 92 7d a9 51 24 87 ca 06 21 d5 04 84 9d c3 38 19 21 8e 46 d1 c9 f5 ae 63 e2 de a7 01 f0 35 fc 2b 3d ab 4b 33 aa 15 13 2f ee 8a b0 2a b9 1c ed c2 f6 e4 1e be fd 1b 08 02 37 95 21 09 10 d9 11 93 2f 96 50 36 f6 00 60 37 4c 11 df 03 19 ad e8 72 4b 55 e5 ff 00 03 fa ec 65 34 ee 92 f5 fd 3e 7e 45 c8 56 1b 38 7c a7 56 95 8b 26 ed ce 55 cb 05 01 41 39 f9 Data Ascii: 8m1T'q)2rc^$f7BXyw6.my30nnvZ^v!~jjX\tJs`w5$}Q$!8!Fc5+=K3/7!/P6`7LrKUe4>~EV8\|V&UA9
2024-04-18 14:42:58 UTC	758	IN	Data Raw: 7f 0f 1d 6b 26 d7 50 bb 95 98 40 af a8 18 25 2c 54 ae d2 b8 19 04 03 9c 30 dd f4 c6 6a 7d 5a ea 7b a3 23 d9 ad c9 85 d9 26 79 bb 17 0a 4f 03 1c b6 1c 7c bd 32 73 9a e5 95 39 ce 4f 9b af f5 b6 be bf 72 d4 ed f6 90 84 7d d5 7b 7f c3 5a d6 d3 ba ee 96 d7 b9 83 e3 1f b4 c9 77 2a ea 4c cb 13 46 44 20 44 bb 64 27 3c 1f 9b 3d 5b 20 0e 99 3d 2a 08 f4 6b fb 87 7b 95 0a b0 06 f9 e5 61 c1 3c 77 3d 70 33 db 9e 3d 4e 6c ce 3e d2 c8 65 8c bc f3 96 55 85 65 c2 aa 96 03 e6 cf 5c f6 fa 71 e9 57 45 cd c0 78 60 49 b3 12 b6 14 1f 94 ae 59 4e f2 a0 64 64 90 78 1f f0 21 91 5d 37 94 20 94 37 57 f4 e9 7f bc f3 9c 22 ea 5d bb ff 00 5f e7 ff 00 00 e6 e4 d3 e4 b6 d3 50 3a 5c 34 0a 8b 1a 07 5c b4 a0 e7 81 9e 84 ee 19 3c f4 da 01 e6 bb bd 37 4a d0 f4 ad 26 df 50 98 c8 67 fb 3e f2 b2 Data Ascii: k&P@%,T0j}Z{#&yO\|2s9Or}{ZwLFD Dd'<=[ =k{a<w=p3=Nl>eUe\qWEx`IYNddx!]7 7W"]_P:\4\<7J&Pg>
2024-04-18 14:42:58 UTC	1255	IN	Data Raw: c0 d3 ee 1c 66 e1 4e 3a 59 eb a7 65 bb fc fd 6d 73 ba d7 df c2 92 78 5e 7d 73 43 d1 4c 49 05 d2 c3 21 30 90 fb 76 ae e5 52 79 c6 53 1f 88 23 d2 b9 39 35 a8 9f 4c 92 ee 15 36 f6 ca a1 51 15 08 7f 94 9d dd f8 39 64 38 1c f1 8c e0 1c 53 5d 4f 4a 8a d6 df ec 7a 2d d4 a9 b8 bc b2 95 39 ea 01 c9 38 c6 43 1e 4f 6c 70 30 6a ae ab ac 69 3b a3 11 d9 de c3 03 c6 19 9e 19 d5 09 93 71 f9 be eb 63 9f c4 e0 f1 d2 b2 8d 2e 48 a5 27 7d 7e 7a 79 0d 37 0b 41 3b eb d7 7b 5f cb 4d be 66 ec 9a fe 85 3f 87 bc b8 b4 e1 3c 6a 24 48 dd 9b 69 e8 be 66 0f 5c 10 46 0f 41 b7 1c 71 9a 36 da 82 8b 55 bb 81 52 e2 36 98 cd 14 91 e3 ae e1 b9 18 0e 84 64 63 a6 41 03 1d aa 95 fe a4 63 32 26 99 67 6d 60 1b 31 4e c2 50 db c8 3c 06 1d f8 e7 18 fe 21 cf 07 11 e8 6d a8 c1 65 23 5b 5f 31 8a 41 b7 Data Ascii: fN:Yemsx^}sCLI!0vRyS#95L6Q9d8S]OJz-98COlp0ji;qc.H'}~zy7A;{_Mf?<j$Hif\FAq6UR6dcAc2&gm`1NP<!me#[_1A
2024-04-18 14:42:58 UTC	1255	IN	Data Raw: fd 6c 32 ee 65 8e 55 32 17 67 6e 42 b9 46 09 b7 1f c3 83 c1 f9 b1 c1 ef c0 e7 1b 11 5b 3b ef f3 63 37 45 5b 0b 28 b6 12 06 18 07 86 5e 08 e6 b1 e7 94 c5 28 8d 9a 69 a2 2d 97 54 00 13 92 7e 40 b9 eb c0 38 00 02 3f 0a 9d 6e a7 5c 81 1d 9d c8 07 89 65 27 2d ee 00 5e 07 ff 00 af bd 67 56 2e 51 49 3b 7f 5e 61 fb ff 00 f9 72 ec fc dd bf 46 36 3d 1a ea ee 7b 8b 8b 88 be cf 6f 23 64 86 66 32 60 f5 51 ed c8 c8 04 e7 af 3d a1 b7 d2 b5 19 21 8e 4b 85 2c 2e 10 9c ff 00 ab c1 0c 00 20 77 e0 64 73 df 3c 9a 5b 99 ee 5e 33 b5 98 b0 06 64 7d ff 00 ba 62 76 8e 4e 7a f5 e3 39 cd 3b 52 9e 38 5e 37 b8 09 e5 46 a3 ee b0 28 40 38 08 40 3c 82 33 83 8e fd 05 7a 1e d2 5d d5 bf 1d ba 7a fe 96 b1 c6 f9 1b 49 6e df cf cb d7 4b 3f c3 a1 15 ba 3a c2 63 3e 74 ec 72 17 64 40 b3 29 55 ce Data Ascii: l2eU2gnBF[;c7E[(^(i-T~@8?n\e'-^gV.QI;^arF6={o#df2`Q=!K,. wds<[^3d}bvNz9;R8^7F(@8@<3z]zInK?:c>trd@)U
2024-04-18 14:42:58 UTC	1255	IN	Data Raw: f4 1c 54 f7 2d 64 b3 36 d8 d5 16 64 78 65 44 63 f2 20 da 00 2c de e5 57 8e e0 1c 0c e2 9b 94 23 26 f5 d7 ee fe b7 fc 8a 8b e5 76 be bd 3f 1f f2 6b ee 33 96 df 5a b8 b2 f3 21 80 46 ac a4 05 0c a3 fb dc 8c 96 61 93 83 eb d0 76 a7 e9 ba 5f da 5e 1b 97 ba 51 69 1b 1d c8 63 62 ae 8a 08 ca ee 18 e7 83 8e a0 81 de a6 86 49 22 81 88 b7 92 18 54 6e 67 55 52 62 db 19 c0 23 07 03 e5 60 49 18 18 3c 9e 69 25 b9 90 db c6 0b 9f 32 44 26 40 a4 3e 58 90 d8 00 7c a3 6f cc 33 83 d0 f1 c5 65 1a a9 a7 cb a7 f5 fd 75 e8 55 3d da f9 2d fa ef 7e 82 c5 63 a7 82 fe 64 af 3c cf 26 76 06 dc 36 71 f3 05 1d 0e 40 ea 06 4f 6c 75 96 ce 78 3f 76 b1 40 7e ce ae ca ec 9e 58 d8 aa 70 80 91 d4 64 1c f6 e0 f5 14 e5 9a 2f 38 3c ef 2a 6d 5d b1 b3 48 a1 8c 67 95 c6 31 c0 2a d9 e0 e3 a7 35 49 e6 Data Ascii: T-d6dxeDc ,W#&v?k3Z!Fav_^QicbI"TngURb#`I<i%2D&@>X\|o3euU=-~cd<&v6q@Olux?v@~Xpd/8<m]Hg15I
2024-04-18 14:42:58 UTC	1255	IN	Data Raw: ac 4a 25 aa 90 33 cf f2 23 d6 9b 9a f9 fa 5c d2 35 15 29 73 4a 29 ef bb 6b f1 b3 3a 88 74 db 0d a9 6d 73 ad de de 48 43 83 27 da b6 ac 81 b6 81 c8 19 c6 7b e4 f3 9f 7a 66 a7 63 e1 35 92 59 de 2d 46 5b 7c 29 95 63 9d b2 ca 03 6d f9 42 e0 0e 08 cf 5f 98 77 e9 d0 47 e1 eb 66 81 ee 05 f4 b2 90 84 48 22 5d a4 3e e2 4a a9 24 9c 73 e9 d3 f4 89 34 ad 02 d7 4d 98 dd 4a cc 93 c8 5b 6e 44 6d f2 82 08 5c ae 49 39 1c 67 b1 f7 c7 9e aa 28 be 69 cd e8 ec bc f6 6f cb 6b 3f 2b 1b c6 0d c9 ca 51 d3 6e 9f 92 d1 77 5d 37 33 20 d1 fc 2f 13 5c 23 e9 66 4b a7 91 dd 64 2e e7 9d 98 19 01 bb 8c 9f 5e d8 a4 bc b1 f0 54 b6 e1 9f 43 41 03 64 12 ce e1 46 36 a8 45 25 86 0f cb dc f4 35 af 9d 01 e0 8e e6 3b 63 34 8f 3b b3 ed dc 4b 70 39 24 9c e1 71 9f 4e 9e 84 d4 d2 de e8 d1 c0 a9 1e 8d Data Ascii: J%3#\5)sJ)k:tmsHC'{zfc5Y-F[\|)cmB_wGfH"]>J$s4MJ[nDm\I9g(iok?+Qnw]73 /\#fKd.^TCAdF6E%5;c4;Kp9$qN
2024-04-18 14:42:58 UTC	1255	IN	Data Raw: c1 05 b0 48 e0 9c ee 23 d4 91 d7 26 a2 8c 31 9b ce 78 94 46 ec 17 19 e4 12 70 bc e3 a7 03 23 23 8c 0c 73 53 4c b1 0b 26 6b 9b 81 1b 6d f2 82 ec 5d c8 0b 02 49 55 c6 78 c6 57 6e 3a 51 65 06 a1 2f c3 f4 fe ba 13 cd 4b aa dd ff 00 c0 f9 eb af 75 bf 91 1c 91 49 2a c6 eb 13 33 ef 06 38 65 5c 70 72 7a af af cf f2 e7 82 4f 5a b0 be 4f d8 da 3b 64 8f 62 0c cc ce 98 66 5f 90 11 b7 20 01 d3 9c 0e dd 3a d5 69 55 6e 19 e4 95 e5 d9 23 9d bb 97 1b a3 18 38 c1 cf 65 1f 83 0f 6a 9e d9 02 36 c9 a6 8d d9 76 c6 04 88 50 75 e8 54 64 05 3b 79 e3 8e d5 52 70 de 5f d7 73 65 c9 cb 7d bf e1 b5 fb 9f e3 af 5d 14 7e f3 6d cd cb 45 1b aa 9c 79 48 aa db 77 1c 0e bd 58 e7 23 3e b9 a7 7d 94 c6 1a 2b 96 8d 41 61 bd c9 c0 7c b0 24 80 30 41 2d d8 77 23 af 66 b3 e2 e1 a2 0e 14 85 55 91 36 Data Ascii: H#&1xFp##sSL&km]IUxWn:Qe/KuI*38e\przOZO;dbf_ :iUn#8ej6vPuTd;yRp_se}]~mEyHwX#>}+Aa\|$0A-w#fU6
2024-04-18 14:42:58 UTC	1255	IN	Data Raw: c9 ea 47 11 ab f8 9b c5 b6 1f 3d b6 8d 64 81 49 6f de 3b cd 27 0c dd 54 91 c7 de ce 06 3b d7 9c b0 b3 af 1b 45 25 a7 5f 5b fe 3a 6b 6f 22 e5 46 5e c5 3e 5f 75 f5 e9 d6 eb 4e ad db cb 65 63 ba b6 d3 97 4d b8 0c 9b 51 19 40 21 22 f9 e2 dc 48 c1 1e 98 50 33 d7 f2 39 d0 b3 4f b4 a3 4b 24 92 bb b8 72 e0 f0 80 74 3c 01 f2 f3 8e be 9c e4 8e 3c 2e f7 c7 fe 2e 12 4d 14 37 0b 62 d2 ca 4b ac 10 aa b1 ca e3 1c 82 70 77 7a f7 cd 66 cb 79 e2 6b f5 64 97 51 d4 66 52 ac bb 64 b8 65 18 3e b9 23 b9 15 b7 f6 5c da f7 9e b6 b7 e1 d7 fe 03 f3 30 bc ed cd 17 d3 fa d7 f0 f4 f3 3e 87 b8 bf b6 d3 e3 cd d4 b6 b6 80 b0 44 49 65 8e 2e d9 01 b7 11 8e ac 01 03 b7 35 c3 7c 4c be b5 d5 ad f4 fb 6d 32 e6 1b 9b 48 77 b3 8b 39 55 c8 65 d8 02 13 c8 63 8e fd 87 7c 57 8f 5c 2c b1 91 2c c1 83 Data Ascii: G=dIo;'T;E%_[:ko"F^>_uNecMQ@!"HP39OK$rt<<..M7bKpwzfykdQfRde>#\0>DIe.5\|Lm2Hw9Uec\|W\,,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49741	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:00 UTC	1329	OUT	POST /recaptcha/api2/replaceimage?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 5814 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://www.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:00 UTC	5814	OUT	Data Raw: 76 3d 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 26 63 3d 30 33 41 46 63 57 65 41 35 4e 54 4f 5f 6a 44 49 48 4b 36 78 4d 44 31 58 4f 32 51 35 6c 52 6f 63 4e 77 43 52 6b 76 49 6e 49 6b 79 70 56 66 78 2d 4a 54 6a 31 55 6f 46 31 41 73 6e 4f 36 4e 4b 6d 5f 6a 73 64 76 5a 70 65 59 6d 5f 70 39 53 6f 72 30 44 46 72 36 56 7a 45 42 61 55 35 78 72 48 79 75 52 6b 73 49 59 74 48 4e 32 79 4e 74 6a 2d 4b 66 37 4b 75 6c 4a 36 74 63 4a 78 7a 68 44 6d 43 5a 44 56 41 46 54 53 6a 30 71 58 50 59 32 71 6b 7a 47 39 54 30 50 68 57 6a 70 73 76 34 53 68 39 50 54 68 6c 30 67 71 51 79 76 79 51 74 6f 52 2d 4b 31 69 36 44 36 4b 55 75 77 77 72 57 6b 39 56 37 2d 34 36 70 39 2d 70 74 4a 52 5f 64 4f 61 46 43 47 35 54 55 7a 34 74 34 43 73 31 42 45 48 2d 71 65 Data Ascii: v=QoukH5jSO3sKFzVEA7Vc8VgC&c=03AFcWeA5NTO_jDIHK6xMD1XO2Q5lRocNwCRkvInIkypVfx-JTj1UoF1AsnO6NKm_jsdvZpeYm_p9Sor0DFr6VzEBaU5xrHyuRksIYtHN2yNtj-Kf7KulJ6tcJxzhDmCZDVAFTSj0qXPY2qkzG9T0PhWjpsv4Sh9PThl0gqQyvyQtoR-K1i6D6KUuwwrWk9V7-46p9-ptJR_dOaFCG5TUz4t4Cs1BEH-qe
2024-04-18 14:43:00 UTC	483	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 14:43:00 GMT Expires: Thu, 18 Apr 2024 14:43:00 GMT Cache-Control: private, max-age=0 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:43:00 UTC	772	IN	Data Raw: 61 36 30 0d 0a 29 5d 7d 27 0a 5b 22 64 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 37 61 4a 46 2d 41 57 4a 79 52 64 58 64 74 79 39 30 4f 57 52 77 4a 75 51 47 2d 53 4c 48 51 59 33 54 68 72 33 42 63 41 45 55 48 67 76 68 62 62 57 46 67 48 52 69 46 45 31 33 4a 64 72 30 62 53 4b 67 55 6e 32 79 69 73 2d 44 5a 2d 67 65 4f 55 4f 67 67 36 57 46 32 56 6f 42 41 72 35 41 4d 65 73 4b 71 4b 56 49 5a 31 6f 52 4a 74 35 75 67 31 41 6e 57 36 47 56 4a 5f 74 65 6b 2d 43 44 5f 64 72 31 70 68 38 49 32 38 68 42 65 6d 33 44 6c 52 64 74 72 34 39 44 61 6b 5a 51 36 71 56 4b 56 67 77 47 63 4d 2d 31 76 38 47 72 58 72 4e 68 39 50 5a 65 38 31 6e 49 4b 73 4d 64 4c 36 39 45 55 6f 53 41 38 44 39 35 4e 44 79 43 36 75 71 6c 37 79 41 32 68 4e 69 4c 71 49 41 69 53 75 34 59 66 44 39 72 58 49 Data Ascii: a60)]}'["dresp","03AFcWeA7aJF-AWJyRdXdty90OWRwJuQG-SLHQY3Thr3BcAEUHgvhbbWFgHRiFE13Jdr0bSKgUn2yis-DZ-geOUOgg6WF2VoBAr5AMesKqKVIZ1oRJt5ug1AnW6GVJ_tek-CD_dr1ph8I28hBem3DlRdtr49DakZQ6qVKVgwGcM-1v8GrXrNh9PZe81nIKsMdL69EUoSA8D95NDyC6uql7yA2hNiLqIAiSu4YfD9rXI
2024-04-18 14:43:00 UTC	1255	IN	Data Raw: 61 4e 4c 43 67 72 48 50 76 4c 57 70 79 68 43 50 64 57 53 7a 73 42 71 42 35 2d 79 36 6e 4a 53 37 6e 39 78 48 6e 31 57 43 55 4a 31 37 75 6d 58 52 32 45 63 4c 52 52 34 37 30 51 4f 4e 4e 68 41 39 56 31 4b 36 63 6d 42 75 6c 4c 31 2d 44 37 44 4b 56 67 73 4c 59 54 4c 56 64 62 44 6d 72 65 61 70 4e 68 51 37 37 4a 4f 52 5a 30 38 68 50 34 71 34 61 52 59 66 56 57 50 30 32 2d 5a 46 73 4e 75 36 4e 57 70 47 6b 71 45 53 78 50 67 30 5f 4d 6f 73 41 4a 4c 31 68 6f 43 59 77 6f 49 57 35 62 30 76 68 6c 41 4f 2d 77 49 35 64 61 6c 79 6a 36 69 55 39 59 6c 4e 6b 5a 56 47 6c 7a 75 7a 67 41 30 6d 4a 45 6c 58 31 5a 59 58 46 71 64 52 75 56 45 51 5a 4f 55 52 5f 64 57 49 79 4e 70 68 72 56 42 69 37 5a 33 34 6e 57 61 58 6f 4e 69 43 42 69 33 42 43 76 67 50 30 39 5a 45 48 67 5a 69 61 63 34 Data Ascii: aNLCgrHPvLWpyhCPdWSzsBqB5-y6nJS7n9xHn1WCUJ17umXR2EcLRR470QONNhA9V1K6cmBulL1-D7DKVgsLYTLVdbDmreapNhQ77JORZ08hP4q4aRYfVWP02-ZFsNu6NWpGkqESxPg0_MosAJL1hoCYwoIW5b0vhlAO-wI5dalyj6iU9YlNkZVGlzuzgA0mJElX1ZYXFqdRuVEQZOUR_dWIyNphrVBi7Z34nWaXoNiCBi3BCvgP09ZEHgZiac4
2024-04-18 14:43:00 UTC	636	IN	Data Raw: 45 65 67 32 67 57 56 34 55 5f 38 57 39 44 32 61 61 50 6a 55 70 66 45 30 6a 4a 62 41 45 79 47 7a 32 51 4b 66 74 42 32 67 69 61 55 34 6d 76 4d 68 4a 71 33 42 4e 4e 79 78 7a 7a 65 72 6d 6f 72 31 77 43 32 6f 55 69 6f 63 67 49 64 5f 6a 6a 6f 50 7a 5a 31 5a 36 73 64 51 61 33 4b 30 50 73 46 72 64 44 62 56 51 77 32 70 67 30 2d 4b 51 6f 70 32 55 49 54 75 6a 72 50 33 43 33 53 61 61 51 65 43 6b 34 31 6c 50 75 68 43 54 64 61 53 6e 64 4f 4a 63 33 6b 6e 54 59 71 4f 6c 74 61 48 52 6e 6b 50 35 4c 67 65 70 6e 58 69 66 73 75 34 47 37 47 4d 50 6c 62 72 75 51 59 5a 6d 56 75 38 72 38 63 54 5a 56 45 4d 73 2d 4a 52 79 53 5a 55 66 4c 45 4a 7a 72 6b 59 4b 45 4f 33 74 52 4b 50 6a 51 6e 5f 77 63 53 6e 41 78 4c 6d 46 53 57 44 4f 74 4b 48 46 54 44 2d 45 4a 56 6a 53 34 54 5f 43 46 4e Data Ascii: Eeg2gWV4U_8W9D2aaPjUpfE0jJbAEyGz2QKftB2giaU4mvMhJq3BNNyxzzermor1wC2oUiocgId_jjoPzZ1Z6sdQa3K0PsFrdDbVQw2pg0-KQop2UITujrP3C3SaaQeCk41lPuhCTdaSndOJc3knTYqOltaHRnkP5LgepnXifsu4G7GMPlbruQYZmVu8r8cTZVEMs-JRySZUfLEJzrkYKEO3tRKPjQn_wcSnAxLmFSWDOtKHFTD-EJVjS4T_CFN
2024-04-18 14:43:00 UTC	1255	IN	Data Raw: 64 34 35 0d 0a 55 77 6b 55 30 78 56 4d 6d 62 4e 34 48 6c 63 50 78 70 31 38 30 2d 2d 33 44 78 74 41 2d 69 77 44 71 75 62 63 32 51 64 42 36 78 6c 46 74 4e 6f 6b 4e 33 36 6c 70 56 55 41 58 67 54 50 54 6a 49 44 61 5f 52 64 36 4a 4d 4e 4c 69 64 75 34 4f 31 6d 39 4c 5f 68 41 34 42 47 75 66 33 6b 72 6f 44 54 74 74 68 77 51 57 30 73 57 4d 73 46 77 6e 31 32 4c 51 33 42 52 7a 6e 5a 6e 41 72 38 45 43 72 70 70 74 45 58 69 67 45 54 42 6a 42 47 30 4e 6f 5f 44 35 54 48 70 59 63 62 4f 77 5f 54 33 42 37 64 45 42 48 33 55 44 54 67 4b 48 71 53 39 42 2d 36 71 41 74 61 54 66 44 31 74 31 57 70 72 32 73 73 65 39 74 65 62 6f 30 44 44 31 6b 44 48 68 39 2d 61 74 66 4c 69 33 63 6f 2d 61 64 56 61 79 65 66 5f 36 4b 74 55 5f 70 49 50 78 30 50 51 46 6d 63 53 4d 45 45 62 71 43 5f 56 74 Data Ascii: d45UwkU0xVMmbN4HlcPxp180--3DxtA-iwDqubc2QdB6xlFtNokN36lpVUAXgTPTjIDa_Rd6JMNLidu4O1m9L_hA4BGuf3kroDTtthwQW0sWMsFwn12LQ3BRznZnAr8ECrpptEXigETBjBG0No_D5THpYcbOw_T3B7dEBH3UDTgKHqS9B-6qAtaTfD1t1Wpr2sse9tebo0DD1kDHh9-atfLi3co-adVayef_6KtU_pIPx0PQFmcSMEEbqC_Vt
2024-04-18 14:43:00 UTC	1255	IN	Data Raw: 30 72 45 53 57 4b 58 61 5a 64 4a 4c 71 53 62 6b 56 75 36 63 68 52 32 55 6e 77 4c 38 66 70 4c 6c 58 6f 47 31 68 32 76 42 6c 35 72 75 76 6f 4d 63 75 75 56 4c 4d 33 32 59 59 79 66 6f 53 35 54 4d 42 42 77 69 61 41 43 54 78 31 74 4e 59 2d 35 55 75 79 43 5f 69 52 42 79 4c 66 69 62 49 33 54 58 6b 49 45 5a 63 4b 64 67 62 61 31 49 54 5a 76 66 6a 74 48 72 52 6e 31 52 33 31 68 5a 46 45 6c 38 35 62 67 63 74 48 6f 47 45 46 61 64 38 2d 71 66 68 41 75 56 50 77 71 77 5a 56 62 49 58 53 50 6b 76 52 73 70 47 4c 58 33 52 6f 6d 33 52 41 75 6d 4f 73 6a 73 4a 67 6e 45 4e 52 37 45 30 4c 4f 2d 69 4e 6e 37 5a 51 6e 38 53 35 68 41 32 6b 48 50 69 74 53 47 63 5f 64 56 68 55 62 74 69 58 39 6f 4c 42 36 41 45 49 34 41 56 49 55 43 6b 65 53 4c 6b 4a 4f 47 44 5a 58 41 66 69 32 71 4c 58 55 Data Ascii: 0rESWKXaZdJLqSbkVu6chR2UnwL8fpLlXoG1h2vBl5ruvoMcuuVLM32YYyfoS5TMBBwiaACTx1tNY-5UuyC_iRByLfibI3TXkIEZcKdgba1ITZvfjtHrRn1R31hZFEl85bgctHoGEFad8-qfhAuVPwqwZVbIXSPkvRspGLX3Rom3RAumOsjsJgnENR7E0LO-iNn7ZQn8S5hA2kHPitSGc_dVhUbtiX9oLB6AEI4AVIUCkeSLkJOGDZXAfi2qLXU
