Edit tour

Windows Analysis Report
https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884

Overview

General Information

Sample URL:	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884
Analysis ID:	1428674
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish9

Yara detected Phisher

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=2012,i,13379061869876988813,15450211964942131721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_55	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security
dropped/chromecache_55	JoeSecurity_HtmlPhish_9	Yara detected HtmlPhish_9	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish9

Source: Yara match

File source: dropped/chromecache_55, type: DROPPED

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_55, type: DROPPED

Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.18
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm- HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltduAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltduAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA407PX6KZPO_EZMp_NZbasNkhse1n9EzmIo2dBbRb4x9Gi9vRNiZyFRManWTdB3isufJ6LkOCy4Xga80NHHoKO85DUdTIlvj-_OeAbbdpD7MppuLHIJzJgBUQRn4GP9mi-KPxzCaEUkHF1v2lrTYZWJePF7qtkgN9glOLLs2BEZnXT9boVDHOf75I3XVsoLG0JYbXKc&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA407PX6KZPO_EZMp_NZbasNkhse1n9EzmIo2dBbRb4x9Gi9vRNiZyFRManWTdB3isufJ6LkOCy4Xga80NHHoKO85DUdTIlvj-_OeAbbdpD7MppuLHIJzJgBUQRn4GP9mi-KPxzCaEUkHF1v2lrTYZWJePF7qtkgN9glOLLs2BEZnXT9boVDHOf75I3XVsoLG0JYbXKc&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: unknown

HTTP traffic detected: POST /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 7719sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-protobufferAccept: */*Origin: https://www.google.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4

Source: chromecache_72.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_72.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_72.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_72.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_72.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_72.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_72.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_55.2.dr	String found in binary or memory: https://www.google.com/
Source: chromecache_59.2.dr, chromecache_72.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_72.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__.
Source: chromecache_59.2.dr, chromecache_64.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@17/39@4/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=2012,i,13379061869876988813,15450211964942131721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=2012,i,13379061869876988813,15450211964942131721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://recaptcha.net	0%	URL Reputation	safe
https://www.gstatic.c..?/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	74.125.136.105	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false		unknown

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js	false	high
https://www.google.com/recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA407PX6KZPO_EZMp_NZbasNkhse1n9EzmIo2dBbRb4x9Gi9vRNiZyFRManWTdB3isufJ6LkOCy4Xga80NHHoKO85DUdTIlvj-_OeAbbdpD7MppuLHIJzJgBUQRn4GP9mi-KPxzCaEUkHF1v2lrTYZWJePF7qtkgN9glOLLs2BEZnXT9boVDHOf75I3XVsoLG0JYbXKc&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/recaptcha/api.js	false	high
about:blank	false	low
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu	false	high
https://www.google.com/	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/favicon.ico	false	high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/log?format=json&hasfast=true	chromecache_72.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_72.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_72.2.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_72.2.dr	false		high
https://support.google.com/recaptcha#6262736	chromecache_72.2.dr	false		high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_72.2.dr	false		high
https://recaptcha.net	chromecache_72.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/api2/	chromecache_59.2.dr, chromecache_72.2.dr	false		high
https://www.gstatic.c..?/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__.	chromecache_72.2.dr	false	URL Reputation: safe	low
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_72.2.dr	false		high
https://cloud.google.com/contact	chromecache_72.2.dr	false		high
https://support.google.com/recaptcha	chromecache_72.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_72.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.136.105	www.google.com	United States	15169	GOOGLEUS	false
142.250.105.103	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
192.168.2.23

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428674
Start date and time:	2024-04-19 11:35:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@17/39@4/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.105.94, 74.125.138.84, 64.233.185.113, 64.233.185.101, 64.233.185.100, 64.233.185.138, 64.233.185.102, 64.233.185.139, 34.104.35.123, 20.251.162.34, 172.253.124.94, 64.233.185.95, 64.233.177.95, 142.251.15.95, 142.250.105.95, 142.250.9.95, 173.194.219.95, 172.217.215.95, 64.233.176.95, 108.177.122.95, 74.125.138.95, 74.125.136.95, 172.253.124.95, 20.114.59.183, 23.40.205.26, 23.40.205.81, 74.125.138.94, 20.242.39.171, 192.229.211.108, 13.85.23.206
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, cionfacttalleriproj.norwayeast.cloudapp.azure.com, clients.l.google.com, www.gstatic.com, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3
Category:	downloaded
Size (bytes):	46106
Entropy (8bit):	7.968519513488407
Encrypted:	false
SSDEEP:	768:eDLt49+JVhOwMmhJ2t9HR7Clneg6wdjy1x8MKBqt2akt8gJN0fbpA8dTHaLoBBHm:eDL6MJ+whhAlClnegtjy/8MYPigJOXd6
MD5:	CE2C4103FA40DBAAD991E067F76F515F
SHA1:	9EC78FC3C478D528A4FD5F7235753F5ACD54F56C
SHA-256:	29810E3B624889558A8811647A8E48B775BDE1CE06299AA60FA019B86B3ACDB4
SHA-512:	A9AD1ED3D173FC5D05FF7BD62EFDA18DDB0FFECBC2FF3BD8E7C575697C233F32A4B2105FB695F7A2962C9CF19255E46A14A7DAB4757E50841D6835C799C00197
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA407PX6KZPO_EZMp_NZbasNkhse1n9EzmIo2dBbRb4x9Gi9vRNiZyFRManWTdB3isufJ6LkOCy4Xga80NHHoKO85DUdTIlvj-_OeAbbdpD7MppuLHIJzJgBUQRn4GP9mi-KPxzCaEUkHF1v2lrTYZWJePF7qtkgN9glOLLs2BEZnXT9boVDHOf75I3XVsoLG0JYbXKc&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b
Preview:	......JFIF.............C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..=G[.D...1..9..x#]...O.7..]].i...u...Q.:g..].x2.U...k..Db....'_..:..i..Gk.\|..W....iE5d...}.>8./..?.O..B....3..[h.P.g /..'....:.".WR8e..?.1[J..FJ;...`jR..a.:.r..-..B.......j.Ix....(..j....Q....[FVV1j..&...n1.....U..D.........m..%.#A.......u.>...C49.)>.G..C.TS.fWd.>..C..E.6..m.........5.e...N.../\|.......`.a+.....{.9.qNg.e...G.X...cm.?...l--... ..V.....J?.5..=Dq3.