2024-04-18 14:43:00 UTC	894	IN	Data Raw: 34 36 6f 4d 30 53 6c 45 62 57 4f 39 6a 36 78 74 39 57 6f 6a 7a 54 42 76 63 74 5a 37 52 54 62 6f 75 41 31 58 51 7a 78 55 59 73 6c 6a 6e 61 6f 45 57 31 47 32 6a 56 76 48 72 75 55 6d 74 44 62 35 7a 66 43 5f 7a 74 71 61 75 46 75 72 37 7a 43 76 7a 6b 70 59 33 76 5f 56 62 72 59 31 39 55 6d 6a 53 71 75 49 4e 30 33 65 44 67 5a 37 66 37 52 61 34 41 2d 74 5a 4a 56 54 71 43 63 51 32 76 69 66 72 56 39 34 6b 68 6a 41 4f 45 72 4d 43 77 5f 78 6a 48 41 74 48 74 72 4d 45 72 61 68 4a 72 6a 34 79 36 76 57 48 42 38 67 31 41 75 4e 57 5a 56 65 47 65 70 62 46 55 74 66 4f 78 61 4f 44 6e 42 6b 52 73 5f 5a 77 72 4b 42 4f 37 56 7a 75 75 30 69 4c 78 62 52 4d 55 64 36 55 4f 41 4f 6d 68 41 4f 32 6c 50 59 6b 63 54 64 33 68 58 63 62 59 4c 62 59 68 44 66 69 6c 33 47 4e 76 30 56 4e 54 6d Data Ascii: 46oM0SlEbWO9j6xt9WojzTBvctZ7RTbouA1XQzxUYsljnaoEW1G2jVvHruUmtDb5zfC_ztqauFur7zCvzkpY3v_VbrY19UmjSquIN03eDgZ7f7Ra4A-tZJVTqCcQ2vifrV94khjAOErMCw_xjHAtHtrMErahJrj4y6vWHB8g1AuNWZVeGepbFUtfOxaODnBkRs_ZwrKBO7Vzuu0iLxbRMUd6UOAOmhAO2lPYkcTd3hXcbYLbYhDfil3GNv0VNTm
2024-04-18 14:43:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49743	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:00 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mAxnuSGHD3KYcLX&MD=OpGoY+BO HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-18 14:43:00 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: d58ee56b-d12c-44db-95a7-0ac494537068 MS-RequestId: 907f5cee-3f69-4397-bc9c-aedf3d030cd8 MS-CV: /NAiPfjdbkCZiz5Y.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 14:43:00 GMT Connection: close Content-Length: 25457
2024-04-18 14:43:00 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-18 14:43:00 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49745	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:00 UTC	1499	OUT	GET /recaptcha/api2/payload?p=06AFcWeA5EkBAPcMOv8LoW-z9oBGkRrNwkqmrtq_175ZiAFCWhI-dyfruxwN0EDtkBtrIe45FR2B35vqjequ9u7h18hT0EZgUvvCNumA3qqc1Nn-xqxq27UAv_m_wGsMefQh0-uUR_Pqw0MRFz6NSBUxRcoRoZXH2Q2wOpxOB1syaPENODsWo-xZ2DDegCQOWtGbJF25CD4XKk&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=ad1303f5874012dd HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:00 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 18 Apr 2024 14:43:00 GMT Date: Thu, 18 Apr 2024 14:43:00 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:43:00 UTC	1255	IN	Data Raw: 31 33 33 46 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 133FJFIFC!"$"$Cdd"}!1AQa"q
2024-04-18 14:43:00 UTC	1255	IN	Data Raw: fa 1e 87 b5 15 be 9f 12 6d d6 34 11 69 fa da 0c 73 e5 db a8 0d 8e 33 f3 10 7a 01 da 8a c6 5c 89 d9 da fe ac 4e 14 db d5 ff 00 5f 73 fc cf 87 15 a5 19 91 98 c8 a1 43 1e 80 73 db e8 7e 9d 85 48 80 a9 c2 b1 90 0c 30 f9 49 24 63 ae 7d 38 eb ec 3d 69 54 c7 f7 ca 67 fb ab 12 f5 e0 e4 9f cc 7e 94 91 c4 fb 59 f0 9b 98 80 49 1b 9b 1d b7 0f 5c 7d 2b 7b eb 61 79 b2 62 82 52 5b 93 d4 1c 8c 8c 67 a9 39 e7 a6 7f 3e f5 22 23 97 55 50 5e 46 00 2a ed e4 67 f5 ff 00 f5 1a 6c 76 f7 0f 22 f9 6b 23 22 92 14 05 e0 11 fe 03 fa 55 cb 7d 2e e5 64 40 63 1b 0e 7e 67 60 b8 24 e3 df b8 fe 7d 28 d0 76 d5 3e 81 a5 24 51 c5 9b 95 fb 40 f2 b6 f9 60 12 72 49 3d 47 7f f0 a8 75 15 91 5e 20 82 50 23 6f 2f 24 75 19 1d 70 7a 8f 4a d6 d0 b4 b8 ee 6d 52 ea e6 ee 18 51 91 e3 19 8c b0 c6 7b 81 d0 Data Ascii: m4is3z\N_sCs~H0I$c}8=iTg~YI\}+{aybR[g9>"#UP^F*glv"k#"U}.d@c~g`$}(v>$Q@`rI=Gu^ P#o/$upzJmRQ{
2024-04-18 14:43:00 UTC	1255	IN	Data Raw: e9 e8 fb 96 35 90 70 72 46 33 d3 8e 4f 53 f8 d7 63 e2 84 27 4c 77 49 0c 52 ac a9 92 06 15 89 1c fb 71 df b8 cf 7e b5 82 82 84 1a 36 93 e6 eb fd 7f 5f f0 4e 65 a5 81 42 ee b9 9b 25 41 f9 18 a8 e7 ea e3 f9 51 50 ef be c9 58 2e 4c 68 bc 7e e8 9d a7 be 46 06 3b e3 f0 a2 aa 2a eb fe 1c d6 30 ba db f1 5f e4 3f c4 91 aa 5e 2d d4 80 f9 77 6a 27 e9 9d db 87 cc 78 c0 1c 83 f9 8a a4 66 96 de e2 44 47 31 ca aa bb 81 52 a4 8c 0c 0e 3a 80 00 fd 4d 5d 53 1d ee 93 04 04 96 b9 81 ca 9d d8 63 b4 f3 8c 31 ed 8f d7 f0 1b 37 ba 62 6a 76 99 50 df 69 58 c0 49 3c d2 55 59 86 70 7e ad bb 3f d6 ba 67 4d 54 72 6b d7 ef ff 00 82 79 91 a9 c9 64 fc ff 00 af eb f0 39 5b f9 65 0d 04 76 f1 fc ea c1 db 68 19 3b 17 d7 38 ce 33 d2 b5 ef 2c a1 ba d6 e0 95 52 61 f6 b0 8e 98 e5 b1 b4 86 38 3c Data Ascii: 5prF3OSc'LwIRq~6_NeB%AQPX.Lh~F;*0_?^-wj'xfDG1R:M]Sc17bjvPiXI<UYp~?gMTrkyd9[evh;83,Ra8<
2024-04-18 14:43:00 UTC	339	IN	Data Raw: 40 19 8b 64 ed ef f2 83 d0 f0 7f 2f ad 67 6a 7e 4c d7 42 e0 47 22 a3 0f f4 74 03 00 60 e3 91 9e 4e 49 c7 b7 1d f8 63 ea 46 ee f1 56 e8 95 dc 0f 94 a1 55 57 71 c9 3b 81 fc b3 fc aa 1b 96 37 72 ac 92 4e be 64 61 4a ab 9c a9 38 e4 97 f5 19 cf e5 c5 5c 54 79 b9 96 e4 49 ab df b1 ba da 78 de 44 b3 c6 18 60 61 89 72 38 e9 d7 8c 74 c7 b5 15 8f 6f 77 a9 45 10 58 ad 61 6c f2 f8 8c f0 d8 e7 a1 eb 45 35 4e 9b 5b ff 00 5f f8 10 fd ad 65 a4 5c 52 f5 34 86 9e 5a 46 12 10 18 82 85 7a 83 8e 4f 4e 78 c9 ed e9 8c e7 86 4d a7 92 a7 0e 00 50 58 c8 7f e5 90 ed c0 ce 78 03 d3 8f c7 1b 53 2e 9d 6f 1e 26 d4 50 92 01 65 89 01 40 08 c8 39 27 07 ee f7 e0 f3 9f 5a 74 97 f6 51 5c 7c 96 f2 4c 37 89 03 48 e7 0a 8b 9e cb 8f cb 3e e7 9c 54 5b 5b 8f 6d 9f f5 fd 7e 46 3e 9b a6 35 bc a5 e5 Data Ascii: @d/gj~LBG"t`NIcFVUWq;7rNdaJ8\TyIxD`ar8towEXalE5N[_e\R4ZFzONxMPXxS.o&Pe@9'ZtQ\\|L7H>T[[m~F>5
2024-04-18 14:43:00 UTC	829	IN	Data Raw: ad ea db 45 39 2b b6 b7 fb 8b 8d a1 c6 0a 09 9a 05 e0 13 e6 b0 63 ee 71 d8 7f f5 c7 07 92 f7 3a 55 b0 fb 44 da 82 48 c1 49 58 a0 4c 0c 81 d4 13 c6 de 7a 1c f5 27 35 98 f6 36 4b 0c 72 de ea e8 f1 48 bb 18 c7 97 27 d7 a6 32 38 3f 43 d2 ab 5e 6b 3a 15 aa 22 db 9b ab fb 8c 61 96 65 db 1f 5e 80 0e 4f 51 f9 9f 5a 99 c1 b8 dc 8b 3e 52 fc 9a 9e 8d 69 1c a9 1d 8d c1 f2 c1 da d2 c9 81 c0 1c 00 00 1c 83 d4 f3 9a ab 77 e3 09 ed e7 f2 ec ec 2d 50 a3 b1 85 12 35 24 75 1b bf 5f d3 e9 5a de 0d f0 5d 9e b9 19 d4 b5 5b c9 22 b2 2f b6 18 9d c4 60 8e 70 71 9c a8 f4 fa 7b f3 db af 85 b4 bd 18 be a7 0d 9d b2 da 47 18 20 bc 9b ca 81 c2 aa fa e4 11 d0 63 ad 29 54 4d db fa fe bf e1 8e 95 46 52 b7 33 d0 f1 7d 66 eb 5d b9 81 57 54 37 09 0b 80 e0 39 db 8c 8e 4e 33 e8 7a e3 ff 00 ad Data Ascii: E9+cq:UDHIXLz'56KrH'28?C^k:"ae^OQZ>Riw-P5$u_Z]["/`pq{G c)TMFR3}f]WT79N3z
2024-04-18 14:43:00 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-04-18 14:43:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49746	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:01 UTC	1329	OUT	POST /recaptcha/api2/replaceimage?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 5836 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://www.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:01 UTC	5836	OUT	Data Raw: 76 3d 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 26 63 3d 30 33 41 46 63 57 65 41 37 61 4a 46 2d 41 57 4a 79 52 64 58 64 74 79 39 30 4f 57 52 77 4a 75 51 47 2d 53 4c 48 51 59 33 54 68 72 33 42 63 41 45 55 48 67 76 68 62 62 57 46 67 48 52 69 46 45 31 33 4a 64 72 30 62 53 4b 67 55 6e 32 79 69 73 2d 44 5a 2d 67 65 4f 55 4f 67 67 36 57 46 32 56 6f 42 41 72 35 41 4d 65 73 4b 71 4b 56 49 5a 31 6f 52 4a 74 35 75 67 31 41 6e 57 36 47 56 4a 5f 74 65 6b 2d 43 44 5f 64 72 31 70 68 38 49 32 38 68 42 65 6d 33 44 6c 52 64 74 72 34 39 44 61 6b 5a 51 36 71 56 4b 56 67 77 47 63 4d 2d 31 76 38 47 72 58 72 4e 68 39 50 5a 65 38 31 6e 49 4b 73 4d 64 4c 36 39 45 55 6f 53 41 38 44 39 35 4e 44 79 43 36 75 71 6c 37 79 41 32 68 4e 69 4c 71 49 41 69 53 Data Ascii: v=QoukH5jSO3sKFzVEA7Vc8VgC&c=03AFcWeA7aJF-AWJyRdXdty90OWRwJuQG-SLHQY3Thr3BcAEUHgvhbbWFgHRiFE13Jdr0bSKgUn2yis-DZ-geOUOgg6WF2VoBAr5AMesKqKVIZ1oRJt5ug1AnW6GVJ_tek-CD_dr1ph8I28hBem3DlRdtr49DakZQ6qVKVgwGcM-1v8GrXrNh9PZe81nIKsMdL69EUoSA8D95NDyC6uql7yA2hNiLqIAiS
2024-04-18 14:43:01 UTC	483	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 14:43:01 GMT Expires: Thu, 18 Apr 2024 14:43:01 GMT Cache-Control: private, max-age=0 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:43:01 UTC	772	IN	Data Raw: 61 36 33 0d 0a 29 5d 7d 27 0a 5b 22 64 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 34 58 56 5f 48 66 51 39 36 51 6d 45 41 54 50 6e 5a 67 44 77 39 49 51 50 5f 6c 70 76 56 73 38 6a 64 4d 4f 5a 37 42 61 69 4d 4f 72 77 69 31 72 31 46 4e 5a 32 37 71 42 62 53 6c 73 32 67 56 6f 48 4f 68 39 56 44 74 78 34 55 31 5a 46 55 35 61 74 69 46 74 62 4d 34 6f 6e 68 75 6a 38 34 41 77 2d 50 74 6c 63 49 64 4c 7a 73 4a 49 44 61 79 36 64 68 51 73 31 52 56 34 78 62 4d 59 6e 5f 52 42 75 6f 30 38 46 65 57 53 42 69 38 6a 6f 34 50 49 7a 68 7a 74 38 78 52 41 52 36 4b 7a 48 44 59 4b 67 39 36 50 6c 4e 74 6e 79 52 45 62 71 39 6d 55 73 6c 37 68 32 50 63 53 36 6b 4f 58 30 5a 54 45 58 76 34 50 42 55 68 42 34 39 49 2d 6b 45 37 64 37 38 75 71 38 36 30 61 39 54 52 38 6b 6c 6d 44 37 48 67 64 Data Ascii: a63)]}'["dresp","03AFcWeA4XV_HfQ96QmEATPnZgDw9IQP_lpvVs8jdMOZ7BaiMOrwi1r1FNZ27qBbSls2gVoHOh9VDtx4U1ZFU5atiFtbM4onhuj84Aw-PtlcIdLzsJIDay6dhQs1RV4xbMYn_RBuo08FeWSBi8jo4PIzhzt8xRAR6KzHDYKg96PlNtnyREbq9mUsl7h2PcS6kOX0ZTEXv4PBUhB49I-kE7d78uq860a9TR8klmD7Hgd
2024-04-18 14:43:01 UTC	1255	IN	Data Raw: 59 37 4e 72 73 35 38 58 71 4d 76 41 42 38 32 6b 74 66 4c 34 76 38 61 62 2d 41 64 71 45 4c 50 6a 68 30 77 64 65 4b 74 5a 42 75 33 57 4e 67 44 55 4a 48 4f 6a 36 4d 6d 46 6b 66 36 71 55 37 6e 34 61 63 65 41 4f 48 7a 4c 33 58 6c 5a 48 30 50 56 35 5f 6d 36 4d 6a 31 62 72 72 52 33 38 75 76 6d 6e 30 4a 6b 7a 6e 4f 63 6a 45 4b 39 69 57 32 67 4f 48 6e 41 5a 39 32 57 47 6a 66 52 6c 4f 5f 33 55 6d 77 5f 59 70 33 33 53 71 78 6f 72 64 6a 58 6d 32 4b 39 72 4d 38 2d 2d 37 7a 5a 47 32 6c 58 72 74 65 4c 58 45 69 77 74 7a 62 31 51 7a 76 65 6f 67 6b 46 47 4e 34 5f 41 4a 7a 71 47 76 71 6e 70 5a 30 63 46 4d 62 45 4e 78 61 4d 61 68 72 49 58 78 38 67 31 6f 43 78 79 36 78 70 50 7a 33 76 6b 36 31 69 62 4e 65 36 6d 6d 64 5a 32 41 69 4c 65 35 46 54 76 6f 69 74 68 74 4d 4b 50 71 7a Data Ascii: Y7Nrs58XqMvAB82ktfL4v8ab-AdqELPjh0wdeKtZBu3WNgDUJHOj6MmFkf6qU7n4aceAOHzL3XlZH0PV5_m6Mj1brrR38uvmn0JkznOcjEK9iW2gOHnAZ92WGjfRlO_3Umw_Yp33SqxordjXm2K9rM8--7zZG2lXrteLXEiwtzb1QzveogkFGN4_AJzqGvqnpZ0cFMbENxaMahrIXx8g1oCxy6xpPz3vk61ibNe6mmdZ2AiLe5FTvoithtMKPqz
2024-04-18 14:43:01 UTC	639	IN	Data Raw: 54 7a 73 32 33 6d 79 53 41 6a 4c 5f 51 43 71 59 64 47 70 67 74 64 43 6a 4c 67 55 61 6c 34 5a 4b 6c 46 53 6f 68 45 44 38 54 61 76 66 50 6e 55 5a 32 51 52 63 41 45 76 35 45 65 53 73 71 4c 78 71 4b 68 54 34 35 50 76 5a 45 57 52 37 30 6f 65 50 4c 4a 65 37 66 6a 62 4c 36 43 53 63 65 56 55 37 33 55 37 79 71 39 69 64 52 6e 59 4a 4c 6c 41 6e 69 47 6b 48 57 70 67 31 6b 5a 6c 30 36 76 73 63 44 43 50 2d 39 38 65 43 67 39 78 68 42 61 43 50 79 65 2d 4b 6e 31 4f 4d 6d 4d 68 30 72 31 4e 6b 79 6b 46 4b 68 38 57 57 42 31 30 79 71 78 66 6d 70 6e 79 49 6d 68 61 47 77 62 66 49 42 74 57 44 37 64 43 66 67 6e 45 44 5f 73 6f 52 70 7a 61 66 6a 48 7a 36 6b 70 6d 79 5a 6a 76 50 72 54 71 78 76 47 55 49 70 47 32 5f 46 4e 49 53 67 77 4a 68 70 53 42 30 78 32 77 38 45 48 4a 32 43 5a 5f Data Ascii: Tzs23mySAjL_QCqYdGpgtdCjLgUal4ZKlFSohED8TavfPnUZ2QRcAEv5EeSsqLxqKhT45PvZEWR70oePLJe7fjbL6CSceVU73U7yq9idRnYJLlAniGkHWpg1kZl06vscDCP-98eCg9xhBaCPye-Kn1OMmMh0r1NkykFKh8WWB10yqxfmpnyImhaGwbfIBtWD7dCfgnED_soRpzafjHz6kpmyZjvPrTqxvGUIpG2_FNISgwJhpSB0x2w8EHJ2CZ_
2024-04-18 14:43:01 UTC	1255	IN	Data Raw: 64 35 37 0d 0a 71 4d 35 49 48 32 4d 6f 52 42 72 34 4b 4a 31 4f 75 2d 61 68 76 67 75 68 6c 56 6b 4a 64 62 6f 4f 6b 70 5a 4b 52 5a 48 78 62 6a 30 73 67 41 61 66 63 57 39 66 33 6d 6c 58 77 76 48 75 61 65 66 36 5f 4b 70 50 74 32 32 43 4c 52 36 5f 41 2d 4f 34 44 63 37 4e 62 78 36 52 4c 73 30 39 44 5f 34 32 6d 69 6b 66 48 63 50 51 2d 58 49 5a 77 61 38 73 75 52 77 53 30 61 6d 73 59 72 72 33 30 71 6d 41 72 76 48 47 57 50 6b 6e 6b 75 53 6f 2d 36 2d 50 4e 65 37 67 51 52 67 50 4f 42 64 4d 74 36 78 41 4c 43 36 49 51 4b 71 41 6b 4b 4a 49 62 74 6e 36 33 45 65 68 5a 62 54 69 78 4d 6b 55 57 56 36 72 58 6b 52 78 53 6b 53 74 78 34 62 4a 72 7a 34 4a 5f 7a 61 75 36 4b 47 5a 39 59 52 58 73 65 31 58 48 41 31 61 38 32 50 42 50 5f 58 4a 32 4c 50 71 66 2d 77 5f 37 53 42 68 6e 54 Data Ascii: d57qM5IH2MoRBr4KJ1Ou-ahvguhlVkJdboOkpZKRZHxbj0sgAafcW9f3mlXwvHuaef6_KpPt22CLR6_A-O4Dc7Nbx6RLs09D_42mikfHcPQ-XIZwa8suRwS0amsYrr30qmArvHGWPknkuSo-6-PNe7gQRgPOBdMt6xALC6IQKqAkKJIbtn63EehZbTixMkUWV6rXkRxSkStx4bJrz4J_zau6KGZ9YRXse1XHA1a82PBP_XJ2LPqf-w_7SBhnT
2024-04-18 14:43:01 UTC	1255	IN	Data Raw: 51 36 44 64 45 49 69 2d 4a 52 45 32 30 62 61 58 68 69 4a 6f 67 4f 59 65 76 63 31 6c 58 6b 77 36 58 79 77 73 66 67 5a 33 6a 78 48 7a 5f 49 50 2d 31 4a 75 30 7a 6f 30 4a 47 53 6a 7a 59 51 55 64 73 6d 75 4f 37 51 73 73 6e 74 7a 67 7a 6e 69 58 38 4d 70 4c 4b 4c 48 52 78 2d 70 4c 68 6d 39 54 37 66 74 62 48 4c 6e 63 5f 50 58 39 56 51 64 65 33 43 53 4e 70 67 4f 65 2d 41 4f 51 64 4f 6f 41 70 58 47 79 52 78 41 7a 41 4f 53 46 61 46 56 51 47 52 5f 37 31 78 39 50 65 42 45 33 52 4c 52 78 72 62 54 65 2d 51 5f 54 39 54 7a 53 34 62 68 49 58 31 63 32 51 6a 30 5f 47 68 39 70 49 65 30 7a 4a 35 78 31 41 4d 37 75 50 46 42 6e 64 6e 48 54 6a 57 65 5f 2d 32 71 34 4d 6a 67 70 34 65 6e 70 44 63 54 30 6b 6e 4a 61 63 49 59 70 59 38 4f 34 6d 44 48 7a 5f 63 38 55 33 71 4d 58 47 33 47 Data Ascii: Q6DdEIi-JRE20baXhiJogOYevc1lXkw6XywsfgZ3jxHz_IP-1Ju0zo0JGSjzYQUdsmuO7QssntzgzniX8MpLKLHRx-pLhm9T7ftbHLnc_PX9VQde3CSNpgOe-AOQdOoApXGyRxAzAOSFaFVQGR_71x9PeBE3RLRxrbTe-Q_T9TzS4bhIX1c2Qj0_Gh9pIe0zJ5x1AM7uPFBndnHTjWe_-2q4Mjgp4enpDcT0knJacIYpY8O4mDHz_c8U3qMXG3G
2024-04-18 14:43:01 UTC	912	IN	Data Raw: 5a 55 43 42 57 4b 77 54 50 50 71 75 4f 51 4b 41 2d 68 4a 52 63 73 74 57 6c 31 34 46 54 34 6d 57 66 72 53 69 47 68 51 32 61 7a 42 53 35 39 7a 4b 77 79 74 69 4a 5a 54 5a 36 68 37 61 75 4c 31 70 6c 63 36 66 4c 44 71 61 4e 4b 31 49 51 4d 36 79 47 6a 47 7a 56 71 46 42 67 4f 44 54 6c 47 41 50 38 77 6f 35 30 62 46 47 67 58 79 7a 6e 31 6a 6a 4c 7a 33 39 55 31 41 50 31 73 62 5a 68 68 63 58 52 4a 44 52 69 45 52 56 79 2d 4f 46 38 42 57 6d 73 6c 6c 79 57 61 61 37 52 49 6f 51 78 50 7a 4d 6b 5a 32 47 56 4d 75 31 56 75 62 59 48 4f 74 61 34 36 71 5f 32 53 66 4a 34 33 43 51 57 56 69 74 71 4e 65 44 6c 4b 5a 4f 6d 75 7a 4a 58 53 34 43 34 77 6a 59 45 55 42 75 32 37 4a 61 79 75 44 56 6a 49 6e 70 5f 79 79 41 38 43 48 4e 45 7a 61 56 64 42 6a 70 4f 35 68 78 42 38 31 4b 31 66 47 Data Ascii: ZUCBWKwTPPquOQKA-hJRcstWl14FT4mWfrSiGhQ2azBS59zKwytiJZTZ6h7auL1plc6fLDqaNK1IQM6yGjGzVqFBgODTlGAP8wo50bFGgXyzn1jjLz39U1AP1sbZhhcXRJDRiERVy-OF8BWmsllyWaa7RIoQxPzMkZ2GVMu1VubYHOta46q_2SfJ43CQWVitqNeDlKZOmuzJXS4C4wjYEUBu27JayuDVjInp_yyA8CHNEzaVdBjpO5hxB81K1fG