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	low
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17696)
Category:	downloaded
Size (bytes):	18291
Entropy (8bit):	5.675040290596522
Encrypted:	false
SSDEEP:	384:A10ZNodN7X9fo6Gfx+VfvBZbIPGIu/9xJMD5RjTORps0E30cIMW4XdiGZ0ZeaeoR:A10ZY7XNo6Gfx+dvBZkPGt/97K5lTORP
MD5:	8D120D4D5CB207E52720218A143FEF17
SHA1:	DAE68D4F786BDA08FE39D89AB6F3366B1199CB8B
SHA-256:	AC88D994CF1935F39E5504E88EDB7938FB98F589C4D02013F36B46D15F98517D
SHA-512:	4611F40996ABD45761C5D56FD3EE000A3733ED872C6CFA89E112E32104E328AF632B0330C20E125E248F6D5718116D848A1D0CA28F01626CEDE564610319D629
Malicious:	false
Reputation:	low
URL:	https://www.google.com/js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var a=this\|\|self,K=function(z,w){if(!(w=(z=null,a.trustedTypes),w)\|\|!w.createPolicy)return z;try{z=w.createPolicy("bg",{createHTML:m,createScript:m,createScriptURL:m})}catch(F){a.console&&a.console.error(F.message)}return z},m=function(z){return z};(0,eval)(function(z,w){return(w=K())&&1===z.eval(w.createScript("1"))?function(F){return w.createScript(F)}:function(F){return""+F}}(a)(Array(7824Math.random()\|0).join("\n")+['(function(){/',.'',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var is=function(z,w){((w.push(z[0]<<24\|z[1]<<16\|z[2]<<8\|z[3]),w).push(z[4]<<24\|z[5]<<16\|z[6]<<8\|z[7]),w).push(z[8]<<24\|z[9]<<16\|z[10]<<8\|z[11])},zc=function(z,w){return z[w]<<24\|z[(w\|0)+1]<<16\|z[(w\|0)+2]<<8\|z[(w\|0)+3]},Fk=function(z,w,a,m,q){(((m=(a=(m=B((w&=(q=w&4,3),z)),B(z)),G)(z,m),q)&&(m=wk(""+m)),w)&&e(a,U(m.length,2),z),e)(a,m,z)},Q=function(z,w,a,m,q,M){if(!w.SQ&&(q=void 0,a&&a[0]===H&&(q=a[2]

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	101
Entropy (8bit):	4.676576247103658
Encrypted:	false
SSDEEP:	3:gnkAqRAdu6/GY7ovoX1mOkADYncSLIVIAIMwa:7AqJmOoemYnjLI+Mwa
MD5:	2404AF761BF0E15075083A7ADD25B545
SHA1:	EE799763A2AC937D5DB8381FD8A3EB216DE2A30D
SHA-256:	479B3AEF58E8CD792B2DF47C8F2BF94B54DC77ADB973A5D7D5A05702EC2654C8
SHA-512:	49E3C79793BFD1C732E6181D4C8D867578DA3EDE521DDA1F53C74A80B8270FDD4188EC8773CE81332FC04E7F168DB3B483519773FEF9E80691B1C43B22D84BA2
Malicious:	false
Reputation:	low
URL:	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/close.html
Preview:	<script type="text/javascript">....window.location.href="https://www.google.com/";....</script>......

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:	12:6v/7OEUT9vceKKNtY3kM8O+mucROzZbJOAjPBE2Iq8AnxT9:bTdcVIM8tfHzzjy2IdKT9
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:	12:6v/7OEUelyuRs56fyKgIEInu5VLJBZInmJhd/3VqQXD8GBm1:belFRs56fuIEIu5VNBZInMTICfBO
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/info_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	low
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1222), with no line terminators
Category:	downloaded
Size (bytes):	1222
Entropy (8bit):	5.812687833352702
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCLTLv138EgFB5vtTGJTlWtB31ngirLOGsLqo40RWUnYN:VKEctKonR3evtTA8/1/OXLrwUnG
MD5:	3F1B1790C083261F6FD3CF02FB56F2F8
SHA1:	BF1B289456E260CF5C5F0AF7C1B0F4E9BA7EB97B
SHA-256:	A58FF2DE4D6A14E055A553E83A4E67AEA6AAF589A57364305EEC36105CCE9EF3
SHA-512:	99D52B4D79A3B36CDAF0640C37FA504518DAF3C23A2FEAAE6A4966633D5407F1941F726741BE59E25A6726698614D202033BC6BD3D34DD2A352789088C54F0DE
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-eZG8e4nRp0gEpRB75JBNzhS0vVseDRBVprGQYHJN

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:	12:6v/7OEUelyuRs56fyKgIEInu5VLJBZInmJhd/3VqQXD8GBm1:belFRs56fuIEIu5VNBZInMTICfBO
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:	12:6v/7OEUT9vceKKNtY3kM8O+mucROzZbJOAjPBE2Iq8AnxT9:bTdcVIM8tfHzzjy2IdKT9
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/refresh_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.87377555746297
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKeHZQx66FTEVgWaee:PLKdXNQKOyo6FIVgL
MD5:	701C50FE2F9D8CFCA61542DEE7684552
SHA1:	952A04F81A291E11F5D4ECD7364A3840412BA65E
SHA-256:	9FC5DFC54DE18E9C98733BBEA6EBDCBC1F01C0B23F985556F24684EE96DC0582
SHA-512:	5CA3C342F4BE563EE68235F32BCB8B25B62215A961B903B3568C496FCAD4508B9408FBDE00C6592085A819826630462863630F888FE73348F13FC037A9AB2C99
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js');

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3
Category:	dropped
Size (bytes):	46106
Entropy (8bit):	7.968519513488407
Encrypted:	false
SSDEEP:	768:eDLt49+JVhOwMmhJ2t9HR7Clneg6wdjy1x8MKBqt2akt8gJN0fbpA8dTHaLoBBHm:eDL6MJ+whhAlClnegtjy/8MYPigJOXd6
MD5:	CE2C4103FA40DBAAD991E067F76F515F
SHA1:	9EC78FC3C478D528A4FD5F7235753F5ACD54F56C
SHA-256:	29810E3B624889558A8811647A8E48B775BDE1CE06299AA60FA019B86B3ACDB4
SHA-512:	A9AD1ED3D173FC5D05FF7BD62EFDA18DDB0FFECBC2FF3BD8E7C575697C233F32A4B2105FB695F7A2962C9CF19255E46A14A7DAB4757E50841D6835C799C00197
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..=G[.D...1..9..x#]...O.7..]].i...u...Q.:g..].x2.U...k..Db....'_..:..i..Gk.\|..W....iE5d...}.>8./..?.O..B....3..[h.P.g /..'....:.".WR8e..?.1[J..FJ;...`jR..a.:.r..-..B.......j.Ix....(..j....Q....[FVV1j..&...n1.....U..D.........m..%.#A.......u.>...C49.)>.G..C.TS.fWd.>..C..E.6..m.........5.e...N.../\|.......`.a+.....{.9.qNg.e...G.X...cm.?...l--... ..V.....J?.5..=Dq3.