2024-04-18 14:43:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49748	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:01 UTC	1499	OUT	GET /recaptcha/api2/payload?p=06AFcWeA7ZXw9uOkzALS2kTLha29HPHU16TQlZMx1pKUQ_7wrrt-sofC93B5Gzs09quO4b5SQJHCmYHReXfi5VGgdKJJAbCbCk-tgCCtCpA6KflzJKIdpjmWKDksHG1uX8pTnEgx7MlhKw9QEWgFjprGJNpLH_qpjPuN2JS_Cw43bf-dyuoA8h0Z5tkw6aMn_Crw32vrySkE60&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=9747b01ef597c89c HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:02 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 18 Apr 2024 14:43:02 GMT Date: Thu, 18 Apr 2024 14:43:02 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:43:02 UTC	1255	IN	Data Raw: 31 35 37 43 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 157CJFIFC!"$"$Cdd"}!1AQa"q
2024-04-18 14:43:02 UTC	1255	IN	Data Raw: a8 cf 5c 1c 74 ed 2e 96 a1 25 51 3a 2c ca 57 00 b1 dd 82 73 ed c8 39 f4 c7 7e 69 c5 72 2e 6b df fe 18 55 1a 93 b4 74 b9 9b 06 9f 24 c6 42 d1 82 aa c1 63 0f 2c 91 61 76 8c 00 a0 8e 3f 0a 2b a1 b6 d2 34 ab 84 32 b4 51 c2 cc 7e 65 f3 8a 83 ee 39 e4 11 8e 68 a9 75 e1 f6 a7 67 fd 79 89 42 9a 56 93 77 f2 b7 f9 8f 53 14 d6 72 c7 3c 50 43 1b 46 ea b2 91 9f 62 00 62 4e 72 c4 e3 a9 c7 bd 50 b7 b5 96 47 2b 10 81 c2 1c 32 86 04 31 2c 08 6d cd ce 4f 23 8a 91 04 3b e1 68 da 29 41 39 0e 03 1e 31 d0 7b f1 d4 74 15 95 a9 f8 87 4d d3 ad af 20 86 e6 ce 7b bb 48 f0 d0 79 e9 e7 61 41 3b 70 4e 17 39 03 9c 75 e6 b3 d0 df 91 f4 56 fe bf ad f5 2f 9b 69 84 e0 1b 41 0b 12 40 c6 dc c8 07 bb 7a 61 be bc e7 35 3c 2d 6f 6f 6e 1a 65 8a 38 c9 0a ce c3 94 07 27 2c 33 c7 3f e4 0c 57 3d f0 Data Ascii: \t.%Q:,Ws9~ir.kUt$Bc,av?+42Q~e9hugyBVwSr<PCFbbNrPG+21,mO#;h)A91{tM {HyaA;pN9uV/iA@za5<-oone8',3?W=
2024-04-18 14:43:02 UTC	1255	IN	Data Raw: b4 f0 45 a6 ad 6d 6f 38 b9 7c 43 70 85 b7 6c c2 90 cc 17 66 7d 8e 5b 1c e7 00 d2 e6 92 4f 94 99 a5 7b 45 f9 74 fc 8e f2 df e3 2c 73 dc 98 e1 f0 cb 8b 61 bd c4 b3 5f 04 f3 07 6c a9 1d 4e 39 03 e9 eb 9b 69 f1 76 c7 0c 7f b1 65 b8 85 e5 1e 54 69 70 85 87 39 6c f4 03 83 d8 e4 01 8f 5a f3 9b 2d 02 d4 78 1c eb 09 14 cf 76 d0 85 b9 0b 3a a0 88 ee 2c 5b 61 f9 8e 3e b8 f4 ad 8f 01 f8 5e cf 56 f0 f3 ea 52 dd 5c b4 ca 65 5f 29 4a 97 f9 77 0e 14 f2 07 bf 43 d8 60 55 ca 53 8c b4 2e a2 ea bf e1 ce db 4f f8 b1 a2 6d 9c 9d 1a e5 c4 8b b1 81 74 cf df 62 01 6c f1 c1 1c e3 b7 b9 35 a9 07 c5 4d 1a e2 7f f9 07 df 8b 97 60 14 b2 a3 1c f4 3b 8e 41 3d bf a9 af 24 f0 3f 87 ad bc 45 ac dc c1 79 2a cb e5 c6 33 b9 b8 70 58 a9 fa 91 c1 1f 53 9c d4 ba ff 00 86 ad 8f 8b 23 d2 6d 24 8a Data Ascii: Emo8\|Cplf}[O{Et,sa_lN9iveTip9lZ-xv:,[a>^VR\e_)JwC`US.Omtbl5M`;A=$?Ey*3pXS#m$
2024-04-18 14:43:02 UTC	1255	IN	Data Raw: 39 4b 89 02 07 39 c8 cb 11 c6 e0 30 c3 24 36 47 04 1f 4e d5 8d af cb b1 e6 74 dc a7 12 95 0d b9 72 41 04 64 80 be e7 d8 76 ad 14 d4 af e4 df 66 92 35 cc 6b 19 55 49 50 3a a3 16 39 5c 31 38 1c 1f bb d3 23 9e d5 03 cd 1c a6 28 ed d2 08 77 93 fb a8 77 6c 1f 31 04 b2 9c e3 6e e6 f6 e3 a1 c5 6b 74 b4 42 72 d2 ef fa 43 11 f5 1b 6b 93 32 79 f0 5c 14 11 33 c7 31 c3 61 f7 01 83 91 cf b1 24 73 57 6d 75 cd 56 08 41 7b a8 d1 9d 7e 47 97 68 62 bb 97 68 24 7b 0e 9e a7 f0 19 ba 7c 90 24 40 82 14 2c 7f bc 38 cc 72 31 f9 72 49 18 1c 13 81 53 24 c1 09 33 5b bc 0f 34 40 a2 ef de cc 72 72 3e 61 c0 e0 7c a3 3d 7f 01 12 a3 19 bb 5b fa fe ac 5b ab 25 6d 3f ad bf af c4 d7 ff 00 84 8b 52 b5 11 29 b7 4b 90 91 29 2a 08 85 bc b5 6c 67 1c 60 f0 07 d3 3f 8c ad e2 2d 1a e4 a9 bc b4 92 Data Ascii: 9K90$6GNtrAdvf5kUIP:9\18#(wwl1nktBrCk2y\31a$sWmuVA{~Ghbh${\|$@,8r1rIS$3[4@rr>a\|=[[%m?R)K)*lg`?-
2024-04-18 14:43:02 UTC	488	IN	Data Raw: 0a 8e 39 ef db 2e 59 94 80 88 5f fd 63 90 92 66 31 95 51 9c 63 ee f2 cb d0 1c 00 0f 53 45 b4 da c4 59 da d6 ff 00 86 fe bf a6 c7 98 56 54 47 79 6f 9d b6 80 4c 37 0c 79 1c 1d c4 0c 13 9e 73 e8 45 14 eb 20 f2 c6 ec d1 40 48 72 31 2c e4 32 8f ee f4 e7 1d 33 45 75 c6 a3 8a b7 f9 7f 91 32 c4 c6 0f 97 91 3b 79 ff 00 c1 30 51 f3 7b 11 64 42 5e 58 54 9c 73 89 30 1b fa 63 d3 15 0d dd f5 c5 ac 2e e8 db 89 11 03 b8 9e 70 a5 86 70 7d 54 51 45 79 b4 f5 9d 9e da 7e 87 55 f6 f9 7e 65 fd 3b 50 ba 4d 2f 0a e3 cb 9f 32 b4 6c 37 20 3b 09 c0 07 a7 dd 1e fe f5 d0 78 82 69 ac 34 c9 ae ad 65 65 8e 46 8c b5 b3 61 e1 e8 a4 f0 d9 23 3e 61 ef e9 45 15 ce e2 b9 d7 f5 d8 e8 cb e4 e5 6b bd 93 fc cb b7 1a 45 85 fe 80 75 76 89 a1 9e 2f 33 e4 8a 46 08 db 47 00 82 49 fd 7b 9a e5 62 99 e4 Data Ascii: 9.Y_cf1QcSEYVTGyoL7ysE @Hr1,23Eu2;y0Q{dB^XTs0c.pp}TQEy~U~e;PM/2l7 ;xi4eeFa#>aEkEuv/3FGI{b
2024-04-18 14:43:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49751	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:02 UTC	1329	OUT	POST /recaptcha/api2/replaceimage?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 5857 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://www.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:02 UTC	5857	OUT	Data Raw: 76 3d 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 26 63 3d 30 33 41 46 63 57 65 41 34 58 56 5f 48 66 51 39 36 51 6d 45 41 54 50 6e 5a 67 44 77 39 49 51 50 5f 6c 70 76 56 73 38 6a 64 4d 4f 5a 37 42 61 69 4d 4f 72 77 69 31 72 31 46 4e 5a 32 37 71 42 62 53 6c 73 32 67 56 6f 48 4f 68 39 56 44 74 78 34 55 31 5a 46 55 35 61 74 69 46 74 62 4d 34 6f 6e 68 75 6a 38 34 41 77 2d 50 74 6c 63 49 64 4c 7a 73 4a 49 44 61 79 36 64 68 51 73 31 52 56 34 78 62 4d 59 6e 5f 52 42 75 6f 30 38 46 65 57 53 42 69 38 6a 6f 34 50 49 7a 68 7a 74 38 78 52 41 52 36 4b 7a 48 44 59 4b 67 39 36 50 6c 4e 74 6e 79 52 45 62 71 39 6d 55 73 6c 37 68 32 50 63 53 36 6b 4f 58 30 5a 54 45 58 76 34 50 42 55 68 42 34 39 49 2d 6b 45 37 64 37 38 75 71 38 36 30 61 39 54 52 Data Ascii: v=QoukH5jSO3sKFzVEA7Vc8VgC&c=03AFcWeA4XV_HfQ96QmEATPnZgDw9IQP_lpvVs8jdMOZ7BaiMOrwi1r1FNZ27qBbSls2gVoHOh9VDtx4U1ZFU5atiFtbM4onhuj84Aw-PtlcIdLzsJIDay6dhQs1RV4xbMYn_RBuo08FeWSBi8jo4PIzhzt8xRAR6KzHDYKg96PlNtnyREbq9mUsl7h2PcS6kOX0ZTEXv4PBUhB49I-kE7d78uq860a9TR
2024-04-18 14:43:02 UTC	483	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 14:43:02 GMT Expires: Thu, 18 Apr 2024 14:43:02 GMT Cache-Control: private, max-age=0 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:43:02 UTC	772	IN	Data Raw: 61 36 33 0d 0a 29 5d 7d 27 0a 5b 22 64 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 35 73 74 48 77 66 77 4e 63 62 4e 6b 4a 41 65 4f 62 4b 4f 30 42 77 4b 76 6f 65 42 34 4a 4f 72 48 44 32 59 57 2d 5a 68 72 70 62 78 73 31 31 35 50 5f 32 62 4c 42 51 71 77 63 52 77 46 79 68 5f 77 59 76 39 72 53 56 49 5f 50 35 65 6e 74 31 31 7a 4f 41 52 72 52 5f 32 50 41 70 41 33 75 58 6c 4d 36 63 5f 6c 31 4b 61 43 59 58 6b 46 52 72 61 56 70 72 6f 42 4a 77 50 49 34 6c 78 32 56 61 34 6d 67 47 69 49 46 71 36 31 66 58 4b 71 32 61 37 6a 45 2d 78 65 4b 33 34 4d 72 64 55 66 5a 68 65 77 44 46 42 6f 77 42 6c 6d 64 35 75 35 7a 69 64 47 57 36 4d 59 55 6a 38 6e 72 33 39 68 36 49 42 72 32 33 57 53 44 36 34 72 77 35 57 4a 47 43 4a 56 6c 53 65 63 66 64 4e 45 42 31 48 42 36 55 31 37 41 65 58 Data Ascii: a63)]}'["dresp","03AFcWeA5stHwfwNcbNkJAeObKO0BwKvoeB4JOrHD2YW-Zhrpbxs115P_2bLBQqwcRwFyh_wYv9rSVI_P5ent11zOARrR_2PApA3uXlM6c_l1KaCYXkFRraVproBJwPI4lx2Va4mgGiIFq61fXKq2a7jE-xeK34MrdUfZhewDFBowBlmd5u5zidGW6MYUj8nr39h6IBr23WSD64rw5WJGCJVlSecfdNEB1HB6U17AeX
2024-04-18 14:43:02 UTC	1255	IN	Data Raw: 70 4b 57 4a 63 6b 63 5f 53 36 6e 36 45 4a 46 45 51 34 53 48 5f 53 4c 68 49 72 77 6d 46 66 4a 44 57 74 2d 39 44 6d 6e 56 36 39 53 45 68 76 79 6a 53 4f 67 76 48 38 4a 56 61 63 34 74 6a 68 30 56 47 41 33 67 46 49 6b 4a 66 71 50 50 63 75 61 42 78 4a 35 51 6c 48 5a 37 36 55 36 6a 4e 43 56 54 59 2d 44 7a 45 31 38 49 6a 4e 7a 38 54 75 75 35 43 46 66 72 71 56 36 6e 39 55 53 55 75 6f 74 33 53 4a 6c 50 4e 7a 74 2d 46 54 64 5f 59 34 4c 4b 69 69 54 73 41 6a 2d 45 35 54 64 6e 57 42 63 72 44 66 4d 64 36 6e 41 34 39 54 58 58 4c 32 5a 71 43 5a 42 38 38 4b 31 34 77 39 6c 70 6f 56 73 79 5a 71 6f 52 6d 6e 79 48 44 66 76 72 6f 43 44 77 7a 56 70 38 77 4c 43 2d 47 64 71 75 5f 51 6b 45 4b 43 45 72 6f 77 6a 78 64 55 54 35 35 53 33 73 72 75 31 53 35 7a 52 4f 48 66 6e 4d 34 30 65 Data Ascii: pKWJckc_S6n6EJFEQ4SH_SLhIrwmFfJDWt-9DmnV69SEhvyjSOgvH8JVac4tjh0VGA3gFIkJfqPPcuaBxJ5QlHZ76U6jNCVTY-DzE18IjNz8Tuu5CFfrqV6n9USUuot3SJlPNzt-FTd_Y4LKiiTsAj-E5TdnWBcrDfMd6nA49TXXL2ZqCZB88K14w9lpoVsyZqoRmnyHDfvroCDwzVp8wLC-Gdqu_QkEKCErowjxdUT55S3sru1S5zROHfnM40e
2024-04-18 14:43:02 UTC	639	IN	Data Raw: 53 51 32 59 34 65 37 35 6b 6d 76 79 41 71 37 6b 5f 77 43 4e 72 52 37 73 61 38 6e 7a 36 55 32 4a 30 34 51 52 69 31 46 7a 6a 79 75 41 76 52 37 37 37 56 43 6e 61 32 65 73 75 64 4a 74 32 72 4b 63 65 63 49 75 53 44 75 62 67 72 70 64 4f 7a 47 73 4c 72 69 76 50 35 5a 45 4a 50 5a 2d 4a 64 4b 43 37 5a 65 67 4a 79 4f 67 54 31 63 48 4a 79 65 4d 75 65 75 59 6c 77 77 6c 54 75 74 5a 4f 44 7a 6e 6f 4f 79 74 37 36 6a 5f 31 75 65 78 6e 65 35 61 36 56 48 59 6f 4e 74 43 68 4b 36 4b 55 37 43 33 52 65 69 70 6d 33 30 35 6c 4a 59 6c 61 51 6c 41 4e 6c 6c 51 31 41 55 71 33 6b 2d 5f 36 37 74 6e 48 30 58 32 30 58 61 67 74 44 71 45 45 49 50 4b 55 6d 32 44 42 4c 78 6a 71 37 66 66 33 71 50 32 51 34 38 53 33 32 2d 69 6d 57 36 4d 55 65 34 47 5f 4e 42 49 2d 66 6c 44 45 6b 36 62 45 32 6d Data Ascii: SQ2Y4e75kmvyAq7k_wCNrR7sa8nz6U2J04QRi1FzjyuAvR777VCna2esudJt2rKcecIuSDubgrpdOzGsLrivP5ZEJPZ-JdKC7ZegJyOgT1cHJyeMueuYlwwlTutZODznoOyt76j_1uexne5a6VHYoNtChK6KU7C3Reipm305lJYlaQlANllQ1AUq3k-_67tnH0X20XagtDqEEIPKUm2DBLxjq7ff3qP2Q48S32-imW6MUe4G_NBI-flDEk6bE2m
2024-04-18 14:43:02 UTC	1255	IN	Data Raw: 64 35 37 0d 0a 52 51 53 64 35 2d 43 6e 66 7a 56 79 31 75 44 7a 42 35 74 44 68 77 67 75 69 79 53 43 6b 63 79 49 45 4b 6e 57 7a 6b 5f 67 46 6e 50 69 5a 77 66 75 59 6f 34 37 78 38 34 5f 39 37 34 78 72 69 4f 63 70 4f 5f 75 30 5a 4a 68 37 57 53 53 7a 45 4f 59 44 6c 68 42 35 74 66 44 36 37 34 72 49 6d 62 55 6a 4d 75 68 55 30 71 6f 43 64 72 6b 45 6a 63 34 71 42 4f 62 50 31 5f 68 39 79 66 6e 37 51 5a 33 61 4a 6d 6e 58 6e 79 55 61 46 69 69 5a 43 31 51 4e 6e 55 6b 53 5f 5f 73 6c 6a 53 64 7a 6b 41 70 44 67 71 58 4d 75 73 2d 4b 35 4d 2d 66 37 77 59 70 6d 46 44 63 4d 50 5f 2d 61 4c 2d 33 39 72 34 6b 37 38 4b 43 41 62 2d 6e 4d 50 7a 38 53 76 5a 45 30 57 74 78 6c 4c 39 79 45 63 65 76 57 73 4b 64 51 35 33 59 59 4e 31 6d 30 79 74 46 48 6b 78 76 42 72 52 2d 79 44 4f 38 6b Data Ascii: d57RQSd5-CnfzVy1uDzB5tDhwguiySCkcyIEKnWzk_gFnPiZwfuYo47x84_974xriOcpO_u0ZJh7WSSzEOYDlhB5tfD674rImbUjMuhU0qoCdrkEjc4qBObP1_h9yfn7QZ3aJmnXnyUaFiiZC1QNnUkS__sljSdzkApDgqXMus-K5M-f7wYpmFDcMP_-aL-39r4k78KCAb-nMPz8SvZE0WtxlL9yEcevWsKdQ53YYN1m0ytFHkxvBrR-yDO8k
2024-04-18 14:43:02 UTC	1255	IN	Data Raw: 59 47 6d 47 62 49 4d 50 32 4c 2d 76 5f 38 68 37 71 6b 6d 75 37 7a 49 39 75 58 2d 7a 59 57 70 6b 47 76 7a 42 78 34 58 5a 62 79 57 42 58 67 41 4f 6f 62 53 50 7a 33 71 4f 6f 56 61 34 49 51 58 68 58 35 57 31 65 68 55 59 58 32 77 52 7a 43 66 36 62 30 63 30 49 46 34 4f 69 51 61 67 65 57 6c 56 48 31 68 61 68 38 6b 59 36 67 2d 6b 49 50 4c 57 6d 4a 6f 46 64 50 63 30 30 57 63 75 61 38 38 4d 71 51 5a 4d 57 6f 73 39 62 33 46 30 67 54 31 70 37 4d 72 78 43 52 77 6a 55 6c 78 42 47 45 53 4e 77 39 49 6b 65 43 35 2d 6a 69 58 79 49 35 61 6b 33 47 55 4f 4e 34 54 67 77 72 4c 47 56 2d 43 64 55 69 64 56 64 4a 58 34 65 70 49 63 41 54 37 6b 71 77 31 6c 39 58 61 74 6f 63 76 6f 47 78 32 63 63 38 57 79 47 49 71 59 67 41 69 62 38 71 67 55 69 34 41 76 71 73 37 35 53 48 4b 7a 74 38 6e Data Ascii: YGmGbIMP2L-v_8h7qkmu7zI9uX-zYWpkGvzBx4XZbyWBXgAOobSPz3qOoVa4IQXhX5W1ehUYX2wRzCf6b0c0IF4OiQageWlVH1hah8kY6g-kIPLWmJoFdPc00Wcua88MqQZMWos9b3F0gT1p7MrxCRwjUlxBGESNw9IkeC5-jiXyI5ak3GUON4TgwrLGV-CdUidVdJX4epIcAT7kqw1l9XatocvoGx2cc8WyGIqYgAib8qgUi4Avqs75SHKzt8n
2024-04-18 14:43:02 UTC	912	IN	Data Raw: 56 70 52 78 69 6c 38 72 72 4c 7a 78 4b 59 43 7a 4c 45 68 73 73 31 44 4c 42 4a 5f 56 66 39 6e 52 34 4b 47 41 6a 46 5f 66 61 65 31 43 7a 59 62 48 77 68 76 46 32 70 5f 6c 67 33 75 4b 78 4e 46 68 42 66 57 71 69 44 6f 58 6b 42 54 35 38 4d 4b 34 35 78 56 4a 70 76 75 4f 64 45 4c 6c 7a 4e 4c 51 74 41 71 30 63 68 79 31 6d 69 58 78 51 45 37 72 44 33 7a 69 33 42 76 61 6b 51 67 54 66 57 64 77 53 6c 44 55 6c 4a 77 56 37 50 5a 7a 78 43 71 61 75 39 4d 49 6d 46 62 6a 51 6e 77 67 43 6d 74 74 46 7a 4f 67 6c 6a 36 68 57 6b 43 70 59 44 33 5f 64 7a 70 70 53 4d 4d 78 78 69 69 37 4b 77 43 68 77 5f 5f 77 7a 2d 38 4a 52 42 59 49 4a 5f 4a 56 6a 58 6a 55 65 67 68 4c 67 57 6c 43 45 36 37 4e 42 43 52 59 61 32 36 79 50 44 52 32 5f 52 54 37 30 6a 73 71 44 35 70 55 5f 55 73 73 6e 62 62 Data Ascii: VpRxil8rrLzxKYCzLEhss1DLBJ_Vf9nR4KGAjF_fae1CzYbHwhvF2p_lg3uKxNFhBfWqiDoXkBT58MK45xVJpvuOdELlzNLQtAq0chy1miXxQE7rD3zi3BvakQgTfWdwSlDUlJwV7PZzxCqau9MImFbjQnwgCmttFzOglj6hWkCpYD3_dzppSMMxxii7KwChw__wz-8JRBYIJ_JVjXjUeghLgWlCE67NBCRYa26yPDR2_RT70jsqD5pU_Ussnbb
2024-04-18 14:43:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49752	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:03 UTC	1499	OUT	GET /recaptcha/api2/payload?p=06AFcWeA4frbWer0wKH0ZR6C82DbZps44nKxyxai6240hzAEw4slWjXUVJ3G1AUW3Y7SCTq-LwA_ygKzzLxwJlUwqwNlcl3_wi5JOCrgtg40cH6DJGZ1KhngUVXVffYTbAGm5AhZKzZt9feWlVBAu2j2Kye-blWt3VyTeXfK2TkZ7U2m_pU2d80hjh4I5LRFeyCpD9IVa-f_I9&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=58248a340f3c879f HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:03 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 18 Apr 2024 14:43:03 GMT Date: Thu, 18 Apr 2024 14:43:03 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:43:03 UTC	6	IN	Data Raw: 31 37 34 43 0d 0a Data Ascii: 174C
2024-04-18 14:43:03 UTC	1255	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC!"$"$Cdd"}!1AQa"q2
2024-04-18 14:43:03 UTC	1255	IN	Data Raw: bb 1d be 6e 3c c6 86 40 57 e6 90 46 8a 1c 03 cb 60 67 9c 11 9e f9 cf b5 2f 92 a5 25 8e 62 92 ab 2b 6e 6c 6d 40 0e 72 30 79 e0 ae e6 c1 cf 07 8e b4 47 95 6b fd 74 d0 1a 4d eb fd 7f 5d ce 77 52 d1 2c af 6e 05 dd e6 93 24 b3 4a bb 99 92 11 20 cf 42 37 03 83 c8 3d 3b 62 8a e8 10 60 60 a5 b9 3d fc d9 32 de df 7b 9e 98 f5 18 e9 45 6e 9d 3e b1 5f 80 4b d9 df de 9c af fd 7f 78 bb 1a 24 91 46 55 95 a4 d8 23 46 5c 49 b9 08 c8 52 54 0e 3a 77 1c 0e 7b 06 56 b7 75 98 79 f7 72 3c b9 2c c3 61 76 4e 87 ae 07 60 bf 4e 3a 60 1a d8 16 d2 48 86 e0 c0 ee fb 82 90 18 e0 60 6d ea 40 e3 0f 8e 70 0e 7d b9 92 3d 2e e4 c8 4c 08 8c a2 11 2f ee dc b8 6d b9 db 83 b4 74 c7 07 3c 65 b1 5c de d2 2b 57 b7 ea 5a a3 2b 36 93 b7 5f f8 7b 33 1a 1b 6f 21 d9 f7 48 a8 14 3a 46 24 62 44 6a c3 86 Data Ascii: n<@WF`g/%b+nlm@r0yGktM]wR,n$J B7=;b``=2{En>_Kx$FU#F\IRT:w{Vuyr<,avN`N:`H`m@p}=.L/mt<e\+WZ+6_{3o!H:F$bDj
2024-04-18 14:43:03 UTC	1255	IN	Data Raw: fd 7f 5e 5a 74 21 b8 c6 dd f5 fe bf 0f ea c3 ff 00 b3 b4 e4 bb 8e 15 b6 99 e7 52 00 ea 30 40 38 76 3d 87 07 8e 9c 7b d5 4f 11 43 a6 49 a5 5e 18 a6 78 e6 48 9a 58 f1 f2 9f bb 81 d7 ae dc 03 b8 64 f1 ed 8a 96 ce 4b d9 c4 76 b0 cd 25 a1 69 0e d9 19 d5 97 03 6e 33 93 ea 57 1d 7f a0 a1 e2 41 a8 b4 77 90 c5 14 97 28 d6 f3 34 d7 32 30 0b c0 25 16 3d bc b0 f9 88 3c 70 7a e2 9f 33 52 4d b6 ff 00 af eb f5 2a ea cb 4e df 87 fc 3f 7f bc dd 92 1d 21 b6 ce c8 9b 62 99 9f 6b 3e 03 96 c9 e0 fe 23 91 ed ef 59 d7 1a 55 99 91 2e 23 f3 81 21 97 0a 07 cc 41 da aa 46 41 04 2a f1 ee 7a d2 e9 36 50 5d e8 b6 b3 4b 1a 24 cd 6c ae a1 11 f0 7e 41 dc 9e db bd 78 f4 ad 29 22 bb 77 9e f3 6c 4b 03 15 32 ab ed 01 b0 32 41 63 9f 43 e9 d7 34 f9 9a d1 7f 5e 5f 8d ef e4 2b 46 2b 6d 7c fe 5b Data Ascii: ^Zt!R0@8v={OCI^xHXdKv%in3WAw(420%=<pz3RMN?!bk>#YU.#!AFAz6P]K$l~Ax)"wlK22AcC4^_+F+m\|[
2024-04-18 14:43:03 UTC	333	IN	Data Raw: 3d 58 9c b3 30 6c 06 23 38 cf cc 45 54 86 cb 4f d3 e3 58 e1 be d4 27 8c c8 ce ab 3d d6 e0 39 e4 29 2c 78 c0 23 1d b3 d3 9a ae 6a 8e e9 6d b7 eb f7 db cf a9 54 e9 7b cd 34 da ed b6 fa ff 00 5f 99 ce eb de 2c 9a ca e6 21 2e 8d af c6 65 85 65 1e 6d d2 a9 60 72 33 80 4e 3a 74 f5 cd 15 d8 d9 4d 6f 6f 1b c4 71 76 a1 c8 49 26 91 8b ed 1c 2e 7e 4e 0e 07 4f 7a 2b 19 e2 62 a4 fd cb fc d1 85 6c 7c 29 d4 71 71 5a 7f 5d cc 58 2f 61 f3 48 82 de 6b 72 b9 2c 1b 6c 9f 39 fe 10 01 0a 3f bc 0f 6c 0a b1 77 6d 2c 8f 0d ee af 34 91 15 2a c2 34 21 98 1e 9b 36 77 63 b4 9c 9e b8 c8 a8 a4 d5 2c f4 dd 36 23 66 88 a9 80 64 92 40 32 59 81 04 6e 00 e4 9c fb 75 03 d6 b9 4d 47 55 bf bf 59 ae 81 75 f3 14 fe fc 29 3f 2a 8e 14 e7 3e 9d 18 63 1f 80 1a 49 de 5a eb d3 4e fd bf 5e bd 2c f7 bf Data Ascii: =X0l#8ETOX'=9),x#jmT{4_,!.eem`r3N:tMooqvI&.~NOz+bl\|)qqZ]X/aHkr,l9?lwm,44!6wc,6#fd@2YnuMGUYu)?>cIZN^,
2024-04-18 14:43:03 UTC	1255	IN	Data Raw: 96 30 a8 ff 00 29 22 30 00 23 0d c0 3c 37 20 ff 00 8e 3a ad 2a dd 6d 6d f7 c8 24 5d f2 a9 01 0e 1c ed 2c cd b8 75 cf ca d8 fd 3a 56 49 a7 ab fe bf ad fe 5b d8 98 cb 5f 77 7f 5f d7 e5 7d 15 af f7 0f b8 d9 a4 e9 b3 c3 89 56 76 86 46 25 ba 91 8e 70 30 78 38 2d 90 7d 46 45 7c c9 73 7d 65 7b 73 73 38 b7 69 24 b9 9e 5b 83 2d c3 31 66 05 be 4c 8c 1e 46 d6 cf 52 73 8e dc fd 13 ab de 2c ab 71 1b 6d 92 05 05 8a 31 ca aa 37 04 1d b9 2c a4 0c 7d 3a 71 d3 ce f5 ff 00 0c 78 7a 7b b8 e1 97 49 82 29 e1 52 64 75 46 55 0b 9c 85 20 1c 90 33 81 df 1c f1 8a 74 ea 38 6b 6f eb f5 e8 2f 67 cc 9c ad b7 f5 7f ea fa f7 31 be 0e f8 cf 46 f0 ae a9 7d f6 b8 6e 8d 96 a2 82 34 8a 29 15 dd 50 1f 95 39 d9 c8 3c 13 83 9e c3 d7 dc 3c 1f e2 fd 03 5a 90 ae 93 76 97 17 51 a7 ef 2d 5e 33 1b 01 Data Ascii: 0)"0#<7 :*mm$],u:VI[_w_}VvF%p0x8-}FE\|s}e{ss8i$[-1fLFRs,qm17,}:qxz{I)RduFU 3t8ko/g1F}n4)P9<<ZvQ-^3
2024-04-18 14:43:03 UTC	611	IN	Data Raw: d9 24 90 42 9e 9d 31 91 8e 7a 8a d5 6b a7 5f 5e fd 2e 65 17 ce b9 ad bf cb cf d4 bf 14 56 9a 9e 99 0d b2 18 a5 b8 85 72 3c d5 0c 59 30 0b 2e 0e 3d ce 31 8f 5e d5 cc 5d 79 51 a1 9e 58 e6 9d 37 bb 46 db ca 17 3f 2e 30 06 48 3d 38 c7 f0 83 d8 67 61 a4 b9 d3 ee e1 48 6f 56 4d a4 bb b9 9c 2a ae 17 ee 93 9c 60 11 d3 8f 4c 55 df 12 da 45 79 02 eb 5a 74 2c 48 22 53 18 8c 92 58 90 77 71 f7 41 c7 bf 51 c6 46 29 e9 27 75 bf e3 fa 5b f2 f9 97 27 c9 2b c5 bd 76 77 fc 7f ad 12 df cb 89 d5 51 2e ee 16 5f b2 ac 87 60 c9 2e 17 19 f9 b1 db a6 ef f2 68 ab 32 b2 5b c8 c8 cb 2c 40 b1 2a b1 cc 50 60 12 39 f9 86 4e 41 e7 1f 9f 5a 28 84 ad 14 95 bf 03 a2 9d 5a d0 8a 8c 36 5e 9f fc 91 5c 22 5b b4 c8 91 ab 27 98 e1 55 c6 e5 5c 30 00 81 d3 38 02 b7 6f ed d6 d6 1b 29 77 bc e6 58 55 Data Ascii: $B1zk_^.eVr<Y0.=1^]yQX7F?.0H=8gaHoVM`LUEyZt,H"SXwqAQF)'u['+vwQ._`.h2[,@P`9NAZ(Z6^\"['U\08o)wXU
2024-04-18 14:43:03 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-04-18 14:43:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49753	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:05 UTC	1329	OUT	POST /recaptcha/api2/replaceimage?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 5857 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://www.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:05 UTC	5857	OUT	Data Raw: 76 3d 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 26 63 3d 30 33 41 46 63 57 65 41 35 73 74 48 77 66 77 4e 63 62 4e 6b 4a 41 65 4f 62 4b 4f 30 42 77 4b 76 6f 65 42 34 4a 4f 72 48 44 32 59 57 2d 5a 68 72 70 62 78 73 31 31 35 50 5f 32 62 4c 42 51 71 77 63 52 77 46 79 68 5f 77 59 76 39 72 53 56 49 5f 50 35 65 6e 74 31 31 7a 4f 41 52 72 52 5f 32 50 41 70 41 33 75 58 6c 4d 36 63 5f 6c 31 4b 61 43 59 58 6b 46 52 72 61 56 70 72 6f 42 4a 77 50 49 34 6c 78 32 56 61 34 6d 67 47 69 49 46 71 36 31 66 58 4b 71 32 61 37 6a 45 2d 78 65 4b 33 34 4d 72 64 55 66 5a 68 65 77 44 46 42 6f 77 42 6c 6d 64 35 75 35 7a 69 64 47 57 36 4d 59 55 6a 38 6e 72 33 39 68 36 49 42 72 32 33 57 53 44 36 34 72 77 35 57 4a 47 43 4a 56 6c 53 65 63 66 64 4e 45 42 31 Data Ascii: v=QoukH5jSO3sKFzVEA7Vc8VgC&c=03AFcWeA5stHwfwNcbNkJAeObKO0BwKvoeB4JOrHD2YW-Zhrpbxs115P_2bLBQqwcRwFyh_wYv9rSVI_P5ent11zOARrR_2PApA3uXlM6c_l1KaCYXkFRraVproBJwPI4lx2Va4mgGiIFq61fXKq2a7jE-xeK34MrdUfZhewDFBowBlmd5u5zidGW6MYUj8nr39h6IBr23WSD64rw5WJGCJVlSecfdNEB1
2024-04-18 14:43:05 UTC	483	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 14:43:05 GMT Expires: Thu, 18 Apr 2024 14:43:05 GMT Cache-Control: private, max-age=0 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:43:05 UTC	772	IN	Data Raw: 61 36 38 0d 0a 29 5d 7d 27 0a 5b 22 64 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 34 57 63 59 37 52 36 4b 47 69 41 4f 36 4c 67 30 33 61 75 36 31 64 4d 33 6d 4c 58 4a 35 63 39 45 4f 4c 67 37 68 6c 78 76 45 72 65 41 6d 76 70 70 65 57 45 75 33 4e 45 43 79 49 5f 45 6c 66 55 6f 41 71 43 39 52 47 55 39 49 69 65 68 75 73 69 44 44 76 43 72 37 57 4c 4b 39 52 6c 42 48 4c 68 2d 56 75 52 41 48 30 42 76 6f 55 68 4d 56 34 75 73 41 63 51 47 48 46 59 37 4f 4d 58 4d 56 57 4f 61 67 38 56 75 57 63 36 66 36 57 4d 59 45 6d 59 4b 68 59 68 63 71 39 58 31 47 42 62 4d 31 77 30 6c 31 77 63 6d 69 63 50 4e 61 43 6f 4b 30 45 73 5a 41 66 54 46 78 32 6f 62 65 4a 70 55 58 66 37 6d 54 42 54 74 6a 33 6f 30 46 55 44 73 4e 4b 48 30 6b 50 71 57 77 4d 61 2d 38 74 4c 71 34 61 6e 31 67 7a 6b Data Ascii: a68)]}'["dresp","03AFcWeA4WcY7R6KGiAO6Lg03au61dM3mLXJ5c9EOLg7hlxvEreAmvppeWEu3NECyI_ElfUoAqC9RGU9IiehusiDDvCr7WLK9RlBHLh-VuRAH0BvoUhMV4usAcQGHFY7OMXMVWOag8VuWc6f6WMYEmYKhYhcq9X1GBbM1w0l1wcmicPNaCoK0EsZAfTFx2obeJpUXf7mTBTtj3o0FUDsNKH0kPqWwMa-8tLq4an1gzk
2024-04-18 14:43:05 UTC	1255	IN	Data Raw: 57 64 75 54 30 65 75 47 73 50 38 51 6f 49 71 6f 58 78 47 53 79 31 4e 59 4c 63 63 59 6f 42 73 35 32 56 2d 6d 49 34 44 44 72 5a 62 2d 38 52 55 6c 62 4d 51 46 44 6f 4b 71 5a 51 72 48 44 5f 48 4e 38 5a 5a 34 44 73 62 55 49 67 44 76 42 6e 66 55 48 6d 73 79 6f 62 75 4a 45 76 6c 78 35 47 48 4c 76 6a 6b 4d 50 5f 4b 75 36 33 4b 4a 75 6e 51 67 38 6a 70 70 74 54 76 42 46 35 4c 33 68 77 71 71 5a 4d 62 76 57 41 53 50 49 48 6f 59 6e 66 44 4b 6b 61 55 35 65 4b 58 66 6f 4c 6b 61 53 48 69 6a 58 36 45 41 70 63 66 5f 4e 4b 48 6e 75 78 44 73 5f 74 46 5f 6a 57 68 58 6a 41 2d 6a 6e 46 47 68 79 48 6b 69 35 47 73 53 61 68 32 71 65 68 47 6a 72 39 45 4c 35 49 5a 35 66 45 53 74 4b 45 53 4f 5a 68 49 52 65 37 68 70 6c 63 54 77 5f 72 33 32 6d 79 53 70 67 72 50 45 6b 52 42 6c 70 32 65 Data Ascii: WduT0euGsP8QoIqoXxGSy1NYLccYoBs52V-mI4DDrZb-8RUlbMQFDoKqZQrHD_HN8ZZ4DsbUIgDvBnfUHmsyobuJEvlx5GHLvjkMP_Ku63KJunQg8jpptTvBF5L3hwqqZMbvWASPIHoYnfDKkaU5eKXfoLkaSHijX6EApcf_NKHnuxDs_tF_jWhXjA-jnFGhyHki5GsSah2qehGjr9EL5IZ5fEStKESOZhIRe7hplcTw_r32mySpgrPEkRBlp2e
2024-04-18 14:43:05 UTC	644	IN	Data Raw: 69 6a 52 4c 33 74 36 59 4e 47 50 71 43 79 46 4a 6b 67 51 5f 62 5f 51 4e 70 32 45 56 49 68 33 30 36 73 76 64 71 57 38 4e 61 49 58 33 71 52 6c 56 69 4d 42 6a 78 50 36 4a 37 79 67 46 5f 37 56 75 34 78 36 7a 6a 77 70 5f 6b 78 71 36 4e 7a 4a 34 73 57 4d 5a 6e 65 4d 63 70 37 38 6b 6b 54 56 58 4c 38 37 54 5f 6d 57 5f 4c 70 6b 49 48 34 64 5a 4c 79 32 6b 2d 30 4d 58 52 54 32 53 35 50 4e 68 53 4a 49 30 79 35 65 75 59 39 35 76 52 68 63 66 74 30 7a 5a 56 77 77 75 46 51 36 47 6e 54 45 4d 48 78 43 33 65 6a 46 6c 32 77 73 2d 66 54 77 39 2d 59 77 42 67 69 75 42 55 52 50 47 50 57 74 68 31 46 73 4c 51 31 48 6f 63 7a 73 54 67 48 56 70 38 77 48 75 63 62 36 59 49 64 46 56 4b 34 47 76 39 71 36 76 38 5a 67 41 48 31 78 42 38 31 5a 42 7a 59 33 4f 4b 41 33 4d 5f 37 42 35 39 73 65 Data Ascii: ijRL3t6YNGPqCyFJkgQ_b_QNp2EVIh306svdqW8NaIX3qRlViMBjxP6J7ygF_7Vu4x6zjwp_kxq6NzJ4sWMZneMcp78kkTVXL87T_mW_LpkIH4dZLy2k-0MXRT2S5PNhSJI0y5euY95vRhcft0zZVwwuFQ6GnTEMHxC3ejFl2ws-fTw9-YwBgiuBURPGPWth1FsLQ1HoczsTgHVp8wHucb6YIdFVK4Gv9q6v8ZgAH1xB81ZBzY3OKA3M_7B59se
2024-04-18 14:43:05 UTC	1255	IN	Data Raw: 64 36 37 0d 0a 55 6a 75 79 33 35 36 48 57 42 37 39 4f 57 47 74 6d 4f 38 66 67 76 5a 50 56 35 41 7a 70 75 30 49 6d 49 72 55 42 58 58 35 6f 62 44 6c 33 35 46 46 5f 32 67 56 53 65 54 61 6f 4a 51 57 59 79 44 79 54 74 55 54 4b 45 34 45 5a 34 4a 69 38 5f 39 32 7a 73 69 34 48 77 44 2d 72 38 5f 4c 6e 45 47 30 30 75 4d 4f 61 43 79 5a 55 61 6a 72 45 4d 69 78 49 65 74 61 55 37 55 65 61 6d 49 4e 53 38 61 5f 5a 77 32 32 71 50 66 73 68 57 6f 6a 55 6b 4c 6a 36 42 39 41 32 73 41 6e 62 6a 55 5a 56 69 5a 69 70 68 64 75 4d 71 39 37 76 42 56 55 38 41 72 64 30 73 63 4c 4b 72 66 53 73 7a 4b 54 63 43 58 4a 66 75 7a 74 34 79 5f 4c 6d 4f 47 6c 52 6c 35 66 30 4a 35 56 6c 39 41 32 47 4d 56 65 35 67 35 42 59 39 61 75 63 37 4d 6d 6f 46 5f 73 56 59 70 45 47 63 53 41 50 79 59 4e 7a 39 Data Ascii: d67Ujuy356HWB79OWGtmO8fgvZPV5Azpu0ImIrUBXX5obDl35FF_2gVSeTaoJQWYyDyTtUTKE4EZ4Ji8_92zsi4HwD-r8_LnEG00uMOaCyZUajrEMixIetaU7UeamINS8a_Zw22qPfshWojUkLj6B9A2sAnbjUZViZiphduMq97vBVU8Ard0scLKrfSszKTcCXJfuzt4y_LmOGlRl5f0J5Vl9A2GMVe5g5BY9auc7MmoF_sVYpEGcSAPyYNz9
2024-04-18 14:43:05 UTC	1255	IN	Data Raw: 34 75 5f 69 64 68 5f 71 6a 37 68 50 46 59 51 68 71 71 4e 69 31 66 6a 50 36 47 55 76 55 49 71 5a 34 53 52 42 67 6d 5a 75 54 46 77 67 62 75 62 35 47 46 34 38 41 6a 78 4a 6a 66 78 79 63 49 6d 71 4c 76 63 4f 4f 78 31 53 42 69 6c 77 50 42 34 43 43 78 6a 4a 5a 58 33 6c 32 48 39 49 4c 35 6a 52 55 6f 58 63 54 55 59 4e 62 70 32 73 35 74 35 4e 55 31 30 56 41 5a 75 34 48 37 62 62 70 71 70 6c 6a 31 50 44 31 78 79 52 64 58 73 36 35 32 4e 32 70 58 54 6e 67 44 48 74 59 76 54 79 67 46 4c 70 4c 31 44 4e 48 4d 6c 63 33 36 36 5f 4d 6b 70 49 62 72 61 64 50 7a 4b 6c 45 74 61 71 5f 75 4d 5f 61 33 4b 4d 54 5f 55 46 74 31 73 33 4e 45 6a 6e 33 76 58 46 6d 72 63 6d 71 33 51 68 69 43 6b 6a 75 45 39 67 4b 4b 69 70 4a 69 6a 54 45 5a 6e 48 47 38 2d 72 66 5f 63 49 71 30 5a 67 63 4a 75 Data Ascii: 4u_idh_qj7hPFYQhqqNi1fjP6GUvUIqZ4SRBgmZuTFwgbub5GF48AjxJjfxycImqLvcOOx1SBilwPB4CCxjJZX3l2H9IL5jRUoXcTUYNbp2s5t5NU10VAZu4H7bbpqplj1PD1xyRdXs652N2pXTngDHtYvTygFLpL1DNHMlc366_MkpIbradPzKlEtaq_uM_a3KMT_UFt1s3NEjn3vXFmrcmq3QhiCkjuE9gKKipJijTEZnHG8-rf_cIq0ZgcJu
2024-04-18 14:43:05 UTC	928	IN	Data Raw: 72 59 74 64 53 51 35 50 34 6f 70 6f 51 6a 34 49 6f 51 48 73 36 68 58 49 64 6a 4e 50 52 36 45 42 57 73 4e 51 70 4e 5a 48 49 44 38 7a 68 69 62 33 61 4d 65 70 61 39 77 65 6a 61 77 65 53 33 57 50 78 79 4a 32 6a 4e 37 74 6c 5a 76 73 75 78 56 57 61 68 35 38 4f 64 6e 30 49 4e 62 75 35 38 5a 5f 79 6c 35 58 37 47 67 66 66 6c 52 63 74 65 59 66 45 76 70 49 4b 65 50 5a 5a 53 4c 5a 4a 74 6d 5f 2d 56 30 56 72 6a 6a 35 51 70 4b 34 56 4e 43 76 6f 53 72 37 31 74 65 71 4f 79 51 56 70 6c 56 64 31 32 46 73 74 41 78 75 68 53 75 30 32 43 4e 46 35 75 52 50 32 6a 32 67 46 78 66 42 63 31 5a 30 6f 65 6f 4f 6d 38 49 65 73 6f 38 5a 43 77 45 4b 7a 57 46 77 66 31 69 6a 50 4e 6e 71 49 76 6f 70 39 6b 7a 61 4d 67 6c 48 49 71 38 7a 37 52 39 59 6e 54 34 39 56 7a 44 57 53 5a 4e 56 7a 7a 48 Data Ascii: rYtdSQ5P4opoQj4IoQHs6hXIdjNPR6EBWsNQpNZHID8zhib3aMepa9wejaweS3WPxyJ2jN7tlZvsuxVWah58Odn0INbu58Z_yl5X7GgfflRcteYfEvpIKePZZSLZJtm_-V0Vrjj5QpK4VNCvoSr71teqOyQVplVd12FstAxuhSu02CNF5uRP2j2gFxfBc1Z0oeoOm8Ieso8ZCwEKzWFwf1ijPNnqIvop9kzaMglHIq8z7R9YnT49VzDWSZNVzzH
2024-04-18 14:43:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49754	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:05 UTC	1499	OUT	GET /recaptcha/api2/payload?p=06AFcWeA49y5mejDfIItLfORTrCWMpwtXejgU5GCv958_nqMD5Zxylr-6zIx65ExHw1tpmotQ7Id4J-fYyfd4cyx0F-qJ09jcF7FAlBQXoal_B73_uydDY-r5s-DHQcgc0N5SMXpZpKkEPIZN4QyJ_FZeSXmOffxktGnHKIqywcNv4HybJbrC_vzHYAm1ddgiYyCAuBDRspTBM&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=2d8a8ce75c7ca037 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:05 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 18 Apr 2024 14:43:05 GMT Date: Thu, 18 Apr 2024 14:43:05 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:43:05 UTC	1255	IN	Data Raw: 37 41 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 Data Ascii: 7A2JFIFC!"$"$Cdd"}!1AQa"q
2024-04-18 14:43:05 UTC	706	IN	Data Raw: ba e5 93 3b 06 97 6a f1 b7 e5 39 34 f1 ab 58 31 23 cf c0 f7 53 fe 14 ee 85 66 5c d5 24 ff 00 89 6d cf fd 72 6f e5 52 b4 a7 da b1 b5 3d 46 da 4b 39 63 86 45 72 e8 57 1d 3a f1 52 ff 00 69 d9 96 70 67 40 07 dd cf 7a 2e 82 cc d2 f3 4f ad 15 98 9a 95 93 22 96 99 43 63 91 cf 14 51 74 16 67 8b ce 3c 45 6e bf 30 8e 61 eb b7 ad 42 35 9b a8 f2 2e f4 c5 73 8c 64 71 53 78 47 51 7b 8b 1b a9 f5 4d 52 52 f1 32 a4 48 ca 1c b1 20 fb 67 b7 ad 51 9b c5 32 ac e5 24 b3 b6 74 07 d5 86 7f cf d2 a2 ce f6 2b 42 7f ed ab 07 ff 00 5f 6b 3a 37 a8 1c 7e 95 27 db 34 59 63 03 ed 8c 8f dc 3a 1f f0 a8 13 c4 5a 74 84 09 f4 c2 09 ee ac ad fd 07 f3 ad 8d 27 4c d2 b5 b8 5d ad 62 01 d7 ef 21 18 60 3d 7a d2 96 9b a2 96 bb 15 e0 97 4f 45 09 6f aa 45 83 db 2b c5 5f 47 98 31 11 6a 2a ca 3f ba d8 Data Ascii: ;j94X1#Sf\$mroR=FK9cErW:Ripg@z.O"CcQtg<En0aB5.sdqSxGQ{MRR2H gQ2$t+B_k:7~'4Yc:Zt'L]b!`=zOEoE+_G1j*?