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0
Category:	downloaded
Size (bytes):	15340
Entropy (8bit):	7.983406336508752
Encrypted:	false
SSDEEP:	384:F2gPJde0V2iGrQyD8b3k/tigCdeNqOUd47SH0tsGm:4gPVV2NQE8b3ldeNWH0Wb
MD5:	19B7A0ADFDD4F808B53AF7E2CE2AD4E5
SHA1:	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA
SHA-256:	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
SHA-512:	49DA16000687AC81FC4CA9E9112BDCA850BB9F32E0AF2FE751ABC57A8E9C3382451B50998CEB9DE56FC4196F1DC7EF46BBA47933FC47EB4538124870B7630036
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Preview:	wOF2......;........d..;..........................d..z..J.`..L.Z..<.....\..`..^...x.6.$..6. ..\|. ..8..z%......Q.{..q...FF.kd .8.(..d..).!C...Y.JA...r. ..GH8F......nW...".2&....2<..+C...p...b..SC.......J......z.-..Q..#6&1zUe../\...l.....<.....9s...E~.]B-..B.wY..o......Q..A.F..1j.......-.`P% .. ,..@1.0..~.....WWW.d.u<c{..^.R.+..w....&.........A......+C....(.N.....0.~..0.J.;.Nu..7....]..m.H.....[h.GL3....?)....c.H...2.3.}y........SXI\|..iVN'%E.D.W....r..<`....i....6;E$.....U.$j.@...._.......R2....WS...k.vz.R.'a9!^...N....h.._.....c.%."..S.2.16B...o.2}.pmU[.\|.LI....2.....OWQLO1-....s..8.(...".\|6...6R.. ..M-.zO.}w)..v..mXxX...c..3#.+.v....F`.Z;.zQ.......r,....Yo.....g.h....+.....O.3Y..)Y.8.!....elX......._.3.}k~u.{ C..H.z..FP........@...d..)T.R...L.H.J.j.@..............$...E......y...3.b...I.h u.+%.HA.\..9..8..X.!....gx...].:..V..C...._..X..!....6..)...GM:E.....O.Z.}k.;.T.k..D.k.O..D5.r..."......?..T.Q.A...CF...3g.5.Dn<.QPy..G..1.9..Q..0..

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:	12:6v/7OEUhUxzPKmghSn8nazyk+k8/OzxQcxNMvVb:bhUxzlvWkT8FcxK1
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/audio_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.184482755717443
Encrypted:	false
SSDEEP:	6:otqWtxbQLZVVi7GeqlAGmwbQLZVZYZ7qT:o7xbK95eqKVaKiM
MD5:	B54D0452E2FDB8C0D91C455D1C5495F9
SHA1:	DDD85730B9CB4CB9905B1D7E7643F595D2F33CB8
SHA-256:	F4138D99EC6E17514BB87CEEAD1C1D2A204219C970864FC85BFF00949EE18082
SHA-512:	6883DE3ABB2A7B71CBDE6EDA0854D5B9EC696A0656735843BBB6329007D758B502D2557CB36D5A1CEFC7B4D0AB5DCBC227C88DE9163662741C60F9D561F5A367
Malicious:	false
Reputation:	low
Preview:	<HTML>.<HEAD>.<TITLE>HTTP method GET is not supported by this URL</TITLE>.</HEAD>.<BODY BGCOLOR="#FFFFFF" TEXT="#000000">. GSE Default Error -->.<H1>HTTP method GET is not supported by this URL</H1>.<H2>Error 405</H2>.</BODY>.</HTML>.

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56398), with no line terminators
Category:	downloaded
Size (bytes):	56398
Entropy (8bit):	5.907604034780877
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKYlebyB5lxRx54PHSGdXXwW7MFWwXVuE2:4UcW6v+0B5chXwW49z2
MD5:	EB4BC511F79F7A1573B45F5775B3A99B
SHA1:	D910FB51AD7316AA54F055079374574698E74B35
SHA-256:	7859A62E04B0ACB06516EB12454DE6673883ECFAEAED6C254659BCA7CD59C050
SHA-512:	EC9BDF1C91B6262B183FD23F640EAC22016D1F42DB631380676ED34B962E01BADDA91F9CBDFA189B42FE3182A992F1B95A7353AF41E41B2D6E1DAB17E87637A0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (554)
Category:	downloaded
Size (bytes):	510578
Entropy (8bit):	5.695280300193632
Encrypted:	false
SSDEEP:	6144:/LJaSgOPDcwWOTEmzYSU9F0Gx95F+SiT1i7uiv5VQgDx212FC:IS4sGx97+SihiSrFIC
MD5:	E9CCB3DBDE79BA5FFDF9CAD4B32D59FD
SHA1:	3A8CD67ADC7C885BDF683F1E7F491E6A4A50679F
SHA-256:	8F2C6777C7CCC01AB67290FA8ACD5A4C4866BE64129F39DFAEB9197DFA15E137
SHA-512:	5CA7C8439030C9B4B966760C660640A094B0D6E30E10DF85D7B900C6F9108B0E309298ED93C006634BB3F437BAB3CFF1B83A5D1B18C666C04346F0856294C461
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0./.var y=function(){return[function(E,X,B,M,c,v,Y,I,h,J,F,a,C,R,P){return E+4>>3==(E-8<<2>=(R=[1,"F",22],E)&&(E+2&12)<E&&(M=u[32](4,B[R[1]]),P=A[16](32,0,X,B[R[1]],M)),R[0])&&(M=void 0===M?null:M,Y=[3,341,278],c=d[46](16,21,X,u[31](32,B)),J=e[48](7,Y[0],X,u[31](35,X),u[31](28,Y[R[0]])),I=g[27](77,15,u[31](29,X),X,u[31](33,438)),v=u[31](38,Y[2]),a=A[32](R[2],l[13](2,d[9](48,36),X),[u[7](24,v),u[31](34,X)]),C=[c,J,I,a],null!=M&&(h=A[8](73),F=A[8](72),C=[W[30](8,h,u[31](28,B),u[31](37,0))].concat(C,[W[30](8,.F,R[0],R[0]),h,e[39](12,M,X),F])),P=C),P}]}(),g=function(){return[function(E,X,B,M,c,v){return 3<=((((E^(v=[7,"W",2],19))&v[0]\|\|(this[v

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:	12:6v/7OEUhUxzPKmghSn8nazyk+k8/OzxQcxNMvVb:bhUxzlvWkT8FcxK1
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk8dqZYMe7mkRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:35:55.056029081 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 19, 2024 11:36:04.664505959 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 19, 2024 11:36:09.290966988 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:09.291065931 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:09.291389942 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:09.292138100 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:09.292176962 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:09.372675896 CEST	49740	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.372735977 CEST	443	49740	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.372930050 CEST	49740	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.421283007 CEST	49740	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.421307087 CEST	443	49740	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.520034075 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:09.520428896 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:09.520457029 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:09.522037029 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:09.522106886 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:09.524274111 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:09.524450064 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:09.569957018 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:09.570024967 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:09.618011951 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:09.642688036 CEST	443	49740	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.642806053 CEST	49740	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.655663013 CEST	49740	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.655740023 CEST	443	49740	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.656131983 CEST	443	49740	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.697010994 CEST	49740	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.767123938 CEST	49740	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.808134079 CEST	443	49740	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.887773991 CEST	443	49740	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.887890100 CEST	443	49740	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.888070107 CEST	49740	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.888113976 CEST	443	49740	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.888133049 CEST	49740	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.888133049 CEST	49740	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.888140917 CEST	443	49740	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.888145924 CEST	443	49740	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.924855947 CEST	49741	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.924916983 CEST	443	49741	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:09.924993038 CEST	49741	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.925951004 CEST	49741	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:09.925987959 CEST	443	49741	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:10.146095037 CEST	443	49741	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:10.146190882 CEST	49741	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:10.160896063 CEST	49741	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:10.160944939 CEST	443	49741	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:10.161778927 CEST	443	49741	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:10.164113045 CEST	49741	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:10.212126970 CEST	443	49741	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:10.359116077 CEST	443	49741	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:10.359327078 CEST	443	49741	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:10.359407902 CEST	49741	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:10.361531019 CEST	49741	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:10.361569881 CEST	443	49741	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:10.361588001 CEST	49741	443	192.168.2.4	23.55.253.34
Apr 19, 2024 11:36:10.361598015 CEST	443	49741	23.55.253.34	192.168.2.4
Apr 19, 2024 11:36:12.578501940 CEST	49742	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:12.578588963 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:12.578692913 CEST	49742	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:12.579385996 CEST	49742	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:12.579421997 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:12.610414028 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:12.652149916 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:12.793521881 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:12.793983936 CEST	49742	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:12.794012070 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:12.794485092 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:12.794899940 CEST	49742	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:12.794985056 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:12.842564106 CEST	49742	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:13.024523973 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:13.024622917 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:13.024645090 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:13.024857044 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:13.027453899 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:13.077677965 CEST	49739	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:13.077708960 CEST	443	49739	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:13.082099915 CEST	49742	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:13.124147892 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:13.294173002 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:13.294239044 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:13.294291973 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:13.294348955 CEST	49742	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:13.294380903 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:13.294403076 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:13.294428110 CEST	49742	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:13.294455051 CEST	49742	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:13.483632088 CEST	49742	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:13.483675003 CEST	443	49742	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:14.330532074 CEST	49743	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:14.330563068 CEST	443	49743	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:14.330621004 CEST	49743	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:14.331132889 CEST	49743	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:14.331147909 CEST	443	49743	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:14.544426918 CEST	443	49743	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:14.598577023 CEST	49743	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:15.747965097 CEST	49743	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:15.747991085 CEST	443	49743	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:15.748795033 CEST	443	49743	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:15.756086111 CEST	49743	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:15.756206036 CEST	443	49743	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:15.756463051 CEST	49743	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:15.804124117 CEST	443	49743	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:15.877389908 CEST	443	49743	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:15.877574921 CEST	443	49743	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:15.877626896 CEST	49743	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:15.879115105 CEST	49743	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:15.879137039 CEST	443	49743	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.007464886 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.007493973 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.007584095 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.007853985 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.007868052 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.221683979 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.233541965 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.233551979 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.234307051 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.234694958 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.234824896 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.235354900 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.235413074 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.459351063 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.459399939 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.459441900 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.459476948 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.459491968 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.459505081 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.459579945 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.459614038 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.459688902 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.466485023 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.473781109 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.473831892 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.473859072 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.473886967 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.473936081 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.479054928 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.488466024 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.488543987 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.488564014 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.543920994 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.564148903 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.567343950 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.567377090 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.567912102 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.567929029 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.567981005 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.574994087 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.582015038 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.582071066 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.582082987 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.589370966 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.589426994 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.589437008 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.596802950 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.596875906 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.596894979 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.604547024 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.604625940 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.604638100 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.611042976 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.611098051 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.611109018 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.617733955 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.617798090 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.617809057 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.624142885 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.624237061 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.624245882 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.630726099 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.630800962 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.630810022 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.637413025 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.637451887 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.637501955 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.637518883 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.637576103 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.644227982 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.647625923 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.647732019 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.647797108 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.648032904 CEST	49746	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:17.648066998 CEST	443	49746	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:17.720199108 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 19, 2024 11:36:17.720242977 CEST	443	49672	173.222.162.32	192.168.2.4
Apr 19, 2024 11:36:17.721153975 CEST	49749	443	192.168.2.4	173.222.162.32
Apr 19, 2024 11:36:17.721168041 CEST	443	49749	173.222.162.32	192.168.2.4
Apr 19, 2024 11:36:17.721451998 CEST	49749	443	192.168.2.4	173.222.162.32
Apr 19, 2024 11:36:17.723032951 CEST	49749	443	192.168.2.4	173.222.162.32
Apr 19, 2024 11:36:17.723047972 CEST	443	49749	173.222.162.32	192.168.2.4
Apr 19, 2024 11:36:18.067264080 CEST	443	49749	173.222.162.32	192.168.2.4
Apr 19, 2024 11:36:18.067342043 CEST	49749	443	192.168.2.4	173.222.162.32