2024-04-18 14:43:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49755	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:06 UTC	1329	OUT	POST /recaptcha/api2/replaceimage?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 5879 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://www.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:06 UTC	5879	OUT	Data Raw: 76 3d 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 26 63 3d 30 33 41 46 63 57 65 41 34 57 63 59 37 52 36 4b 47 69 41 4f 36 4c 67 30 33 61 75 36 31 64 4d 33 6d 4c 58 4a 35 63 39 45 4f 4c 67 37 68 6c 78 76 45 72 65 41 6d 76 70 70 65 57 45 75 33 4e 45 43 79 49 5f 45 6c 66 55 6f 41 71 43 39 52 47 55 39 49 69 65 68 75 73 69 44 44 76 43 72 37 57 4c 4b 39 52 6c 42 48 4c 68 2d 56 75 52 41 48 30 42 76 6f 55 68 4d 56 34 75 73 41 63 51 47 48 46 59 37 4f 4d 58 4d 56 57 4f 61 67 38 56 75 57 63 36 66 36 57 4d 59 45 6d 59 4b 68 59 68 63 71 39 58 31 47 42 62 4d 31 77 30 6c 31 77 63 6d 69 63 50 4e 61 43 6f 4b 30 45 73 5a 41 66 54 46 78 32 6f 62 65 4a 70 55 58 66 37 6d 54 42 54 74 6a 33 6f 30 46 55 44 73 4e 4b 48 30 6b 50 71 57 77 4d 61 2d 38 74 Data Ascii: v=QoukH5jSO3sKFzVEA7Vc8VgC&c=03AFcWeA4WcY7R6KGiAO6Lg03au61dM3mLXJ5c9EOLg7hlxvEreAmvppeWEu3NECyI_ElfUoAqC9RGU9IiehusiDDvCr7WLK9RlBHLh-VuRAH0BvoUhMV4usAcQGHFY7OMXMVWOag8VuWc6f6WMYEmYKhYhcq9X1GBbM1w0l1wcmicPNaCoK0EsZAfTFx2obeJpUXf7mTBTtj3o0FUDsNKH0kPqWwMa-8t
2024-04-18 14:43:06 UTC	483	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 14:43:06 GMT Expires: Thu, 18 Apr 2024 14:43:06 GMT Cache-Control: private, max-age=0 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:43:06 UTC	772	IN	Data Raw: 61 36 35 0d 0a 29 5d 7d 27 0a 5b 22 64 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 35 6c 52 5a 61 6a 77 55 34 7a 52 4b 54 55 4f 73 76 52 71 4c 2d 48 6f 4b 72 31 51 43 4f 4f 2d 64 6c 6c 49 68 6b 41 7a 4c 67 67 65 34 5a 5f 4d 4f 78 44 45 4d 47 37 4e 33 44 78 41 75 33 69 77 64 35 2d 41 69 48 73 74 4e 4a 36 46 72 6d 4f 6e 37 49 62 66 52 6f 4d 37 71 30 56 4a 68 39 4b 72 49 7a 61 5a 4e 4f 42 69 35 59 71 61 37 70 49 37 34 4a 51 2d 54 6b 5a 6a 66 46 43 58 67 44 51 53 69 50 77 42 61 78 69 62 62 30 39 71 50 4e 71 30 33 42 6f 33 57 74 56 6a 30 65 4f 45 62 35 69 5a 41 65 48 52 73 6d 56 30 79 52 71 34 6a 48 6c 6d 64 41 49 43 57 48 4d 4b 73 36 34 73 63 4e 68 4e 66 76 30 46 41 54 79 43 50 68 34 6f 6f 49 75 61 66 53 66 71 58 30 62 59 30 65 72 54 49 70 67 58 4a 34 6f 2d Data Ascii: a65)]}'["dresp","03AFcWeA5lRZajwU4zRKTUOsvRqL-HoKr1QCOO-dllIhkAzLgge4Z_MOxDEMG7N3DxAu3iwd5-AiHstNJ6FrmOn7IbfRoM7q0VJh9KrIzaZNOBi5Yqa7pI74JQ-TkZjfFCXgDQSiPwBaxibb09qPNq03Bo3WtVj0eOEb5iZAeHRsmV0yRq4jHlmdAICWHMKs64scNhNfv0FATyCPh4ooIuafSfqX0bY0erTIpgXJ4o-
2024-04-18 14:43:06 UTC	1255	IN	Data Raw: 7a 77 4c 58 5a 57 50 6a 73 4f 36 55 55 71 6e 61 76 43 37 62 73 31 38 43 35 59 54 77 47 62 6e 65 6f 34 52 5a 66 74 57 5a 2d 43 69 5a 55 63 2d 41 72 54 52 55 57 5a 45 6e 77 30 4a 33 55 67 52 6b 52 69 79 74 6d 43 32 73 72 69 54 35 56 47 42 75 45 74 72 36 72 56 77 46 6b 7a 44 6a 56 38 47 57 30 59 50 38 31 4b 47 75 74 69 71 4b 57 4a 54 56 71 79 33 6d 36 51 45 66 32 46 58 55 58 55 31 6f 4d 49 65 6a 36 62 33 43 43 42 6f 51 64 32 75 6a 79 75 56 51 5a 62 69 43 41 76 57 45 49 44 36 4b 55 55 64 6d 42 52 6a 65 44 6e 57 45 73 4d 46 78 44 56 5f 58 79 72 59 6f 33 6b 4b 34 38 4a 4f 34 36 6e 7a 75 36 43 39 6d 5f 6d 73 35 75 5a 63 41 75 30 31 64 52 45 44 4f 50 5a 6b 4c 73 36 59 67 62 43 77 32 53 49 71 50 42 67 38 34 4b 75 6c 70 43 73 6f 68 45 6e 4c 79 4f 32 32 67 35 35 71 Data Ascii: zwLXZWPjsO6UUqnavC7bs18C5YTwGbneo4RZftWZ-CiZUc-ArTRUWZEnw0J3UgRkRiytmC2sriT5VGBuEtr6rVwFkzDjV8GW0YP81KGutiqKWJTVqy3m6QEf2FXUXU1oMIej6b3CCBoQd2ujyuVQZbiCAvWEID6KUUdmBRjeDnWEsMFxDV_XyrYo3kK48JO46nzu6C9m_ms5uZcAu01dREDOPZkLs6YgbCw2SIqPBg84KulpCsohEnLyO22g55q
2024-04-18 14:43:06 UTC	641	IN	Data Raw: 52 37 6d 38 32 65 61 48 76 59 42 77 43 34 4b 73 68 6e 31 38 7a 59 54 78 4f 59 4c 6d 79 62 69 6e 77 32 55 45 54 58 63 37 74 30 32 71 2d 53 65 50 67 6b 6a 4a 50 63 77 62 53 72 41 42 37 55 72 41 54 30 6d 62 69 75 4e 39 47 68 5f 37 70 61 4a 6a 56 5a 39 54 5f 4e 36 52 77 33 72 6d 35 4d 6e 52 6d 33 33 34 78 51 44 68 7a 52 58 76 33 72 4b 78 38 33 6a 75 55 78 61 54 49 76 62 68 72 5a 57 53 47 2d 57 78 61 69 4d 4c 2d 32 78 51 59 6c 4f 4b 67 55 6f 46 2d 47 6c 63 53 42 6d 70 5f 71 46 59 4d 36 4b 6f 2d 2d 31 67 78 58 4b 42 71 32 6b 4d 50 56 35 4d 63 6d 55 54 70 2d 38 2d 4b 38 56 4f 69 6b 77 69 4a 41 38 64 6b 59 59 44 6b 36 4f 66 70 31 35 41 72 38 79 2d 5f 66 6e 6b 45 70 6e 6a 6a 76 76 63 64 7a 43 56 64 4f 4f 36 47 76 47 72 6f 6b 6c 45 38 55 39 48 5f 47 63 4c 74 34 48 Data Ascii: R7m82eaHvYBwC4Kshn18zYTxOYLmybinw2UETXc7t02q-SePgkjJPcwbSrAB7UrAT0mbiuN9Gh_7paJjVZ9T_N6Rw3rm5MnRm334xQDhzRXv3rKx83juUxaTIvbhrZWSG-WxaiML-2xQYlOKgUoF-GlcSBmp_qFYM6Ko--1gxXKBq2kMPV5McmUTp-8-K8VOikwiJA8dkYYDk6Ofp15Ar8y-_fnkEpnjjvvcdzCVdOO6GvGroklE8U9H_GcLt4H
2024-04-18 14:43:06 UTC	1255	IN	Data Raw: 64 38 30 0d 0a 77 73 55 31 7a 50 5a 2d 71 53 58 68 63 70 76 48 37 52 67 34 54 2d 67 38 59 69 4e 33 64 31 76 47 5f 55 44 51 50 77 76 5f 56 68 54 4e 4d 38 55 4b 39 4f 74 30 35 7a 34 6a 43 44 63 58 44 7a 33 58 77 71 77 33 32 42 46 79 57 49 61 70 53 6b 69 41 64 77 65 79 37 6b 4a 78 38 48 43 4b 73 54 44 61 4d 63 56 4b 4f 42 33 65 70 54 79 71 71 57 55 5a 6c 35 73 39 62 4a 59 34 54 72 41 49 35 4c 32 42 2d 31 42 77 48 73 66 63 6c 53 44 6f 57 44 50 37 52 43 4e 75 50 35 33 6b 6c 6c 6b 62 71 57 42 67 77 64 69 4c 66 56 6a 75 58 4b 69 71 67 51 6b 49 66 39 79 65 33 68 54 61 56 51 48 4f 5a 66 50 78 33 51 50 52 38 34 70 75 44 65 41 4e 56 34 62 74 4a 53 6b 5f 39 35 33 4e 6e 4e 78 6d 72 49 6d 4c 66 41 68 37 6b 56 59 61 6f 66 33 31 33 53 58 36 66 74 64 71 36 6e 6b 7a 6d 62 Data Ascii: d80wsU1zPZ-qSXhcpvH7Rg4T-g8YiN3d1vG_UDQPwv_VhTNM8UK9Ot05z4jCDcXDz3Xwqw32BFyWIapSkiAdwey7kJx8HCKsTDaMcVKOB3epTyqqWUZl5s9bJY4TrAI5L2B-1BwHsfclSDoWDP7RCNuP53kllkbqWBgwdiLfVjuXKiqgQkIf9ye3hTaVQHOZfPx3QPR84puDeANV4btJSk_953NnNxmrImLfAh7kVYaof313SX6ftdq6nkzmb
2024-04-18 14:43:06 UTC	1255	IN	Data Raw: 51 72 32 4e 37 39 34 58 35 6e 61 73 31 37 7a 6a 35 38 70 79 4f 32 39 56 56 77 42 68 74 4c 34 51 73 2d 51 54 74 49 2d 64 36 32 69 44 55 4a 58 79 75 32 70 61 61 49 4f 6e 4f 62 35 6e 71 75 56 64 32 30 31 44 69 48 51 64 44 39 73 5f 50 42 65 59 2d 51 4b 5f 52 56 64 78 30 46 72 30 52 4f 61 6c 58 59 5a 36 47 35 53 61 44 55 32 74 70 32 46 36 38 4e 46 53 4e 39 47 4c 52 6b 55 31 57 5f 70 6a 6d 32 63 54 68 49 74 30 73 34 78 4c 31 54 6e 57 53 6d 53 4f 6e 52 6c 5f 54 39 39 6e 75 67 56 34 4f 74 5f 66 5f 33 71 32 5f 78 44 39 64 71 4c 57 69 61 69 4d 70 64 76 44 39 4e 4f 33 46 6e 6c 35 6e 42 61 63 74 67 53 7a 6b 35 59 74 35 73 6e 39 50 48 65 5f 4a 75 34 52 6b 67 56 71 6b 45 36 5a 56 39 6a 78 47 4e 51 61 48 4c 6d 48 4b 74 31 44 66 62 77 30 6a 61 5a 58 2d 73 37 73 47 64 37 Data Ascii: Qr2N794X5nas17zj58pyO29VVwBhtL4Qs-QTtI-d62iDUJXyu2paaIOnOb5nquVd201DiHQdD9s_PBeY-QK_RVdx0Fr0ROalXYZ6G5SaDU2tp2F68NFSN9GLRkU1W_pjm2cThIt0s4xL1TnWSmSOnRl_T99nugV4Ot_f_3q2_xD9dqLWiaiMpdvD9NO3Fnl5nBactgSzk5Yt5sn9PHe_Ju4RkgVqkE6ZV9jxGNQaHLmHKt1Dfbw0jaZX-s7sGd7
2024-04-18 14:43:06 UTC	953	IN	Data Raw: 78 2d 2d 54 69 49 4f 41 69 36 74 50 77 67 62 4f 34 48 7a 6a 68 43 43 50 71 62 71 32 69 53 67 73 4c 70 74 43 55 6d 39 53 47 53 44 53 78 73 79 4b 59 35 41 48 4a 4a 37 37 5f 54 36 6e 2d 4c 71 5a 76 67 41 47 42 58 56 48 79 79 78 48 4e 72 43 4a 6a 59 38 70 4d 78 59 69 6f 69 57 5f 30 55 51 34 35 6e 57 43 66 57 67 52 73 6e 58 75 4e 57 55 74 49 5a 47 49 47 61 43 34 70 6b 75 42 51 78 66 7a 70 33 47 77 7a 4d 44 5f 39 5f 63 57 7a 59 74 67 69 53 34 41 33 33 79 39 72 4c 54 73 33 69 79 6c 79 71 79 42 64 45 52 34 6c 7a 37 67 56 2d 2d 58 53 4f 46 48 62 48 7a 75 6b 30 33 59 76 64 74 38 74 76 57 35 76 4d 6c 50 78 4e 77 54 4c 6e 6c 68 64 32 64 37 39 58 39 39 74 57 42 4f 37 4b 76 66 58 39 79 54 30 44 41 30 56 6e 75 76 62 65 48 7a 52 74 71 45 43 42 32 44 46 46 34 78 55 6d 68 Data Ascii: x--TiIOAi6tPwgbO4HzjhCCPqbq2iSgsLptCUm9SGSDSxsyKY5AHJJ77_T6n-LqZvgAGBXVHyyxHNrCJjY8pMxYioiW_0UQ45nWCfWgRsnXuNWUtIZGIGaC4pkuBQxfzp3GwzMD_9_cWzYtgiS4A33y9rLTs3iylyqyBdER4lz7gV--XSOFHbHzuk03Yvdt8tvW5vMlPxNwTLnlhd2d79X99tWBO7KvfX9yT0DA0VnuvbeHzRtqECB2DFF4xUmh
2024-04-18 14:43:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49756	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:06 UTC	1499	OUT	GET /recaptcha/api2/payload?p=06AFcWeA4hugY_j6cLjsTq6ItB7G_7FlPQ9OasBoDJZI-uCF-q987pjHxm_7YGCRPVqOpYpw0ppSeNrVqJoqqm8xchQuabGTkM6aSjP-BS9CdlR7vK9V1cTgmj0DyYvHLV4aeRchnWmVXlCpfs6vZ_2UaD9uosQ-VQZmNKVoD1Rayxmqe25qq4nKvjQt97p5TjWMzvSoCMOLwq&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=d8fb9f57db980dec HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:06 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 18 Apr 2024 14:43:06 GMT Date: Thu, 18 Apr 2024 14:43:06 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:43:06 UTC	836	IN	Data Raw: 31 33 32 41 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 132AJFIFC!"$"$Cdd"}!1AQa"q
2024-04-18 14:43:06 UTC	1255	IN	Data Raw: 0f eb 5a c6 b3 8b e5 9f f5 b7 92 fd 48 83 bb b5 b4 5b eb af cf 43 9f 85 d5 47 da 66 65 90 f9 7f 20 66 3b 41 6c 60 b0 e7 39 00 9e c7 ea 79 ad 1b 2b a3 1e eb 9b 98 4a 28 64 05 95 f6 ae 06 46 71 9e 9c 9f af 1d 3b e4 99 5e 49 a3 0b 01 84 ee 27 0a bb 98 e1 54 0c 91 d3 a3 0c 74 ed ed 46 8b 61 75 ab 6a 30 d8 e9 fb 25 9a e6 4c 02 46 fc 92 dc e0 e3 93 c6 73 f9 f3 cd 75 ed ab 3a a1 1a 93 97 24 77 7a 6f fa a6 6c 6b 97 f6 f3 de 43 1a 3b 01 e5 15 44 23 80 c4 72 06 39 1d 08 eb d3 eb 58 3a 84 b1 cf 38 67 66 02 36 24 b2 e0 88 97 e5 e9 9c 8e dd bd fe a7 a4 f1 67 80 3c 59 e1 48 54 ea b6 1e 5c 32 3a e1 b7 02 15 88 e1 78 e9 8c 9e f8 ce 7a f1 5c 9a 4c c4 62 2d 91 b0 94 00 77 6e db 9f e1 19 3c 1e bc 9e 06 3f 26 9f 3b be e4 d5 c2 4e 8b f7 d6 ff 00 d7 f5 dc b3 b4 79 61 59 57 6b Data Ascii: ZH[CGfe f;Al`9y+J(dFq;^I'TtFauj0%LFsu:$wzolkC;D#r9X:8gf6$g<YHT\2:xz\Lb-wn<?&;NyaYWk
2024-04-18 14:43:06 UTC	1255	IN	Data Raw: 3e 84 11 ef c7 b6 68 0c 1d bc b5 0c d2 79 64 14 f2 c7 43 93 ce 46 32 37 7e b9 cd 66 e3 a3 b6 c2 6e c9 a8 96 ed 98 c8 c3 0c ea c6 42 d1 a8 e0 f3 8c 8d c4 1c 81 9e 40 1d fa 1c d3 9f 63 4e 8f 04 2b 1a c8 0f 90 a7 0f f2 f5 2a b8 1e a0 80 0f 4c 75 3d 2a ac 72 62 29 4e 21 68 02 9c e7 80 ea 30 18 e7 a7 be 30 79 3c 7b 4c 4f 11 09 98 88 cb 04 f2 9c 95 2e c4 f5 c0 07 ae de bf cc 9e 13 d1 dc 7d 56 a3 e0 45 22 37 3e 46 c6 60 a8 1f e6 67 03 ae 31 c9 ef cf 4e 00 35 02 1c 97 62 a5 9d 9f 19 03 8c a8 03 07 8c 13 96 e3 af 27 1d aa 5f f8 f8 85 9e 76 66 9a 60 19 ca 28 25 94 8d a4 9e 39 e1 47 4e 84 1e 3a 54 51 f0 91 49 f3 5b b2 82 ab 21 42 a4 67 38 c1 f4 07 39 f4 ce 79 ef 77 77 bb 29 ea ee bf e1 bf af f8 72 40 2e 16 d5 cc 88 50 38 5c 36 f3 d7 39 6e 9f af 41 8e f5 5e 05 90 e6 Data Ascii: >hydCF27~fnB@cN+Lu=rb)N!h00y<{LO.}VE"7>F`g1N5b'_vf`(%9GN:TQI[!Bg89yww)r@.P8\69nA^
2024-04-18 14:43:06 UTC	1255	IN	Data Raw: 35 4e f2 47 37 53 a1 c3 09 39 75 86 42 e1 46 79 19 e7 3f c3 eb cd 48 d7 d1 f9 e0 15 9d 50 02 02 1e 70 a7 a0 1d 1b 3b bb f6 23 da a5 5a 3b ff 00 5f d3 fc 0e 57 16 d5 d6 a5 99 6d bc e9 1f 7c 50 bb ed 66 66 52 07 3c 64 36 71 c0 c8 1f 51 d7 23 85 9a 29 2d de 27 11 16 2c 58 30 48 ce e7 ec 39 2c 09 1c 1e 79 c9 20 e0 e7 82 09 d2 47 84 cf 11 0b 81 1e c4 c2 85 00 e4 ae 7b 72 0e 07 5e 01 c8 eb 4e 65 01 25 55 8d 95 50 a8 40 e8 22 7d c5 f2 32 0f 43 85 e3 92 38 1e b4 46 29 d9 2d 3f ab 13 b3 ef fd 7a 91 4d b4 ca b2 33 ca 89 e5 86 ff 00 49 90 96 1f 28 27 18 e3 8e 38 23 1f 41 c5 56 fb 6f 9f 09 b8 92 51 00 57 0e 92 30 00 31 1c e4 81 e9 c6 01 3d f9 20 e3 2f 66 91 af 24 8c b4 ce cc 49 49 14 98 b7 b1 00 70 31 f2 9e 9d 3b 7a 74 a8 6f a4 76 46 65 81 8c 73 0f de 49 bf 8e 80 ae Data Ascii: 5NG7S9uBFy?HPp;#Z;_Wm\|PffR<d6qQ#)-',X0H9,y G{r^Ne%UP@"}2C8F)-?zM3I('8#AVoQW01= /f$IIp1;ztovFesI
2024-04-18 14:43:06 UTC	311	IN	Data Raw: 08 9b 49 3b 58 6f 51 c8 f5 e9 f9 0a 28 ae 39 b7 cf f7 7e a5 3d 1e 9d ff 00 cc 8e 26 f3 2e 55 5d 54 b4 ab b9 9f 68 dc 78 ce 3e 95 3f d9 13 c9 76 67 91 db 63 4a 09 3d 1b 77 5f af 03 f2 a2 8a d6 3b 91 4b 6b 7f 5d 4b 38 1e 6d cb 80 14 42 a4 22 2f 0a 30 ed d8 7f ba 3f 5a af 67 34 93 58 79 ce 7e 75 20 02 3a fc e7 93 9e b9 ff 00 13 9c d1 45 67 4f 58 ea 74 50 57 71 bf 75 f9 1d 3e 8f 21 d5 2c 4a 5c 28 41 25 dc 50 9f 2f 23 01 f7 16 e3 a6 78 15 73 c5 11 79 12 dc 4b 1c b2 8d 8e 54 2e f2 01 01 47 a7 34 51 5e 74 1b 53 56 f3 fd 09 a9 a5 4b 7a 14 92 53 27 8a 6d b4 c6 51 f6 7b 99 59 1c 02 41 00 60 71 cf 1c 1a cc d6 65 36 9a 92 41 12 a9 de c1 8b 9c ee 19 70 08 1d b1 c7 a5 14 57 64 36 5e 9f e6 67 0f e2 25 e7 fe 64 16 b7 2c 6e ec 5c c5 0e 43 33 72 99 c9 05 54 1f a8 0e 70 7e Data Ascii: I;XoQ(9~=&.U]Thx>?vgcJ=w_;Kk]K8mB"/0?Zg4Xy~u :EgOXtPWqu>!,J\(A%P/#xsyKT.G4Q^tSVKzS'mQ{YA`qe6ApWd6^g%d,n\C3rTp~
2024-04-18 14:43:06 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-04-18 14:43:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49757	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:07 UTC	1327	OUT	POST /recaptcha/api2/userverify?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 9312 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://www.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:07 UTC	9312	OUT	Data Raw: 76 3d 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 26 63 3d 30 33 41 46 63 57 65 41 35 6c 52 5a 61 6a 77 55 34 7a 52 4b 54 55 4f 73 76 52 71 4c 2d 48 6f 4b 72 31 51 43 4f 4f 2d 64 6c 6c 49 68 6b 41 7a 4c 67 67 65 34 5a 5f 4d 4f 78 44 45 4d 47 37 4e 33 44 78 41 75 33 69 77 64 35 2d 41 69 48 73 74 4e 4a 36 46 72 6d 4f 6e 37 49 62 66 52 6f 4d 37 71 30 56 4a 68 39 4b 72 49 7a 61 5a 4e 4f 42 69 35 59 71 61 37 70 49 37 34 4a 51 2d 54 6b 5a 6a 66 46 43 58 67 44 51 53 69 50 77 42 61 78 69 62 62 30 39 71 50 4e 71 30 33 42 6f 33 57 74 56 6a 30 65 4f 45 62 35 69 5a 41 65 48 52 73 6d 56 30 79 52 71 34 6a 48 6c 6d 64 41 49 43 57 48 4d 4b 73 36 34 73 63 4e 68 4e 66 76 30 46 41 54 79 43 50 68 34 6f 6f 49 75 61 66 53 66 71 58 30 62 59 30 65 72 Data Ascii: v=QoukH5jSO3sKFzVEA7Vc8VgC&c=03AFcWeA5lRZajwU4zRKTUOsvRqL-HoKr1QCOO-dllIhkAzLgge4Z_MOxDEMG7N3DxAu3iwd5-AiHstNJ6FrmOn7IbfRoM7q0VJh9KrIzaZNOBi5Yqa7pI74JQ-TkZjfFCXgDQSiPwBaxibb09qPNq03Bo3WtVj0eOEb5iZAeHRsmV0yRq4jHlmdAICWHMKs64scNhNfv0FATyCPh4ooIuafSfqX0bY0er
2024-04-18 14:43:08 UTC	483	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Thu, 18 Apr 2024 14:43:07 GMT Expires: Thu, 18 Apr 2024 14:43:07 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:43:08 UTC	598	IN	Data Raw: 32 34 66 0d 0a 29 5d 7d 27 0a 5b 22 75 76 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 36 76 71 38 70 38 41 35 62 74 42 78 35 5a 69 76 64 70 49 30 36 42 46 78 6f 6d 4c 38 33 66 2d 4c 6f 6c 65 55 6b 77 6a 79 35 67 61 56 71 38 6c 35 70 68 51 6f 37 35 75 5a 77 6c 57 45 33 47 54 36 38 30 34 74 6a 4e 4b 63 6e 4b 45 61 50 38 58 38 67 6c 50 34 76 58 58 36 61 75 64 56 56 43 5a 44 46 73 66 61 42 78 47 7a 74 57 73 48 76 64 44 52 43 46 46 62 41 42 33 68 6d 38 4b 50 56 51 70 4e 63 69 72 47 51 6f 74 5a 77 38 39 7a 6e 39 6c 6d 49 32 59 48 78 49 42 59 66 43 42 4f 48 44 74 6c 62 71 63 42 46 4a 55 66 5f 77 4e 71 64 6b 65 42 48 4f 59 65 79 5a 66 51 4f 51 55 73 35 58 44 6d 30 4f 34 4f 69 48 62 5f 70 4d 68 61 32 61 54 67 45 43 75 65 4b 4d 66 48 33 6f 49 61 4b 6f 31 44 37 38 Data Ascii: 24f)]}'["uvresp","03AFcWeA6vq8p8A5btBx5ZivdpI06BFxomL83f-LoleUkwjy5gaVq8l5phQo75uZwlWE3GT6804tjNKcnKEaP8X8glP4vXX6audVVCZDFsfaBxGztWsHvdDRCFFbAB3hm8KPVQpNcirGQotZw89zn9lmI2YHxIBYfCBOHDtlbqcBFJUf_wNqdkeBHOYeyZfQOQUs5XDm0O4OiHb_pMha2aTgECueKMfH3oIaKo1D78
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 61 38 61 0d 0a 36 34 6e 5f 32 5f 42 71 65 51 73 68 4c 2d 61 4f 78 79 47 31 39 71 38 61 67 38 37 69 59 58 68 33 52 68 4a 56 38 66 6d 53 52 51 33 65 56 34 35 55 67 59 76 65 6d 47 66 6b 6f 4f 67 70 75 73 49 4b 76 37 35 6d 61 50 4d 59 41 63 56 30 6e 6a 69 34 64 4f 6c 4a 6f 49 43 37 52 39 67 61 54 2d 6a 36 65 56 6e 74 51 4a 72 34 75 4c 6f 35 73 33 43 68 4b 49 44 57 52 54 7a 6d 64 36 35 52 6b 72 38 65 6c 45 4c 57 37 4c 4b 68 6b 64 49 34 5a 48 61 31 76 33 49 4f 67 7a 73 2d 72 49 38 42 73 7a 55 32 46 71 57 75 76 54 36 42 45 33 66 6a 52 31 58 70 70 46 72 71 75 73 4f 52 53 35 72 4a 74 45 6a 62 53 4d 71 7a 5f 53 56 39 36 4f 33 5f 78 33 52 6a 58 2d 65 7a 6f 58 5a 66 68 35 31 38 76 30 77 6c 45 4b 30 49 75 70 2d 6c 32 4c 6b 5f 73 53 71 4b 48 57 6f 41 36 78 69 66 46 36 Data Ascii: a8a64n_2_BqeQshL-aOxyG19q8ag87iYXh3RhJV8fmSRQ3eV45UgYvemGfkoOgpusIKv75maPMYAcV0nji4dOlJoIC7R9gaT-j6eVntQJr4uLo5s3ChKIDWRTzmd65Rkr8elELW7LKhkdI4ZHa1v3IOgzs-rI8BszU2FqWuvT6BE3fjR1XppFrqusORS5rJtEjbSMqz_SV96O3_x3RjX-ezoXZfh518v0wlEK0Iup-l2Lk_sSqKHWoA6xifF6
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 61 4c 4a 63 5f 55 6e 75 2d 4e 72 74 66 6b 69 75 68 64 6b 72 4a 58 30 73 51 6f 4e 5f 57 7a 51 6d 2d 35 68 62 76 4e 75 39 4e 75 73 4f 41 54 56 6b 67 65 56 6c 57 54 4a 49 4c 55 2d 76 4d 54 37 4d 68 44 4a 4b 55 5f 32 77 6d 74 75 44 5a 41 42 73 61 72 7a 76 64 4c 59 35 47 45 31 67 72 66 65 45 6d 76 66 64 42 33 64 65 77 75 62 79 5a 4e 4a 6d 4e 6f 38 50 42 64 4d 52 6e 4c 4d 77 51 78 71 6a 51 55 4a 4d 33 37 4c 57 53 51 65 62 57 55 67 68 53 4e 4a 46 32 75 55 46 69 37 5f 44 2d 6f 30 41 6c 76 50 6b 32 5f 31 74 62 39 44 32 6c 70 6f 34 4a 34 55 64 6b 73 61 79 53 63 51 4a 57 39 7a 31 41 6f 52 79 62 4a 70 6d 41 5f 78 6b 70 45 4d 4e 50 5f 43 48 4f 53 4a 36 6a 75 58 69 72 64 41 79 72 76 52 52 56 6d 75 45 33 54 75 53 72 6c 4b 67 6b 46 42 36 37 5a 4d 48 75 51 7a 48 44 51 50 Data Ascii: aLJc_Unu-NrtfkiuhdkrJX0sQoN_WzQm-5hbvNu9NusOATVkgeVlWTJILU-vMT7MhDJKU_2wmtuDZABsarzvdLY5GE1grfeEmvfdB3dewubyZNJmNo8PBdMRnLMwQxqjQUJM37LWSQebWUghSNJF2uUFi7_D-o0AlvPk2_1tb9D2lpo4J4UdksayScQJW9z1AoRybJpmA_xkpEMNP_CHOSJ6juXirdAyrvRRVmuE3TuSrlKgkFB67ZMHuQzHDQP
2024-04-18 14:43:08 UTC	195	IN	Data Raw: 73 54 6e 4e 79 54 6c 68 66 6d 58 4e 59 46 52 6a 5f 72 53 5a 4a 62 33 53 77 56 6d 45 55 4a 33 35 36 6c 31 6b 4f 31 79 34 50 30 57 36 70 2d 4c 33 50 79 68 66 6f 39 53 4f 63 53 6d 6d 39 62 42 5a 74 31 47 6b 6b 4e 72 5a 53 59 4e 62 74 47 37 72 6b 6f 38 4d 64 6e 34 4b 64 38 2d 32 73 68 79 34 74 6d 4f 43 71 33 4b 57 6c 6a 44 38 54 71 2d 62 42 54 32 31 47 53 6f 5f 30 37 62 4a 61 34 7a 6e 69 70 68 30 6c 50 51 43 32 6f 55 64 76 50 68 4f 4b 4c 6f 4b 54 45 6d 53 43 77 65 73 4c 4b 39 56 4d 4c 33 70 6d 53 39 68 6b 6d 6a 51 36 64 74 4a 4e 4b 64 6b 71 6f 45 33 38 6d 36 48 42 30 37 78 62 0d 0a Data Ascii: sTnNyTlhfmXNYFRj_rSZJb3SwVmEUJ356l1kO1y4P0W6p-L3Pyhfo9SOcSmm9bBZt1GkkNrZSYNbtG7rko8Mdn4Kd8-2shy4tmOCq3KWljD8Tq-bBT21GSo_07bJa4zniph0lPQC2oUdvPhOKLoKTEmSCwesLK9VML3pmS9hkmjQ6dtJNKdkqoE38m6HB07xb
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 31 35 32 65 0d 0a 76 32 48 59 6c 67 7a 6e 33 7a 6d 7a 49 73 4a 47 76 79 66 50 67 2d 4b 2d 72 50 48 71 52 50 54 73 6e 71 72 36 6b 31 35 72 37 6d 4f 42 6d 6a 46 6d 35 59 30 45 54 70 45 71 43 61 76 69 66 7a 67 56 65 36 6e 79 30 59 4a 43 65 6f 50 43 59 33 57 35 6c 57 49 52 64 6a 6f 67 66 75 78 69 71 51 79 4e 75 6d 53 68 4a 78 31 4b 66 46 66 33 53 5f 36 33 4e 75 33 37 31 78 7a 4c 36 57 55 74 47 6f 48 4f 65 35 77 5f 54 6e 73 38 5a 45 4d 4e 50 45 4e 35 38 75 49 51 30 63 50 31 54 79 36 57 52 63 62 4a 46 33 7a 71 37 6b 35 57 4f 61 6e 4e 75 6c 6e 6a 6e 64 46 52 6f 45 35 36 39 5f 54 74 6f 43 32 79 39 74 76 58 41 44 47 35 4f 5f 71 4e 68 67 61 66 68 57 65 56 4f 6c 58 6a 6d 68 6b 38 78 4f 36 74 50 66 35 53 55 59 42 69 41 4c 48 51 6b 4c 77 65 54 50 57 4e 54 7a 6a 6e 68 Data Ascii: 152ev2HYlgzn3zmzIsJGvyfPg-K-rPHqRPTsnqr6k15r7mOBmjFm5Y0ETpEqCavifzgVe6ny0YJCeoPCY3W5lWIRdjogfuxiqQyNumShJx1KfFf3S_63Nu371xzL6WUtGoHOe5w_Tns8ZEMNPEN58uIQ0cP1Ty6WRcbJF3zq7k5WOanNulnjndFRoE569_TtoC2y9tvXADG5O_qNhgafhWeVOlXjmhk8xO6tPf5SUYBiALHQkLweTPWNTzjnh
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 7a 35 54 47 6e 67 4b 34 37 36 53 47 64 69 56 45 47 42 6b 35 4d 6b 7a 30 4c 39 43 36 33 78 54 67 56 72 4e 36 33 4d 50 32 36 69 66 6a 52 76 33 6d 64 59 66 71 5a 4b 77 51 51 75 74 58 44 76 31 36 79 66 4a 61 41 7a 70 41 77 62 4c 49 32 31 46 36 43 51 32 69 46 72 6f 34 34 42 7a 45 79 41 54 74 32 74 71 32 39 54 56 36 57 42 35 50 6a 5a 77 36 30 79 66 31 47 31 68 41 51 39 41 50 32 44 6d 52 4f 61 66 6c 34 4b 34 64 55 58 65 56 39 75 56 56 68 36 52 4a 6b 71 71 6d 32 70 48 35 59 57 47 45 31 53 76 66 58 70 42 76 59 54 49 79 66 4c 50 42 53 53 53 4a 58 37 79 32 66 78 37 71 58 6f 46 4d 4e 4c 72 52 30 7a 31 39 79 74 4e 32 58 73 39 39 68 58 50 65 38 54 64 42 71 75 47 34 73 78 32 57 58 6a 36 67 58 43 69 7a 39 45 5f 4f 50 6b 48 6e 78 59 2d 66 6e 62 65 30 39 59 70 72 34 75 76 Data Ascii: z5TGngK476SGdiVEGBk5Mkz0L9C63xTgVrN63MP26ifjRv3mdYfqZKwQQutXDv16yfJaAzpAwbLI21F6CQ2iFro44BzEyATt2tq29TV6WB5PjZw60yf1G1hAQ9AP2DmROafl4K4dUXeV9uVVh6RJkqqm2pH5YWGE1SvfXpBvYTIyfLPBSSSJX7y2fx7qXoFMNLrR0z19ytN2Xs99hXPe8TdBquG4sx2WXj6gXCiz9E_OPkHnxY-fnbe09Ypr4uv
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 4d 54 6f 30 44 6e 52 6f 64 50 61 7a 61 6a 77 73 77 6a 33 69 76 45 50 74 79 4b 4d 62 51 79 68 41 38 36 5a 77 6d 35 66 41 53 43 42 4d 44 58 65 63 65 61 50 33 4a 39 79 6d 33 57 50 30 65 6d 61 53 49 51 43 31 4d 79 66 65 6e 6e 43 56 49 46 2d 78 47 71 5f 57 54 70 6c 61 45 2d 6c 41 57 74 54 76 33 73 77 56 4f 6b 39 77 22 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 36 4a 4c 42 7a 47 62 4c 47 43 6e 33 59 67 47 5a 73 76 49 34 6b 74 78 47 4d 61 5a 32 53 49 64 32 34 35 4c 79 65 47 63 7a 76 31 2d 61 49 6b 34 68 46 38 43 41 68 61 74 6f 6d 68 6c 37 71 72 31 64 6a 6f 56 4b 4f 68 5f 61 43 56 6e 6f 59 41 46 42 4a 6f 4e 2d 41 59 62 70 39 50 2d 78 39 39 7a 58 6a 52 37 35 6a 58 35 66 37 30 76 32 30 Data Ascii: MTo0DnRodPazajwswj3ivEPtyKMbQyhA86Zwm5fASCBMDXeceaP3J9ym3WP0emaSIQC1MyfennCVIF-xGq_WTplaE-lAWtTv3swVOk9w",0,null,null,null,null,["rresp","03AFcWeA6JLBzGbLGCn3YgGZsvI4ktxGMaZ2SId245LyeGczv1-aIk4hF8CAhatomhl7qr1djoVKOh_aCVnoYAFBJoN-AYbp9P-x99zXjR75jX5f70v20
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 55 73 71 5a 77 4c 56 6e 43 47 38 58 32 34 59 6c 50 4c 37 7a 34 32 6a 4d 62 6a 61 79 31 6b 65 31 34 6c 4a 66 4d 58 68 54 46 50 50 41 65 78 64 6c 7a 46 30 59 45 5f 71 46 49 50 32 67 64 46 57 75 58 4e 52 58 62 46 6b 57 4d 4a 78 2d 36 61 2d 6a 76 52 32 48 6f 32 71 65 6a 62 41 66 4e 46 41 63 47 68 30 31 33 6d 71 75 73 2d 46 61 63 76 36 4d 6e 2d 45 37 49 32 33 65 4b 76 6e 43 70 7a 66 4f 43 68 71 62 33 71 72 4e 69 72 79 36 38 6e 70 52 61 34 64 76 62 51 73 66 52 77 71 52 45 38 4d 75 6e 61 6b 4c 36 47 69 67 51 56 61 77 36 77 37 76 47 5f 5a 53 42 5f 48 36 54 6d 5f 35 53 6d 44 51 48 4b 52 55 44 39 68 61 35 43 6b 38 70 41 79 72 5f 55 32 73 48 55 55 76 30 6c 65 31 6b 7a 66 68 2d 6a 32 5a 42 54 53 4a 37 5a 43 53 4b 54 65 70 54 73 37 65 4a 78 68 58 6f 58 53 6e 72 50 58 Data Ascii: UsqZwLVnCG8X24YlPL7z42jMbjay1ke14lJfMXhTFPPAexdlzF0YE_qFIP2gdFWuXNRXbFkWMJx-6a-jvR2Ho2qejbAfNFAcGh013mqus-Facv6Mn-E7I23eKvnCpzfOChqb3qrNiry68npRa4dvbQsfRwqRE8MunakL6GigQVaw6w7vG_ZSB_H6Tm_5SmDQHKRUD9ha5Ck8pAyr_U2sHUUv0le1kzfh-j2ZBTSJ7ZCSKTepTs7eJxhXoXSnrPX
2024-04-18 14:43:08 UTC	410	IN	Data Raw: 32 30 51 70 57 6c 67 6c 45 37 33 30 61 52 31 4f 32 48 53 63 6a 54 39 6f 56 4f 34 62 39 74 46 5a 52 67 4e 72 33 6a 71 4e 6a 5a 76 57 57 4e 50 6f 33 78 31 52 4b 46 5f 35 49 78 5f 70 39 36 2d 46 74 50 66 4c 73 74 45 53 58 52 37 6a 7a 6d 6a 48 31 5a 6a 32 49 6c 71 48 62 36 36 2d 4c 39 42 38 32 4e 52 45 33 2d 42 58 48 34 6a 52 67 2d 72 74 39 58 2d 5a 66 45 74 62 66 31 61 31 46 6f 4e 7a 49 67 59 6a 6f 4b 4d 45 61 76 32 5a 78 53 74 6d 68 34 34 74 36 74 4e 73 36 38 32 58 71 52 5a 64 39 38 6f 32 43 77 64 33 52 48 77 43 4b 73 46 77 50 6d 6d 44 4a 67 4b 72 78 37 6f 44 5f 75 64 64 52 69 53 5a 47 43 47 6c 56 6e 51 4c 5a 54 74 37 53 77 6e 78 4a 36 48 5f 4f 70 78 5a 52 67 53 55 53 58 53 4d 53 51 5f 4e 67 4a 31 61 54 6f 7a 62 50 43 68 32 74 76 6a 76 65 43 39 57 47 51 44 Data Ascii: 20QpWlglE730aR1O2HScjT9oVO4b9tFZRgNr3jqNjZvWWNPo3x1RKF_5Ix_p96-FtPfLstESXR7jzmjH1Zj2IlqHb66-L9B82NRE3-BXH4jRg-rt9X-ZfEtbf1a1FoNzIgYjoKMEav2ZxStmh44t6tNs682XqRZd98o2Cwd3RHwCKsFwPmmDJgKrx7oD_uddRiSZGCGlVnQLZTt7SwnxJ6H_OpxZRgSUSXSMSQ_NgJ1aTozbPCh2tvjveC9WGQD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49758	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:08 UTC	1479	OUT	GET /recaptcha/api2/payload?p=06AFcWeA6DWEmokBLWnQOYm0IsLW2NCAFj1c2miGD5eH2hsSm1OHz49c2N1MxVhKxDDtEEL2zZk2NK1bsbR1AyeFT-vRiVoiZRg1e25gAiEal0mju1vKctIGQ_5UdkqDGfcfqrme1y35dXtXt6qAOzD9phZba08Uo-Ffyw9mQ7k5rKJ135QuOWdPWi6ZyqtYbh6-oY7luoLg26&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:08 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 18 Apr 2024 14:43:08 GMT Date: Thu, 18 Apr 2024 14:43:08 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:43:08 UTC	6	IN	Data Raw: 39 44 38 32 0d 0a Data Ascii: 9D82
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 c2 01 c2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC!"$"$C"}!1AQa"q2