Apr 19, 2024 11:36:18.702209949 CEST	49753	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.702265978 CEST	443	49753	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.702385902 CEST	49753	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.702759981 CEST	49753	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.702780008 CEST	443	49753	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.734378099 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.734411001 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.734483004 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.735945940 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.735968113 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.916910887 CEST	443	49753	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.940591097 CEST	49753	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.940613031 CEST	443	49753	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.941785097 CEST	443	49753	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.942593098 CEST	49753	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.942780972 CEST	443	49753	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.942913055 CEST	49753	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.951118946 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.951412916 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.951423883 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.951874018 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.952478886 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.952565908 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:18.952780008 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:18.988120079 CEST	443	49753	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.000121117 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.145721912 CEST	443	49753	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.145895958 CEST	443	49753	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.145960093 CEST	49753	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.165985107 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.166042089 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.166075945 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.166105986 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.166120052 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.166162014 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.166191101 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.166205883 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.166255951 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.173090935 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.173309088 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.173321962 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.180363894 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.180437088 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.180449009 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.187829018 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.187912941 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.187925100 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.227524042 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.227544069 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.244889975 CEST	49753	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.244935036 CEST	443	49753	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.270530939 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.270663023 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.270675898 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.274102926 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.274239063 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.275155067 CEST	49754	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.275178909 CEST	443	49754	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.458833933 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.458893061 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.458971977 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.459579945 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.459606886 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.679070950 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.742100954 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.850126982 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.850158930 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.850846052 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.852936983 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.853044033 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:19.853477001 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:19.900122881 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.064130068 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.064209938 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.064255953 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.064285994 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:20.064299107 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.064316034 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.064362049 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:20.064389944 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.064429045 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:20.064439058 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.064486027 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.064537048 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:20.158279896 CEST	49758	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:20.158313036 CEST	443	49758	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.606494904 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:20.606543064 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.606611967 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:20.606870890 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:20.606884956 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.801131010 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:20.801183939 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:20.801256895 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:20.818368912 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:20.818409920 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:20.824918985 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.850402117 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:20.850431919 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.851929903 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.853796959 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:20.853931904 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:20.853940010 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.854008913 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:20.994563103 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:21.032322884 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.032639027 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:21.032700062 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.034152031 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.034234047 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:21.034765005 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:21.034853935 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.034985065 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:21.053149939 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:21.053282976 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:21.053380966 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:21.053427935 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:21.053461075 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:21.053561926 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:21.053599119 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:21.053680897 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:21.053747892 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:21.053765059 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:21.062474012 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:21.062582970 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:21.067929029 CEST	49761	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:21.067960024 CEST	443	49761	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:21.076143980 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.134561062 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:21.134571075 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.242175102 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:21.246808052 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.246857882 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.246891975 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.246931076 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.246951103 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:21.246972084 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.247005939 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:21.247092962 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:21.247145891 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:21.249454021 CEST	49762	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:21.249474049 CEST	443	49762	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:36.778531075 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:36.778594971 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:36.778903961 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:36.779035091 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:36.779047966 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:36.994623899 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:36.995120049 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:36.995189905 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:36.995546103 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:36.996215105 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:36.996294022 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:36.996433973 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:36.996745110 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:36.996788025 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.212311983 CEST	443	49749	173.222.162.32	192.168.2.4
Apr 19, 2024 11:36:37.212483883 CEST	49749	443	192.168.2.4	173.222.162.32
Apr 19, 2024 11:36:37.246634960 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.252377033 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.252407074 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.252463102 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.252515078 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.252855062 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.252873898 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.260040998 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.260059118 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.260279894 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.260297060 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.260440111 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.267370939 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.274688005 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.274714947 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.275254011 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.275263071 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.275446892 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.351094007 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.354531050 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.354556084 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.354979038 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.355000019 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.359436989 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.361841917 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.369076967 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.369096041 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.369240046 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.369416952 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.371433973 CEST	49765	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.371457100 CEST	443	49765	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.374110937 CEST	49766	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:37.374135017 CEST	443	49766	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:37.375694036 CEST	49766	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:37.376434088 CEST	49766	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:37.376451015 CEST	443	49766	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:37.424696922 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.424726009 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.424866915 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.427206039 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.427223921 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.594821930 CEST	443	49766	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:37.595172882 CEST	49766	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:37.595206022 CEST	443	49766	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:37.595669985 CEST	443	49766	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:37.596302032 CEST	49766	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:37.596386909 CEST	443	49766	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:37.596859932 CEST	49766	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:37.639723063 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.640151978 CEST	443	49766	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:37.640269995 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.640289068 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.640675068 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.641377926 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.641474009 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.641810894 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.641829967 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.824084997 CEST	443	49766	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:37.824466944 CEST	443	49766	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:37.824548960 CEST	49766	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:37.826946020 CEST	49766	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:37.826986074 CEST	443	49766	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:37.867456913 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.867558956 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.867597103 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.867610931 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.867635012 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.867680073 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.867687941 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.871999979 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.872077942 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.872092009 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.875727892 