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 9c b7 5c 9f 5a 69 dc 1f 04 0c 9e f4 be 70 70 c0 a2 82 1b 8e db 7d e9 7c cb 72 32 01 2f d4 37 b7 a5 50 0b 82 14 b7 7a 45 da 5d b7 0c 9c 71 4d 92 50 48 03 8d c3 a0 ed 48 5b 23 23 1f 2f 5c d2 01 ec 14 8c 63 91 4c 11 af 24 0a 57 2e 08 d8 b9 27 ae 69 5b 2b 81 91 cf a5 31 8d 45 e0 e7 d6 82 80 91 81 d2 9c bd b8 ef 48 49 12 10 0e 33 c0 a0 96 24 c0 60 11 51 bc 5f 2f c8 d8 26 a5 72 31 82 3a 54 6c ca 18 60 37 3d 4f 6a 56 18 d5 b5 ca a8 56 39 39 cf 35 12 db 4a 99 29 29 db dc 93 cd 5d 59 11 50 a8 03 77 62 2a 37 26 43 9f ba c3 a6 3a 1a 12 15 c4 db 2a c6 36 bf 3f 4e b4 b1 bb 01 b5 81 3e b4 ed cb 90 00 19 f4 f4 a7 34 85 97 0c a8 a1 7b 81 cd 01 71 04 83 cc 23 6f 18 a4 12 9f 33 04 6d c7 23 14 c1 2e 24 1d c7 ad 31 e4 00 63 d4 d3 b8 ee 59 f3 32 db b3 96 3e a6 9e b2 32 10 cc Data Ascii: \Zipp}\|r2/7PzE]qMPHH[##/\cL$W.'i[+1EHI3$`Q_/&r1:Tl`7=OjVV995J))]YPwb7&C:6?N>4{q#o3m#.$1cY2>2
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 8a a0 47 2e c9 2b 15 09 03 e7 be 7b d4 a2 d6 fc a9 22 dc a8 5f 5a e8 b6 f7 f2 c3 7f 4a 77 f0 f1 40 3b 1c cc 76 77 f2 48 0f 94 98 14 f3 a4 5f c9 f3 81 c1 e4 0d dd eb a5 89 39 62 7d 29 db be ed 21 1c b4 ba 36 a7 b4 6d 55 52 4f de cd 42 9a 4e a8 5c 90 c0 76 39 39 15 d7 97 cc 5b 3d 0d 26 fc a2 8e b8 34 01 cb 8d 16 fc c8 40 95 48 ee 31 4e 3a 1d c4 b8 32 c8 54 8e 9b 6b a7 92 4d a5 88 52 38 ea 3a e2 9a 0e f5 ce 06 3b 1e ff 00 8d 30 b9 ce be 84 27 45 02 59 14 29 f9 8e 69 c9 a0 40 06 c3 b9 95 b8 e4 f3 5d 0a 08 3b ae 4d 3e 31 0e fe 17 6d 36 17 30 60 f0 e4 1f 32 95 1b 47 42 5a 9e 34 2b 76 64 0d 6e a6 31 c6 43 56 f3 a4 0c 4a 9e ff 00 ca 92 38 e3 60 7c bf bb 9a 5c a2 31 46 85 61 1c ac 45 b0 6c f4 e7 20 55 88 74 e4 89 49 0b 10 cf 76 5c e2 b4 cc 23 fe 7a 01 4d 78 c0 18 Data Ascii: G.+{"_ZJw@;vwH_9b})!6mUROBN\v99[=&4@H1N:2TkMR8:;0'EY)i@];M>1m60`2GBZ4+vdn1CVJ8`\|\1FaEl UtIv\#zMx
2024-04-18 14:43:08 UTC	333	IN	Data Raw: 83 72 82 09 3c e6 84 6d ff 00 33 28 0c 7d 29 8a 08 ce 78 a6 87 60 20 03 9a 01 04 10 08 26 94 01 9e 7b d0 ca 88 01 42 09 3c 1a 00 61 c1 6d dd bd 73 4f dd b0 67 34 8e bb 57 e4 1b 87 a0 a4 6c 15 19 3c fa 50 4b 1e 0f 15 24 6d 91 cf 6a 6f 92 c4 64 71 c5 35 38 6d 99 a0 09 4b 06 6d a5 8a 67 ae 69 a1 95 0f ee d8 0f c2 91 f0 38 6f bc 47 e4 28 da 31 4c 07 6e 9c f3 e7 3f e9 45 3b 63 7a 1a 29 14 64 93 b0 10 00 cf 42 7d 69 53 1b 83 32 2e 07 4c 8e 94 81 09 4e a1 b9 ef 52 63 e5 ee 6a 07 62 26 55 90 9f 35 57 d8 8e 2a 23 6d 09 00 86 c6 1b 81 93 56 a3 28 cf e5 ba 8a 6e 33 37 cb 80 83 b1 15 40 8a ef 00 51 95 66 fc ea bc b1 cd 18 05 58 38 cf 75 ad 47 71 b3 19 5c fd 29 80 e3 05 80 00 f4 c5 4d c2 e5 58 bc e3 1e e4 40 4a 73 ce 45 3e 2f 30 82 59 07 23 9f 9a af 00 19 00 dc 06 ee Data Ascii: r<m3(})x` &{B<amsOg4Wl<PK$mjodq58mKmgi8oG(1Ln?E;cz)dB}iS2.LNRcjb&U5W*#mV(n37@QfX8uGq\)MX@JsE>/0Y#
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 04 71 8b 87 88 79 9b 15 b3 c8 f6 a7 34 77 18 1b 65 08 a7 ae 05 4a 01 23 2b f9 13 4d 6d cc 98 04 64 1a 00 63 21 da 55 80 61 9f 4e d4 1b 71 20 c0 5e 3b 55 84 03 cb cb 64 11 d7 de 9f 10 19 38 18 03 b5 21 95 96 d0 15 f2 d8 73 db 9a 6c ed 61 a7 a8 37 12 41 10 fe eb b7 26 b3 7e 20 78 9a 0f 0b e8 46 f6 e4 07 9a 46 db 6f 18 1c 9f 53 5e 37 a9 eb fa ad fb 0b fb 98 e4 bb b6 9d 81 86 55 1c a9 ec 2b 6a 54 b9 d7 33 d8 ca 73 b6 c7 bf 5b 1b 49 d3 ed 09 24 66 3e bb 80 ab 3b ad 23 db 23 c9 12 e4 70 4b 01 9a f1 fd 7b c4 73 c5 a7 41 6f 6e 3e cc cc a1 9d 41 c6 5b b9 23 d6 b9 7f 12 6a 9a 8e a9 0c 57 96 77 52 99 a0 52 a6 02 c7 1f 51 8a d1 61 d3 7a b2 1d 57 6d 0f 5e f8 91 e3 0d 33 49 f0 9d f8 d3 ef 60 9a fa 44 31 45 1a 9c 9e 7a fd 2b e5 4b 99 e2 ba 3f bd 8d d2 4f e2 6c e7 9c d3 Data Ascii: qy4weJ#+Mmdc!UaNq ^;Ud8!sla7A&~ xFFoS^7U+jT3s[I$f>;##pK{sAon>A[#jWwRRQazWm^3I`D1Ez+K?Ol
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: c4 80 31 93 8a e1 be 38 6b 57 3e 0f f0 ff 00 f6 79 26 2d 42 f0 6d 55 07 95 4e e6 9c 23 cf 25 14 37 b1 e4 9f 19 35 a4 f1 17 8e 05 9c 13 b3 5a 59 8f 2d 76 b7 19 fe 23 56 bc 0f 7d 9b 2b c8 84 62 4b 46 c2 c3 bc 7d d6 1e 95 c7 78 63 4c d4 f5 2d 41 cc 11 1f 25 f3 e6 ce c3 8f 7c 1a f4 28 74 c9 2d ac e3 b4 d3 d5 62 44 18 c9 ea 7d eb d0 9a 51 5c a8 e6 72 bf 52 96 a1 0b 5c 4a 65 95 87 3d cf 6a e5 75 7b a8 6c df fe 3e c4 47 38 c8 3c 8a d6 f1 5d 96 a5 63 09 96 d9 84 a0 f0 46 4d 79 fc fa 35 db dc ac f7 ee d2 19 1b 80 bf 37 d2 b1 72 69 1b 53 a2 a4 ee d9 a7 74 fa 7a cc 63 d4 25 c4 92 0c e5 93 e6 39 ef 9a a0 da 62 4b 31 fe cc b9 f3 07 75 35 b3 a9 e9 ad 7b 14 86 ef 26 f0 05 45 e3 1b 47 6a d7 d0 7c 39 6d 65 6f 17 9d 75 ca 8f 9b 27 14 e3 52 e8 ce ac 12 96 87 07 34 13 c6 db Data Ascii: 18kW>y&-BmUN#%75ZY-v#V}+bKF}xcL-A%\|(t-bD}Q\rR\Je=ju{l>G8<]cFMy57riStzc%9bK1u5{&EGj\|9meou'R4
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 38 68 8a 96 07 92 7d 29 73 ba 56 c0 5c 30 eb dc 53 01 17 76 f7 56 c6 17 18 cf ad 38 2b 00 e4 a9 c8 e7 f0 a5 8d c3 64 15 07 69 eb eb 53 a4 a4 26 0f de c6 3f 0a 01 9a ba 5e b4 6d a3 57 1a 74 3f 77 ef 0e f5 a1 1f 88 21 79 a1 92 48 9a 01 19 dc 44 63 ef 57 34 70 ee 1b 70 e9 8d b5 31 8e 33 13 79 72 a8 90 2f 4c f0 29 08 ec ad fc 45 67 7b e6 79 f7 52 da 2a 9d c8 ca bd 87 ad 7c cf f1 20 ea 5e 37 f1 ed de af 72 1a 7b 38 58 45 06 ff 00 94 3a 2d 76 3a cf 8b ad 0c f2 d8 47 73 e4 c7 17 ca e5 39 69 3d 71 5c 0d c6 a9 79 24 ed 1c 88 ff 00 63 56 c8 75 39 38 f7 15 d7 4a 0e 1e f1 2a 69 a6 8a d2 df 5f 5b 83 67 6e b0 43 00 3f 2c 69 d0 50 b3 ea 53 37 17 b2 01 ed 8a b0 35 3f 0e f9 6b 12 a1 fb 50 93 23 cd 70 01 5f a5 6b da be 8b a9 27 95 18 5b 79 bf d9 3c 0a de fc a8 e5 71 57 dc Data Ascii: 8h})sV\0SvV8+diS&?^mWt?w!yHDcW4pp13yr/L)Eg{yR\| ^7r{8XE:-v:Gs9i=q\y$cVu98Ji_[gnC?,iPS75?kP#p_k'[y<qW
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 18 ae a4 89 7f ba 07 5a ca e5 1c 16 48 60 43 9e bf 30 3c e2 ac 48 e0 91 e5 9c 81 c6 de 9f 8d 75 32 78 2a 70 31 04 d1 b1 1d 77 1c 55 79 bc 1d aa e4 34 5e 41 7f f7 b8 a7 70 39 b6 13 02 ec 8a 1d b1 c2 ff 00 5a 54 c9 da 65 0c bc 75 50 71 9a e9 87 83 75 85 80 48 25 89 6e 03 f0 a0 f0 45 2b f8 3f 5b f2 ca 96 87 66 73 8d d4 ee 16 39 b9 17 2d b8 0c e3 b6 69 aa cb 94 dc a7 04 10 07 a5 74 2d e1 6d 52 38 c6 df 29 98 f2 41 6e d5 52 6d 13 54 b7 56 77 b7 45 3d 3e f7 03 da 84 c2 c6 6a 4a a2 65 57 05 54 70 71 dc 54 c4 a3 28 70 59 40 6c 75 ed 51 34 37 0a a0 cb 0a a6 0f 39 34 42 0a 39 32 40 c1 87 0a 47 7a 2e 24 5c 2c 04 a5 4e 04 6a 78 38 eb 4e fb cf b9 58 7e 54 c5 52 ec 1d 57 18 eb 91 52 80 65 bc 03 cb 01 59 72 49 38 c1 f4 a4 04 b0 28 57 67 63 92 46 3e 95 ce 78 bf c4 36 3a Data Ascii: ZH`C0<Hu2x*p1wUy4^Ap9ZTeuPquH%nE+?[fs9-it-mR8)AnRmTVwE=>jJeWTpqT(pY@luQ4794B92@Gz.$\,Njx8NX~TRWReYrI8(WgcF>x6:
2024-04-18 14:43:08 UTC	1255	IN	Data Raw: 51 58 af 6b 01 51 e5 2c 61 40 1c 36 69 d7 16 cc 72 37 65 57 04 9c d5 79 4d ec 45 9e 7b 59 50 29 c2 8c 11 55 93 50 82 10 7e d5 2e d5 3c 9c f5 fa 53 51 02 f8 b5 59 10 b7 9a 43 67 a7 b5 27 d9 64 79 36 82 08 1d 08 e3 26 b3 a6 f1 15 91 55 8e d8 3b 15 ee 17 24 d4 82 e7 52 96 03 2d bd b0 4d e7 39 63 8c 55 f2 b2 79 8b 22 32 66 68 a4 e0 2f 24 9e d4 b2 b4 71 47 bf 03 0a 79 e7 b5 41 2d b6 aa aa af 3d da 82 c3 3b 54 67 02 9c 9a 6d bc b8 fb 45 c4 b2 33 72 41 e0 52 5b 8d b2 29 75 a1 18 64 82 26 97 3e a3 1c d4 0c 35 7b 9c 38 3e 42 11 d2 b6 a2 b2 81 20 29 14 3f 32 e3 24 d4 e4 28 18 91 bb 63 14 ee c5 63 9a fe c8 bc 6f 98 dd bf 3c f5 a2 ba 6f f4 71 c6 ef d6 8a 39 a5 d8 7a 1d 35 8f 8c 35 64 b6 45 99 a1 60 3a 17 5e 0f e3 56 13 c6 7a a2 0d d2 5b db b2 71 81 b4 e4 d7 2e 93 e9 Data Ascii: QXkQ,a@6ir7eWyME{YP)UP~.<SQYCg'dy6&U;$R-M9cUy"2fh/$qGyA-=;TgmE3rAR[)ud&>5{8>B )?2$(cco<oq9z55dE`:^Vz[q.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49759	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:14 UTC	1329	OUT	POST /recaptcha/api2/replaceimage?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 5282 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://www.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:14 UTC	5282	OUT	Data Raw: 76 3d 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 26 63 3d 30 33 41 46 63 57 65 41 36 4a 4c 42 7a 47 62 4c 47 43 6e 33 59 67 47 5a 73 76 49 34 6b 74 78 47 4d 61 5a 32 53 49 64 32 34 35 4c 79 65 47 63 7a 76 31 2d 61 49 6b 34 68 46 38 43 41 68 61 74 6f 6d 68 6c 37 71 72 31 64 6a 6f 56 4b 4f 68 5f 61 43 56 6e 6f 59 41 46 42 4a 6f 4e 2d 41 59 62 70 39 50 2d 78 39 39 7a 58 6a 52 37 35 6a 58 35 66 37 30 76 32 30 47 6d 7a 76 65 37 30 6b 75 7a 4c 42 4e 32 77 6a 75 53 64 4f 47 36 38 6c 47 73 5a 5a 64 44 53 37 77 35 35 70 31 31 67 2d 45 43 5f 6f 68 66 61 52 51 32 58 5f 69 53 4e 4b 6c 44 4d 71 78 48 6c 55 66 4d 2d 7a 72 50 6c 74 42 30 78 4d 78 57 50 30 59 6e 42 48 44 55 61 2d 38 35 74 66 49 47 4d 6e 65 32 52 76 79 5f 4b 47 74 5f 42 76 68 Data Ascii: v=QoukH5jSO3sKFzVEA7Vc8VgC&c=03AFcWeA6JLBzGbLGCn3YgGZsvI4ktxGMaZ2SId245LyeGczv1-aIk4hF8CAhatomhl7qr1djoVKOh_aCVnoYAFBJoN-AYbp9P-x99zXjR75jX5f70v20Gmzve70kuzLBN2wjuSdOG68lGsZZdDS7w55p11g-EC_ohfaRQ2X_iSNKlDMqxHlUfM-zrPltB0xMxWP0YnBHDUa-85tfIGMne2Rvy_KGt_Bvh
2024-04-18 14:43:15 UTC	483	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 14:43:14 GMT Expires: Thu, 18 Apr 2024 14:43:14 GMT Cache-Control: private, max-age=0 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 14:43:15 UTC	772	IN	Data Raw: 61 36 35 0d 0a 29 5d 7d 27 0a 5b 22 64 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 34 58 46 4a 63 42 42 50 4e 4d 4e 47 4d 58 72 30 54 72 77 68 52 55 6a 49 46 2d 6e 43 4a 4b 43 4f 6a 36 74 47 44 36 5a 65 4c 70 33 64 75 69 7a 72 7a 34 30 65 63 78 77 78 4b 76 72 38 36 58 76 6d 65 72 4e 55 6f 65 52 47 69 49 64 46 6a 5a 6f 5f 73 58 58 70 37 6d 44 73 78 43 4a 6e 59 6f 41 36 6e 49 76 39 7a 7a 79 67 5f 4a 71 67 55 45 57 31 46 72 63 42 4b 6c 75 6b 6b 5a 75 47 4d 5a 4d 6e 7a 62 67 38 59 4a 6c 73 54 72 71 73 55 57 59 42 58 67 51 58 6c 30 51 59 68 41 78 51 75 41 72 35 7a 73 4d 75 31 5f 4a 73 5f 69 70 57 5f 54 47 61 31 38 5a 77 6c 4a 4b 6f 66 71 67 46 53 70 57 58 59 33 58 50 72 44 57 58 59 7a 56 38 6a 76 6a 39 48 34 4e 36 31 63 69 69 6d 63 56 2d 35 4a 62 68 2d 67 41 Data Ascii: a65)]}'["dresp","03AFcWeA4XFJcBBPNMNGMXr0TrwhRUjIF-nCJKCOj6tGD6ZeLp3duizrz40ecxwxKvr86XvmerNUoeRGiIdFjZo_sXXp7mDsxCJnYoA6nIv9zzyg_JqgUEW1FrcBKlukkZuGMZMnzbg8YJlsTrqsUWYBXgQXl0QYhAxQuAr5zsMu1_Js_ipW_TGa18ZwlJKofqgFSpWXY3XPrDWXYzV8jvj9H4N61ciimcV-5Jbh-gA
2024-04-18 14:43:15 UTC	1255	IN	Data Raw: 52 57 68 4c 71 41 75 61 54 70 74 6e 73 46 75 4f 41 5f 43 58 44 49 36 36 41 77 67 50 65 2d 57 54 6e 67 6b 49 76 47 79 6d 36 4c 6d 79 79 43 48 48 4e 5a 4c 74 54 44 55 6d 76 35 73 65 45 57 70 48 30 6a 6f 45 6a 73 49 4a 31 4b 55 6f 44 44 43 56 54 46 6d 70 41 4d 49 4f 30 39 4f 58 6d 71 56 54 68 52 50 77 75 78 55 41 64 67 79 66 4b 7a 6c 61 63 58 4d 43 69 32 43 6b 55 64 44 2d 79 57 63 72 37 75 52 33 6d 73 62 61 54 5f 52 67 45 33 66 68 43 69 5a 6d 53 52 64 43 54 5f 6b 61 67 5a 44 4b 79 46 37 41 4a 79 5f 4f 68 69 49 57 42 74 50 46 35 57 32 6a 59 64 79 39 4e 79 49 6f 43 5a 77 62 43 5a 56 6b 4c 6a 77 31 62 43 72 4d 4d 4a 4e 6d 38 54 36 7a 41 47 6e 4a 48 77 55 5a 57 50 4d 39 4b 6d 72 7a 4e 66 6c 4f 5a 4f 37 69 67 32 79 33 6a 4b 71 42 62 66 41 67 46 71 76 62 46 47 4d Data Ascii: RWhLqAuaTptnsFuOA_CXDI66AwgPe-WTngkIvGym6LmyyCHHNZLtTDUmv5seEWpH0joEjsIJ1KUoDDCVTFmpAMIO09OXmqVThRPwuxUAdgyfKzlacXMCi2CkUdD-yWcr7uR3msbaT_RgE3fhCiZmSRdCT_kagZDKyF7AJy_OhiIWBtPF5W2jYdy9NyIoCZwbCZVkLjw1bCrMMJNm8T6zAGnJHwUZWPM9KmrzNflOZO7ig2y3jKqBbfAgFqvbFGM
2024-04-18 14:43:15 UTC	641	IN	Data Raw: 4e 70 52 43 49 37 48 6d 37 47 47 48 4f 4a 58 5a 43 30 73 44 49 51 73 7a 49 6b 35 47 75 31 57 7a 35 47 62 70 47 7a 7a 43 49 49 6f 6e 79 44 69 55 46 76 57 48 73 4f 4a 64 30 62 65 54 4c 7a 53 5a 47 4c 67 67 61 78 31 31 79 4e 4b 67 5f 65 6a 49 58 4f 30 2d 57 4b 41 4e 6c 66 41 71 62 56 46 74 4b 45 62 67 68 4c 68 36 72 55 37 45 59 57 2d 6b 73 54 4e 50 52 68 74 45 6f 6b 61 58 36 6e 71 46 37 49 56 30 56 6b 76 57 76 71 79 77 66 78 67 4c 50 41 65 74 74 53 51 43 4f 33 75 47 58 55 6b 41 41 72 64 6a 76 4a 46 72 41 45 52 6e 33 4c 6e 5f 53 56 68 44 6f 38 2d 4d 47 30 39 6e 79 75 35 66 58 49 5f 48 64 46 6d 32 64 78 51 50 4f 5f 31 6e 53 39 4c 42 32 4f 73 79 34 37 4f 79 43 34 7a 5f 59 4c 62 66 53 5f 66 50 75 42 44 68 68 71 34 72 35 70 65 57 59 56 68 62 30 71 73 35 35 6d 4b Data Ascii: NpRCI7Hm7GGHOJXZC0sDIQszIk5Gu1Wz5GbpGzzCIIonyDiUFvWHsOJd0beTLzSZGLggax11yNKg_ejIXO0-WKANlfAqbVFtKEbghLh6rU7EYW-ksTNPRhtEokaX6nqF7IV0VkvWvqywfxgLPAettSQCO3uGXUkAArdjvJFrAERn3Ln_SVhDo8-MG09nyu5fXI_HdFm2dxQPO_1nS9LB2Osy47OyC4z_YLbfS_fPuBDhhq4r5peWYVhb0qs55mK
2024-04-18 14:43:15 UTC	1255	IN	Data Raw: 61 64 61 0d 0a 5f 49 44 41 67 4d 52 34 78 6a 65 65 6c 4e 6d 34 6e 5f 57 39 66 38 52 52 79 68 43 6e 53 55 4f 68 31 66 6a 6e 35 47 6e 35 36 6d 71 57 52 5a 6f 32 39 53 66 77 52 56 51 45 35 33 49 53 6c 65 42 68 79 77 66 6e 6a 77 63 30 6a 43 65 4d 30 4a 59 30 31 50 77 38 74 35 59 31 37 52 4d 6b 30 72 38 76 69 34 77 59 73 4f 33 45 7a 6e 50 75 49 5f 6a 34 49 53 48 62 37 62 75 43 41 46 50 78 74 79 66 57 32 59 63 70 6c 5a 66 62 7a 41 43 45 64 61 41 4d 63 64 30 35 48 74 55 55 77 33 6b 63 4a 4c 2d 31 77 74 6b 76 45 50 35 6c 62 72 68 6c 4f 6f 5f 69 65 6e 64 4b 53 66 50 4a 58 46 73 68 4e 35 53 45 50 5f 77 67 55 6d 5a 46 41 67 57 30 61 53 76 54 51 4e 7a 72 4c 4d 30 4b 59 4a 38 47 78 38 38 72 61 4c 69 66 61 45 4e 61 62 45 6e 53 4a 4d 46 6f 32 2d 4a 31 47 4e 6f 30 36 5a Data Ascii: ada_IDAgMR4xjeelNm4n_W9f8RRyhCnSUOh1fjn5Gn56mqWRZo29SfwRVQE53ISleBhywfnjwc0jCeM0JY01Pw8t5Y17RMk0r8vi4wYsO3EznPuI_j4ISHb7buCAFPxtyfW2YcplZfbzACEdaAMcd05HtUUw3kcJL-1wtkvEP5lbrhlOo_iendKSfPJXFshN5SEP_wgUmZFAgW0aSvTQNzrLM0KYJ8Gx88raLifaENabEnSJMFo2-J1GNo06Z
2024-04-18 14:43:15 UTC	1255	IN	Data Raw: 53 42 30 2d 4a 4c 44 36 63 74 48 41 32 37 67 48 6c 47 42 30 74 59 57 4b 74 46 47 64 76 48 55 51 69 46 51 31 75 4f 79 6d 63 6f 68 7a 34 44 6c 38 59 71 78 4c 71 74 4c 62 39 2d 58 53 50 4d 75 6b 52 49 34 57 68 31 43 4d 34 76 48 50 46 67 5a 5f 67 37 4b 4d 6e 4b 70 77 71 61 70 5f 76 69 4f 6e 58 76 53 53 6b 5a 37 46 6f 4d 48 5a 39 4f 55 77 30 41 75 79 7a 38 7a 4a 35 4c 53 45 4f 4d 49 6d 44 34 78 77 4e 46 4e 45 54 74 43 6d 36 76 4a 6e 61 33 42 52 39 62 53 6f 61 7a 4d 50 59 6e 7a 55 58 61 69 75 6d 49 2d 57 31 4a 6f 59 73 36 53 68 63 33 48 58 37 66 6c 6c 52 6f 4d 53 31 48 70 7a 36 59 55 77 50 34 78 33 69 43 61 6f 30 63 75 45 75 4f 70 75 42 34 47 45 39 36 50 65 4f 34 71 63 4b 4d 6e 65 72 64 41 78 72 70 62 54 5a 49 42 36 55 63 30 46 6f 2d 62 58 35 76 4c 34 4a 72 47 Data Ascii: SB0-JLD6ctHA27gHlGB0tYWKtFGdvHUQiFQ1uOymcohz4Dl8YqxLqtLb9-XSPMukRI4Wh1CM4vHPFgZ_g7KMnKpwqap_viOnXvSSkZ7FoMHZ9OUw0Auyz8zJ5LSEOMImD4xwNFNETtCm6vJna3BR9bSoazMPYnzUXaiumI-W1JoYs6Shc3HX7fllRoMS1Hpz6YUwP4x3iCao0cuEuOpuB4GE96PeO4qcKMnerdAxrpbTZIB6Uc0Fo-bX5vL4JrG
2024-04-18 14:43:15 UTC	275	IN	Data Raw: 30 6b 69 6f 59 44 5a 55 75 59 39 46 59 34 62 66 7a 62 72 5a 6b 47 35 36 55 70 71 30 59 6b 52 52 7a 43 34 5a 73 2d 6c 30 5a 71 54 6d 6e 32 43 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 30 36 41 46 63 57 65 41 36 4d 4a 74 39 6b 78 46 46 62 6b 42 35 45 4f 6e 62 49 6e 64 34 75 4c 33 4e 74 4e 32 39 4e 64 66 66 36 62 6f 64 44 6e 42 63 7a 4c 69 74 78 39 50 46 72 35 2d 2d 44 4c 57 62 32 66 64 4a 59 6f 70 57 57 67 76 7a 39 77 46 68 63 5a 6c 56 75 46 34 66 69 74 4d 67 4f 71 34 50 53 45 35 6f 5a 4a 5a 62 31 44 55 30 48 62 41 34 52 70 61 48 57 49 63 6c 2d 35 52 79 6d 5f 52 65 63 5f 69 5a 33 55 46 4a 39 46 4a 59 74 58 50 77 51 4d 32 50 48 73 4a 36 43 61 75 57 72 53 7a 42 56 50 6e 75 49 55 44 6d 33 59 30 4e 36 64 59 78 54 56 66 56 4b 6c 51 32 4f 68 6e 50 55 Data Ascii: 0kioYDZUuY9FY4bfzbrZkG56Upq0YkRRzC4Zs-l0ZqTmn2C",null,null,null,"06AFcWeA6MJt9kxFFbkB5EOnbInd4uL3NtN29Ndff6bodDnBczLitx9PFr5--DLWb2fdJYopWWgvz9wFhcZlVuF4fitMgOq4PSE5oZJZb1DU0HbA4RpaHWIcl-5Rym_Rec_iZ3UFJ9FJYtXPwQM2PHsJ6CauWrSzBVPnuIUDm3Y0N6dYxTVfVKlQ2OhnPU
2024-04-18 14:43:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49760	64.233.176.106	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 14:43:15 UTC	1484	OUT	GET /recaptcha/api2/payload?p=06AFcWeA6DWEmokBLWnQOYm0IsLW2NCAFj1c2miGD5eH2hsSm1OHz49c2N1MxVhKxDDtEEL2zZk2NK1bsbR1AyeFT-vRiVoiZRg1e25gAiEal0mju1vKctIGQ_5UdkqDGfcfqrme1y35dXtXt6qAOzD9phZba08Uo-Ffyw9mQ7k5rKJ135QuOWdPWi6ZyqtYbh6-oY7luoLg26&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=2 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AH0dGfS5savvQWxF2H_J_7wu-mQ2Aer80ctqRY3EWgPWEpVqxCXhjETlZgek2QO5i9z2LEZhr3BPBSRPrOR6uts; 1P_JAR=2024-04-18-14; NID=513=FlgTKlLAgjexZ5iutrDJhSrThYL13__JvUEDPgOYsU1rTF-T-j_wcoI4J3sMORYyoM96sBWNGc0v-WzQ-F-Qs8reD_vuI1db3wb6mSjd9PcHzQ0vWDS5r9-rCaWLiGJwmGYbzY4tNoTaqcqvkChbiMi0EVMMBGeGtdOISr6IYbI; AEC=AQTF6HzcRlxYde5D_s6Sb8aEYtOOP99oVPwqraRAk0s88KhlNJsMGGKtGA
2024-04-18 14:43:15 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 18 Apr 2024 14:43:15 GMT Date: Thu, 18 Apr 2024 14:43:15 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 14:43:15 UTC	6	IN	Data Raw: 45 45 36 44 0d 0a Data Ascii: EE6D
2024-04-18 14:43:15 UTC	1255	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 c2 01 c2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC!"$"$C"}!1AQa"q2
2024-04-18 14:43:15 UTC	1255	IN	Data Raw: c2 d3 59 b9 f1 36 9f a7 69 b3 a2 a4 f0 e5 3c f7 0b 1a 36 48 66 3e 9f 2e 47 e3 53 4a 0a 52 4b 72 2a ce 51 8d d1 97 f1 bb 5f d5 6f 3c 32 2c 97 4a b8 0d 65 76 7e d2 19 7e 51 11 c8 47 07 d0 86 c6 7d ab ca 74 ed 56 48 2e ad ad ed b7 22 97 3b 90 38 50 b9 c6 01 e3 22 bd 83 e2 7e a3 3d c7 80 ec e5 86 de 4d ee 45 9d e4 db d7 72 91 90 c8 fd 70 0b 0e 9d b6 8c 1a f2 5d 1a da d6 d5 c4 0f 30 2f bf f7 31 b7 df 3e d9 ee 6b 87 32 9a a5 35 6d 34 fd 45 87 5c c9 dd 9b 50 5e 09 e6 94 ee 62 ea cc 9b 56 e6 e5 c1 fa 04 e3 93 4f 93 61 93 77 92 c2 46 5c 62 4b 79 e5 52 7d 3f 78 c0 51 05 95 b5 92 a8 02 75 79 a4 f3 18 2d c3 c7 9c 0f f6 48 aa ed 71 63 3d e4 76 b1 c3 1c a1 89 2e b2 cd 24 80 01 d4 1d c7 35 74 73 6a 12 8e e5 ca 16 2d 8b 7b ed e6 58 ec ed a2 c1 0c 1c 69 90 8e 7d 39 92 ac Data Ascii: Y6i<6Hf>.GSJRKr*Q_o<2,Jev~~QG}tVH.";8P"~=MErp]0/1>k25m4E\P^bVOawF\bKyR}?xQuy-Hqc=v.$5tsj-{Xi}9
2024-04-18 14:43:15 UTC	1255	IN	Data Raw: 00 55 6b 29 bc d0 72 51 ce e2 77 27 20 03 ca fe 84 55 9c f3 8a e9 01 69 a5 94 36 dc 8d d8 ce 29 d5 1c d9 c0 2a 39 1c 8a 00 92 99 33 15 89 98 06 24 0f e1 19 35 15 ad c0 94 77 07 dd 70 47 d6 b1 35 5d 4f 56 8e 4b b8 23 b5 96 2f 22 dc c8 26 48 f7 89 18 02 70 a3 b9 c0 ef dc f7 a6 95 c0 a7 71 e2 3b 7b 59 e3 8f 55 32 42 26 75 53 1d cc 4b b5 3e 72 07 3d f3 81 eb d4 57 9e 78 e7 58 d0 24 d3 6f 75 18 75 6d 26 ee 48 a4 d9 15 a9 50 0b b2 9c b7 cf 82 71 c2 f2 0f 6e a0 62 ae 4d 73 ff 00 09 c6 9c 12 ff 00 4c 16 97 f1 c7 b1 e7 bb e1 22 98 29 c6 76 e1 b6 96 c1 04 63 19 e3 d2 b8 3d 7f 45 bf 9b 59 8e 1d 0a d0 4c 22 86 3f 3a 69 01 7b 61 13 2e 7c b6 43 8d ea 32 5b 18 fe 20 71 5d 30 f7 35 5b 93 2b d8 c8 d1 f5 4d 0b 48 f0 ee a3 77 7b 65 2d 9e ab 70 ac d6 11 c4 04 28 e1 c6 49 90 Data Ascii: Uk)rQw' Ui6)*93$5wpG5]OVK#/"&Hpq;{YU2B&uSK>r=WxX$ouum&HPqnbMsL")vc=EYL"?:i{a.\|C2[ q]05[+MHw{e-p(I
2024-04-18 14:43:15 UTC	333	IN	Data Raw: fb c5 ec 71 d9 ab 96 bd 6f 61 4f 99 3d 7a 1c 73 d5 d9 9c ff 00 89 fc 37 77 6b f6 bb 3d 3a ea e6 e2 21 22 48 ca f3 1c 48 c8 3f e5 a2 f3 b8 f3 d4 9e df 95 1b 5d 2c cf a0 a3 6a 2d 21 99 72 ec cc a1 1d 58 73 91 8e a3 eb 9a ab ac 78 f2 d9 a1 53 65 70 d3 75 00 c9 c3 8f 63 58 3a af 8e 10 ac 7b 63 48 df 25 a4 23 b8 c5 7c e5 5a b5 eb ca f6 2e 3c b0 5a 12 f8 b3 5e b8 b5 9a 26 17 0f 24 8a 3e 66 07 01 bd 0f 15 87 a6 f8 a6 cb cf 7b ab a9 a4 13 91 c0 5c fd e0 7a 7d 0f 5a c0 d7 6f 8d e1 59 4b af cf 80 a0 74 42 7d 6b 9e ba 8a 3f b6 05 59 d0 90 dd 10 67 26 ba 68 61 a3 25 ef 2d 49 e6 b9 e9 7a 16 ab 79 a9 ea 91 f9 45 65 32 12 5c 11 ca 0f 5f ad 77 f7 57 56 5a 5d 8c 0f 73 6d 60 c7 67 c9 23 5b 7e f0 e4 73 96 24 e7 07 d3 15 e5 fe 10 b8 b6 b5 e0 29 45 3f 23 3e 48 38 f5 35 bf a7 Data Ascii: qoaO=zs7wk=:!"HH?],j-!rXsxSepucX:{cH%#\|Z.<Z^&$>f{\z}ZoYKtB}k?Yg&ha%-IzyEe2\_wWVZ]sm`g#[~s$)E?#>H85
2024-04-18 14:43:15 UTC	1255	IN	Data Raw: 8f 1c f5 0a ab 51 09 2c ac f4 c8 20 f0 f5 a4 36 d0 b1 12 20 5b 66 b8 f9 95 7a ef 18 c1 eb f9 f6 a9 23 9e e2 48 3c fb 96 bf 46 e0 02 96 c8 80 ae 7a 10 ff 00 e3 de bd 6c 1d 79 aa 4b cf b9 a4 63 a6 a2 46 d7 6b 32 db 41 70 97 6e c3 6f ef 75 59 33 9f a2 83 51 3c 91 33 a9 9b 4e 82 e5 97 2a c2 29 a7 90 a9 e8 09 2c a2 ad c0 c5 a5 78 e3 ba d4 e2 f3 14 e1 83 5b a0 6c 76 e9 9c f3 54 a2 bd d5 2c f5 79 52 0b 88 e6 90 91 1a 89 f5 24 40 c0 0e bc 0e b5 d4 aa b9 5d 26 be f1 d8 b4 b6 56 97 36 9b a5 d3 b4 f2 ea 99 f3 17 4f 7e 08 1c 92 4f 5f d2 a3 d2 7c 39 00 3f 69 9d 1a 7b a9 55 59 71 a6 66 28 41 1c 05 52 e1 46 07 7c 66 ac 5c ea d7 02 16 69 a4 d3 52 46 f9 25 43 aa c8 e0 8c ff 00 b3 1e 33 58 93 6b d2 dd dd 8b 6b 5b 0d 23 54 20 6e 62 b2 4a d1 83 ce 15 9c a8 f9 b3 d8 0f c4 50 Data Ascii: Q, 6 [fz#H<FzlyKcFk2ApnouY3Q<3N*),x[lvT,yR$@]&V6O~O_\|9?i{UYqf(ARF\|f\iRF%C3Xkk[#T nbJP
2024-04-18 14:43:15 UTC	1255	IN	Data Raw: 28 89 e7 8a 38 09 06 58 4e 03 ab 4a 00 dc 0e de 9c 9c 77 35 85 1f 8d f5 eb cf 0c cf 6d a7 db d9 5a c2 cc d0 33 43 0f 95 74 54 7c a5 4f 3b 43 00 7a fe b5 c2 d9 5a 34 d7 12 35 d5 c0 f2 bc ff 00 26 25 9c f9 8f 08 eb db 03 d3 a0 ae be 49 45 2b 19 ca 7d 4e a3 c7 52 f8 75 48 bb f0 ce 96 b7 0d 16 d1 6d 7d 73 0a a1 89 cb 67 70 fe 29 14 fd dc 3f e7 5c 7f 8a fc 43 e2 3b f9 86 93 a9 6a 46 29 e6 0a 23 0e c1 60 68 86 4a 28 4e 00 03 24 73 9f eb 53 78 92 ea 0b 68 0d 9e 9f 77 e6 79 3b a4 f2 ce 15 4b 30 19 c6 72 78 3c 63 a0 39 af 3d f1 19 9f 50 b7 82 e6 ea 6b 61 3e e2 c5 b7 04 7f ba 00 ca 8e 33 ef 8c f4 ce 73 57 7b 3b 48 c9 4e 4c bc 9a 96 b5 a4 68 23 4b d4 3c d4 b5 b9 dc b1 a3 90 15 81 e8 e7 1d 08 da 07 40 6b 8d 87 c9 44 bd 43 13 3b b0 02 07 2f 8d 9f 30 27 23 18 6c 8c 8e Data Ascii: (8XNJw5mZ3CtT\|O;CzZ45&%IE+}NRuHm}sgp)?\C;jF)#`hJ(N$sSxhwy;K0rx<c9=Pka>3sW{;HNLh#K<@kDC;/0'#l
2024-04-18 14:43:15 UTC	1255	IN	Data Raw: 1e 73 96 3d 46 31 cd 7a 2d 94 d6 90 5b 40 62 d4 24 b4 93 6b 17 2b 26 d0 73 8e 3d ce 3f 95 4e 1e 75 69 4d 7b 47 a1 69 8e 63 ab c9 73 0c 3f d9 81 ac 90 13 1c cb 66 d1 64 e4 8d a5 4e e2 a0 60 12 4f 51 d3 a5 43 79 1c 4b 13 cf 77 36 a5 80 8c ae 61 b4 89 22 05 78 cb 16 19 0b f5 38 aa 1a 87 8b c4 1a 74 d6 ec 12 ee 46 24 16 92 e8 a9 1f 36 49 e1 78 3e 95 cb eb 7a fd 9e a5 a4 35 94 96 16 b1 ab 3f cc 3c c9 1b 2b c1 c6 41 1d 71 83 ed 5f 45 86 a7 2a 9e f3 64 d4 a8 a2 b7 d4 e9 ec 2e 2c e7 d1 ee 22 d3 2f 75 98 fc e1 c2 24 91 79 6c 58 8c fc a9 f3 28 c7 71 d2 ad 78 6e f6 f1 6d 66 96 d2 dd e6 d2 a2 7f 2a d6 21 a8 ad bc 81 80 1b b7 10 46 79 cd 71 df f0 99 98 90 c7 0e 99 a4 44 a4 63 09 68 4e 07 e2 f5 57 45 d7 df 4e b7 7b 6b 74 86 de 20 c1 94 2e 9e 92 1c e3 a9 2d 92 3a 66 bb Data Ascii: s=F1z-[@b$k+&s=?NuiM{Gics?fdN`OQCyKw6a"x8tF$6Ix>z5?<+Aq_Ed.,"/u$ylX(qxnmf!FyqDchNWEN{kt .-:f
2024-04-18 14:43:15 UTC	1255	IN	Data Raw: 6e be 5c d7 0b f3 b2 a3 67 73 36 5b b8 18 f9 42 f0 73 eb de bd be f3 4d d1 66 44 72 b0 c9 14 4e 92 cc 64 90 38 90 01 95 38 ce 77 9e 2b 9a d4 97 c3 96 1a ac d7 37 9a 6a ba 2a b3 3c 91 2e e6 c9 f9 46 41 1d 72 49 cf 60 00 fa ed ca a4 b7 32 89 e1 37 36 77 ba 95 c2 98 92 36 23 04 ae 08 08 3a 0c f1 8f ff 00 5d 50 d4 20 ba bc ba e1 3c c6 23 24 47 1e 02 80 3f a5 7a 6d ce ab 05 d6 a4 2c f4 dd 16 f2 ea d0 04 0d 00 b7 da cf 8e 55 cb 29 e7 20 64 e4 60 f3 59 1e 27 bf 78 35 6b 8b 5b 3b 01 6a 93 1d f2 99 64 49 4a 38 ca ed 04 63 e5 e4 70 7d 33 52 e2 d1 5a 33 ce 2e 2d be c9 39 5d a3 71 1d 17 9c 8f 5a 7d c2 40 5e d9 65 dc 21 38 32 aa f5 f7 c1 f5 ad 56 d3 ee ed 6f 1e 49 23 59 26 8c 8d cd bf 21 81 e3 00 77 ce 7b 7b d6 75 f2 cc ea e2 28 82 10 49 03 1c 1c 63 38 ac aa 73 5d 34 Data Ascii: n\gs6[BsMfDrNd88w+7j*<.FArI`276w6#:]P <#$G?zm,U) d`Y'x5k[;jdIJ8cp}3RZ3.-9]qZ}@^e!82VoI#Y&!w{{u(Ic8s]4
2024-04-18 14:43:15 UTC	1255	IN	Data Raw: a4 89 2d 23 bc f2 d0 2b 02 22 4d eb c9 e8 33 9f ba 49 3c 67 eb 5e 29 a3 7c 45 d6 f4 f5 93 ce d3 8d cc ee 38 32 13 df b8 1d fa d7 a7 f8 5f 75 de 95 0d e6 ab aa a4 86 48 b3 24 2a c1 0d b1 cf 43 8c e7 83 9a f1 f1 11 ac b5 6b ad 8d 20 d0 cb bf 04 47 79 a9 dc 5a dc c5 70 da 80 62 f2 c6 b3 f9 a7 d7 aa 8c 74 f7 aa 89 e0 cd 21 1d 96 58 25 25 4e 08 69 0d 74 b6 7a 8e 93 74 1a e3 42 bc fb 52 42 f9 f3 d1 b9 56 00 75 73 c9 c7 af 15 71 f5 55 b8 9c c9 3f 91 76 64 5c b3 8c e5 0f d7 8c fe b5 d9 09 d4 49 58 ed a6 e2 d6 c7 31 6b e1 4d 20 48 02 59 ab 75 ea 4b 63 8a bb a6 78 46 ce 29 5a f5 92 da de 06 73 e5 33 0d cb 20 db 8e 3d b3 9a d6 6b a5 2d 32 15 f2 a2 60 42 88 7a b1 f7 cf 41 4d 9a 74 74 8a 18 50 ac 70 a0 55 04 93 c7 bd 6e e7 27 1d 37 37 6a 3b 58 cc 1a 45 84 12 63 ec 76 Data Ascii: -#+"M3I<g^)\|E82_uH$*Ck GyZpbt!X%%NitztBRBVusqU?vd\IX1kM HYuKcxF)Zs3 =k-2`BzAMttPpUn'77j;XEcv

Target ID:	0
Start time:	16:42:08
Start date:	18/04/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff73d4a0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:42:28
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff7faa40000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:42:31
Start date:	18/04/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff73d4a0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:42:43
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:42:44
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1896,i,2522147141678714913,16162524076685256105,262144 /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Documents.7z

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Windows Analysis Report
Documents.7z