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.875783920 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.875801086 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.882996082 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.883083105 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.883116007 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.890317917 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.890371084 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.890388012 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.943837881 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.972537994 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.976212978 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.976247072 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.976286888 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.976320028 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.976373911 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.983423948 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.990710974 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.990742922 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.990765095 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.990775108 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:37.990840912 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:37.998079062 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.005425930 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.005461931 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.005496979 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:38.005506039 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.005578041 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:38.005585909 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.012411118 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.012470961 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:38.012506962 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.018774033 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.018836021 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:38.018846989 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.025156975 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.025229931 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:38.025239944 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.031496048 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.031569004 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:38.031578064 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.037870884 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.037926912 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:38.037935972 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.044321060 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.044373989 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:38.044385910 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.053803921 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.053864956 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:38.053873062 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.053893089 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.053956032 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:38.054316044 CEST	49770	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:36:38.054332018 CEST	443	49770	74.125.136.105	192.168.2.4
Apr 19, 2024 11:36:38.061136007 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.061161995 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.061235905 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.061458111 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.061466932 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.278292894 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.279616117 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.279624939 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.280432940 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.281044960 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.281171083 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.281245947 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.324157953 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.506023884 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.506133080 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.506175041 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.506195068 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.506220102 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.506270885 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.510519028 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.517821074 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.517853975 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.517882109 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.517888069 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.517940044 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.525130033 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.532517910 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.532550097 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.532582998 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.532588959 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.532634974 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.610548019 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.614078045 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.614191055 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.614207983 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.621320963 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.621404886 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.621467113 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.621473074 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.621579885 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.628639936 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.635924101 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.635987043 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.635993004 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.643213034 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.643332005 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.643402100 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.643429041 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.643486023 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.643491983 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.650630951 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.650713921 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.650718927 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.657809019 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.657958031 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.657969952 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.665045977 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.665115118 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.665122032 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.672069073 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.672260046 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.672265053 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.679023981 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.679085016 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.679090977 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.689574957 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.689635038 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.689640999 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.696574926 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.696770906 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:36:38.696808100 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.696840048 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.703010082 CEST	49776	443	192.168.2.4	142.250.105.103
Apr 19, 2024 11:36:38.703027010 CEST	443	49776	142.250.105.103	192.168.2.4
Apr 19, 2024 11:37:08.807096004 CEST	49779	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:37:08.807141066 CEST	443	49779	74.125.136.105	192.168.2.4
Apr 19, 2024 11:37:08.807367086 CEST	49779	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:37:08.807756901 CEST	49779	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:37:08.807770967 CEST	443	49779	74.125.136.105	192.168.2.4
Apr 19, 2024 11:37:09.025635958 CEST	443	49779	74.125.136.105	192.168.2.4
Apr 19, 2024 11:37:09.026288986 CEST	49779	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:37:09.026315928 CEST	443	49779	74.125.136.105	192.168.2.4
Apr 19, 2024 11:37:09.026680946 CEST	443	49779	74.125.136.105	192.168.2.4
Apr 19, 2024 11:37:09.027123928 CEST	49779	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:37:09.027199984 CEST	443	49779	74.125.136.105	192.168.2.4
Apr 19, 2024 11:37:09.071055889 CEST	49779	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:37:11.352977037 CEST	49723	80	192.168.2.4	23.40.205.18
Apr 19, 2024 11:37:11.353148937 CEST	49724	80	192.168.2.4	23.40.205.34
Apr 19, 2024 11:37:11.457315922 CEST	80	49724	23.40.205.34	192.168.2.4
Apr 19, 2024 11:37:11.457344055 CEST	80	49723	23.40.205.18	192.168.2.4
Apr 19, 2024 11:37:11.457428932 CEST	49724	80	192.168.2.4	23.40.205.34
Apr 19, 2024 11:37:11.457472086 CEST	49723	80	192.168.2.4	23.40.205.18
Apr 19, 2024 11:37:19.047564030 CEST	443	49779	74.125.136.105	192.168.2.4
Apr 19, 2024 11:37:19.047647953 CEST	443	49779	74.125.136.105	192.168.2.4
Apr 19, 2024 11:37:19.048119068 CEST	49779	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:37:20.979804993 CEST	49779	443	192.168.2.4	74.125.136.105
Apr 19, 2024 11:37:20.979829073 CEST	443	49779	74.125.136.105	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:36:04.574553013 CEST	53	61419	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:04.577565908 CEST	53	57845	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:05.270418882 CEST	53	60635	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:06.603504896 CEST	53	50443	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:08.743494034 CEST	63500	53	192.168.2.4	1.1.1.1
Apr 19, 2024 11:36:08.746069908 CEST	58412	53	192.168.2.4	1.1.1.1
Apr 19, 2024 11:36:08.848417044 CEST	53	63500	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:08.850308895 CEST	53	58412	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:15.989464045 CEST	53	50270	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:17.230036020 CEST	53	50743	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:18.853322983 CEST	53	63320	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:19.158855915 CEST	53	53014	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:20.693030119 CEST	53578	53	192.168.2.4	1.1.1.1
Apr 19, 2024 11:36:20.693591118 CEST	56760	53	192.168.2.4	1.1.1.1
Apr 19, 2024 11:36:20.797449112 CEST	53	53578	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:20.798187017 CEST	53	56760	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:22.713092089 CEST	53	56742	1.1.1.1	192.168.2.4
Apr 19, 2024 11:36:22.939569950 CEST	138	138	192.168.2.4	192.168.2.255
Apr 19, 2024 11:36:42.007673025 CEST	53	57475	1.1.1.1	192.168.2.4
Apr 19, 2024 11:37:04.386650085 CEST	53	50212	1.1.1.1	192.168.2.4
Apr 19, 2024 11:37:05.018443108 CEST	53	59314	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 11:36:08.743494034 CEST	192.168.2.4	1.1.1.1	0x3b13	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:08.746069908 CEST	192.168.2.4	1.1.1.1	0xf356	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 19, 2024 11:36:20.693030119 CEST	192.168.2.4	1.1.1.1	0x4527	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:20.693591118 CEST	192.168.2.4	1.1.1.1	0x8c0f	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 11:36:08.848417044 CEST	1.1.1.1	192.168.2.4	0x3b13	No error (0)	www.google.com		74.125.136.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:08.848417044 CEST	1.1.1.1	192.168.2.4	0x3b13	No error (0)	www.google.com		74.125.136.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:08.848417044 CEST	1.1.1.1	192.168.2.4	0x3b13	No error (0)	www.google.com		74.125.136.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:08.848417044 CEST	1.1.1.1	192.168.2.4	0x3b13	No error (0)	www.google.com		74.125.136.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:08.848417044 CEST	1.1.1.1	192.168.2.4	0x3b13	No error (0)	www.google.com		74.125.136.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:08.848417044 CEST	1.1.1.1	192.168.2.4	0x3b13	No error (0)	www.google.com		74.125.136.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:08.850308895 CEST	1.1.1.1	192.168.2.4	0xf356	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 11:36:20.547447920 CEST	1.1.1.1	192.168.2.4	0x1abf	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:36:20.547447920 CEST	1.1.1.1	192.168.2.4	0x1abf	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:20.797449112 CEST	1.1.1.1	192.168.2.4	0x4527	No error (0)	www.google.com		142.250.105.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:20.797449112 CEST	1.1.1.1	192.168.2.4	0x4527	No error (0)	www.google.com		142.250.105.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:20.797449112 CEST	1.1.1.1	192.168.2.4	0x4527	No error (0)	www.google.com		142.250.105.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:20.797449112 CEST	1.1.1.1	192.168.2.4	0x4527	No error (0)	www.google.com		142.250.105.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:20.797449112 CEST	1.1.1.1	192.168.2.4	0x4527	No error (0)	www.google.com		142.250.105.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:20.797449112 CEST	1.1.1.1	192.168.2.4	0x4527	No error (0)	www.google.com		142.250.105.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:20.798187017 CEST	1.1.1.1	192.168.2.4	0x8c0f	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 11:36:38.199757099 CEST	1.1.1.1	192.168.2.4	0x56f7	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:36:38.199757099 CEST	1.1.1.1	192.168.2.4	0x56f7	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:36:57.793545008 CEST	1.1.1.1	192.168.2.4	0xd703	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:36:57.793545008 CEST	1.1.1.1	192.168.2.4	0xd703	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:37:17.193108082 CEST	1.1.1.1	192.168.2.4	0x50ca	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:37:17.193108082 CEST	1.1.1.1	192.168.2.4	0x50ca	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

https:

www.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	23.55.253.34	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:09 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 09:36:09 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=163647 Date: Fri, 19 Apr 2024 09:36:09 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	23.55.253.34	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:10 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 09:36:10 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=163581 Date: Fri, 19 Apr 2024 09:36:10 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-19 09:36:10 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	74.125.136.105	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:12 UTC	809	OUT	GET / HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:36:13 UTC	2084	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIjPaIsQYQ-bydywMSBFG1OTQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-66GDoxmo5ILVLVunAFzdBQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 19 Apr 2024 09:36:12 GMT Server: gws Content-Length: 398 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; expires=Wed, 16-Oct-2024 09:36:12 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4; expires=Sat, 19-Oct-2024 09:36:12 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 09:36:13 UTC	398	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 26 61 6d 70 3b 71 3d 45 67 52 52 74 54 6b 30 47 49 7a 32 69 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	74.125.136.105	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:13 UTC	1236	OUT	GET /sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:13 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 19 Apr 2024 09:36:13 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3054 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 09:36:13 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/</title></head><body style="font
2024-04-19 09:36:13 UTC	1255	IN	Data Raw: 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 42 73 73 34 70 34 55 75 6d 57 4a 2d 6b 54 71 33 54 36 7a 6b 69 6a 64 6a 74 35 6a 41 4d 73 4b 48 58 30 4d 62 56 48 46 4b 7a 53 75 71 73 4d 65 78 73 34 50 4a Data Ascii: onse) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ
2024-04-19 09:36:13 UTC	900	IN	Data Raw: 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e 67 20 74 68 65 20 61 62 6f 76 65 20 43 41 50 54 43 48 41 20 77 69 6c 6c 20 6c 65 74 20 79 6f 75 20 63 6f 6e 74 69 Data Ascii: ming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solving the above CAPTCHA will let you conti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	74.125.136.105	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:15 UTC	1101	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:15 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Fri, 19 Apr 2024 09:36:15 GMT Date: Fri, 19 Apr 2024 09:36:15 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 09:36:15 UTC	727	IN	Data Raw: 34 63 36 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 4c6/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-04-19 09:36:15 UTC	502	IN	Data Raw: 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 3b 70 6f 2e 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 65 5a 47 38 65 34 6e 52 70 30 67 45 70 52 42 37 35 Data Ascii: cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-eZG8e4nRp0gEpRB75
2024-04-19 09:36:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	74.125.136.105	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:17 UTC	1708	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:17 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 19 Apr 2024 09:36:17 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-q_7k-4mI7UABRH5ijNwpyg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 09:36:17 UTC	364	IN	Data Raw: 32 61 64 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2ad8<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-04-19 09:36:17 UTC	1255	IN	Data Raw: 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 Data Ascii: 18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//font
2024-04-19 09:36:17 UTC	1255	IN	Data Raw: 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 Data Ascii: 0AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00
2024-04-19 09:36:17 UTC	1255	IN	Data Raw: 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 Data Ascii: +04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-19 09:36:17 UTC	1255	IN	Data Raw: 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 Data Ascii: e { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0
2024-04-19 09:36:17 UTC	1255	IN	Data Raw: 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a Data Ascii: ic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2024-04-19 09:36:17 UTC	1255	IN	Data Raw: 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 71 5f 37 6b 2d 34 6d 49 37 55 41 42 52 48 35 69 6a 4e 77 70 79 67 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d Data Ascii: </style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/styles__ltr.css"><script nonce="q_7k-4mI7UABRH5ijNwpyg" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com
2024-04-19 09:36:17 UTC	1255	IN	Data Raw: 53 59 73 62 6b 53 4e 52 52 54 55 74 49 4f 65 62 6d 76 45 54 5a 43 75 5a 72 51 6a 6e 4a 34 64 72 55 73 7a 6a 4e 74 52 4a 6c 5a 5f 4f 42 44 55 4f 53 41 43 48 41 45 69 62 43 4e 46 79 77 48 67 73 4b 72 62 43 59 48 66 30 38 35 4f 76 70 4d 4f 6d 4d 6e 38 62 49 59 77 36 6f 51 41 55 78 67 45 4e 7a 42 37 62 47 4c 45 7a 62 73 43 6a 42 39 49 65 73 6d 31 6b 4a 66 37 6f 7a 4d 66 6f 4d 71 7a 74 73 42 2d 68 2d 68 77 69 79 75 36 50 6d 35 36 64 67 62 4b 4a 6b 69 44 6b 59 6c 69 67 4e 74 6b 67 55 4f 44 7a 6c 75 30 35 37 6c 4e 55 4b 43 74 5a 52 36 59 4d 38 78 46 78 6c 4a 6a 71 6f 58 54 37 4a 71 6d 4f 57 33 79 38 36 44 2d 73 77 73 6c 67 71 63 55 4d 46 54 38 68 46 30 78 31 30 69 45 4c 57 52 71 78 41 33 51 56 72 73 6a 45 72 63 32 39 6a 4e 49 33 67 39 6a 37 5f 6c 49 33 33 7a 65 Data Ascii: SYsbkSNRRTUtIOebmvETZCuZrQjnJ4drUszjNtRJlZ_OBDUOSACHAEibCNFywHgsKrbCYHf085OvpMOmMn8bIYw6oQAUxgENzB7bGLEzbsCjB9Iesm1kJf7ozMfoMqztsB-h-hwiyu6Pm56dgbKJkiDkYligNtkgUODzlu057lNUKCtZR6YM8xFxlJjqoXT7JqmOW3y86D-swslgqcUMFT8hF0x10iELWRqxA3QVrsjErc29jNI3g9j7_lI33ze
2024-04-19 09:36:17 UTC	1255	IN	Data Raw: 39 5a 6a 43 78 44 44 75 31 33 6f 33 70 70 51 34 65 7a 45 2d 42 52 62 6d 63 37 70 42 6b 54 38 42 67 6a 49 48 64 71 54 45 73 5f 4b 34 33 4a 6b 75 77 51 6f 69 43 35 65 6e 5f 34 64 57 61 78 58 35 4b 6f 35 38 45 6b 2d 59 54 6e 79 6d 6a 70 38 6c 4b 71 35 55 31 6e 6a 6b 6c 72 64 47 64 57 70 34 34 61 48 64 64 35 31 4e 45 74 6a 67 74 50 59 73 4b 4c 54 62 36 49 34 39 57 6d 4b 7a 6f 61 74 35 74 58 7a 5f 75 35 72 45 4f 45 6e 30 59 50 56 34 6f 4f 66 33 59 73 36 52 42 63 50 45 76 57 35 6d 49 54 43 76 61 46 59 48 37 4d 57 32 2d 6f 57 49 65 77 72 46 53 76 72 48 66 4b 57 46 4d 79 74 49 66 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 71 5f 37 6b 2d 34 6d 49 37 55 41 42 52 48 35 69 6a 4e 77 70 79 Data Ascii: 9ZjCxDDu13o3ppQ4ezE-BRbmc7pBkT8BgjIHdqTEs_K43JkuwQoiC5en_4dWaxX5Ko58Ek-YTnymjp8lKq5U1njklrdGdWp44aHdd51NEtjgtPYsKLTb6I49WmKzoat5tXz_u5rEOEn0YPV4oOf3Ys6RBcPEvW5mITCvaFYH7MW2-oWIewrFSvrHfKWFMytIf"><script type="text/javascript" nonce="q_7k-4mI7UABRH5ijNwpy
2024-04-19 09:36:17 UTC	572	IN	Data Raw: 59 32 5a 57 4f 53 39 70 4d 56 41 76 57 45 46 56 59 6c 4e 71 63 33 5a 78 4e 33 46 70 61 57 70 4e 63 45 35 6c 65 44 68 76 63 46 67 78 51 6e 5a 59 55 6d 4d 72 51 31 4a 68 55 54 41 30 56 6b 45 35 62 45 4a 4a 4d 56 52 32 57 55 70 53 52 6c 59 34 63 6a 5a 54 56 58 56 47 54 32 6c 54 4e 6b 4e 36 62 6e 5a 70 65 58 70 4d 4d 32 51 79 52 31 68 43 63 45 4a 76 51 57 74 35 4f 44 5a 48 5a 6b 78 52 59 6b 4e 44 4e 45 4a 52 53 57 30 31 57 6b 68 32 52 33 68 4b 64 6d 55 30 4d 46 70 7a 55 33 70 30 4d 58 4a 4a 4e 6c 52 75 52 33 49 32 5a 54 52 46 4d 58 4e 33 51 6d 6c 32 4d 31 46 35 61 55 51 7a 51 32 4a 45 54 46 51 33 4f 55 49 34 63 56 4d 77 57 46 70 55 63 31 68 71 63 6e 6c 44 5a 55 74 42 4d 32 35 6e 56 6b 74 4e 4d 6d 5a 4f 54 57 78 6b 5a 6c 64 6a 52 45 78 79 51 6d 6f 30 56 55 6c Data Ascii: Y2ZWOS9pMVAvWEFVYlNqc3ZxN3FpaWpNcE5leDhvcFgxQnZYUmMrQ1JhUTA0VkE5bEJJMVR2WUpSRlY4cjZTVXVGT2lTNkN6bnZpeXpMM2QyR1hCcEJvQWt5ODZHZkxRYkNDNEJRSW01Wkh2R3hKdmU0MFpzU3p0MXJJNlRuR3I2ZTRFMXN3Qml2M1F5aUQzQ2JETFQ3OUI4cVMwWFpUc1hqcnlDZUtBM25nVktNMmZOTWxkZldjRExyQmo0VUl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	74.125.136.105	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:18 UTC	1435	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm- HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:19 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Fri, 19 Apr 2024 09:36:19 GMT Date: Fri, 19 Apr 2024 09:36:19 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 09:36:19 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js');
2024-04-19 09:36:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49754	74.125.136.105	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:18 UTC	1423	OUT	GET /js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:19 UTC	799	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18291 Date: Fri, 19 Apr 2024 09:36:19 GMT Expires: Sat, 19 Apr 2025 09:36:19 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 04 Apr 2024 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 09:36:19 UTC	456	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 4b 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 29 7b 69 66 28 21 28 77 3d 28 7a 3d 6e 75 6c 6c 2c 61 2e 74 72 75 73 74 65 64 54 79 70 65 73 29 2c 77 29 7c 7c 21 77 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 7a 3b 74 72 79 7b 7a 3d 77 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 6d 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 6d 2c 63 72 65 61 74 Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var a=this\|\|self,K=function(z,w){if(!(w=(z=null,a.trustedTypes),w)\|\|!w.createPolicy)return z;try{z=w.createPolicy("bg",{createHTML:m,createScript:m,creat
2024-04-19 09:36:19 UTC	1255	IN	Data Raw: 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 46 29 7b 72 65 74 75 72 6e 22 22 2b 46 7d 7d 28 61 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 5b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 27 2c 0a 27 27 2c 0a 27 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 69 73 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 29 7b 28 28 77 2e 70 75 73 68 28 7a 5b 30 5d 3c 3c 32 34 7c 7a 5b 31 5d 3c 3c 31 36 7c 7a 5b 32 5d 3c 3c 38 7c 7a 5b 33 5d 29 2c 77 29 2e 70 75 73 68 28 7a 5b 34 5d 3c 3c 32 34 7c 7a 5b 35 5d 3c 3c 31 36 7c 7a 5b 36 5d 3c 3c 38 7c 7a 5b 37 5d 29 2c 77 29 2e 70 75 73 68 28 7a 5b 38 5d 3c Data Ascii: )}:function(F){return""+F}}(a)(Array(7824Math.random()\|0).join("\n")+['(function(){/','',' SPDX-License-Identifier: Apache-2.0','*/','var is=function(z,w){((w.push(z[0]<<24\|z[1]<<16\|z[2]<<8\|z[3]),w).push(z[4]<<24\|z[5]<<16\|z[6]<<8\|z[7]),w).push(z[8]<
2024-04-19 09:36:19 UTC	1255	IN	Data Raw: 2c 61 3e 3e 3e 31 36 26 32 35 35 2c 61 3e 3e 3e 38 26 32 35 35 2c 61 3e 3e 3e 30 26 32 35 35 5d 7d 2c 73 36 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 68 69 73 2e 43 3d 74 68 69 73 2e 50 3d 74 68 69 73 2e 6e 3d 30 7d 72 65 74 75 72 6e 20 77 3d 28 61 2e 70 72 6f 74 6f 74 79 70 65 2e 4e 68 3d 28 61 2e 70 72 6f 74 6f 74 79 70 65 2e 62 50 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 30 3d 3d 3d 74 68 69 73 2e 6e 3f 30 3a 4d 61 74 68 2e 73 71 72 74 28 74 68 69 73 2e 43 2f 74 68 69 73 2e 6e 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 6d 2c 71 29 7b 28 74 68 69 73 2e 50 2b 3d 28 71 3d 6d 2d 74 68 69 73 2e 50 2c 74 68 69 73 2e 6e 2b 2b 2c 71 29 2f 74 68 69 73 2e 6e 2c 74 68 69 73 29 2e 43 2b 3d 71 2a 28 6d 2d 74 68 Data Ascii: ,a>>>16&255,a>>>8&255,a>>>0&255]},s6=function(z,w){function a(){this.C=this.P=this.n=0}return w=(a.prototype.Nh=(a.prototype.bP=function(){return 0===this.n?0:Math.sqrt(this.C/this.n)},function(m,q){(this.P+=(q=m-this.P,this.n++,q)/this.n,this).C+=q*(m-th
2024-04-19 09:36:19 UTC	1255	IN	Data Raw: 5a 3d 3d 7a 3f 28 76 28 7a 29 7c 30 29 2d 31 3a 31 29 2c 42 28 7a 29 29 2c 30 29 3b 71 3c 77 3b 71 2b 2b 29 4d 2e 52 2e 70 75 73 68 28 42 28 7a 29 29 3b 66 6f 72 28 3b 77 2d 2d 3b 29 4d 2e 52 5b 77 5d 3d 47 28 7a 2c 4d 2e 52 5b 77 5d 29 3b 72 65 74 75 72 6e 28 4d 2e 6b 74 3d 47 28 7a 2c 61 29 2c 4d 29 2e 4f 4f 3d 47 28 7a 2c 6d 29 2c 4d 7d 2c 47 63 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 2c 61 2c 6d 2c 71 2c 4d 29 7b 69 66 28 21 77 2e 44 29 7b 77 2e 4b 2b 2b 3b 74 72 79 7b 66 6f 72 28 71 3d 28 61 3d 28 4d 3d 76 6f 69 64 20 30 2c 77 2e 57 29 2c 30 29 3b 2d 2d 7a 3b 29 74 72 79 7b 69 66 28 6d 3d 76 6f 69 64 20 30 2c 77 2e 47 29 4d 3d 4b 49 28 77 2c 77 2e 47 29 3b 65 6c 73 65 7b 69 66 28 71 3d 47 28 77 2c 36 34 29 2c 71 3e 3d 61 29 62 72 65 61 6b 3b 4d 3d 28 Data Ascii: Z==z?(v(z)\|0)-1:1),B(z)),0);q<w;q++)M.R.push(B(z));for(;w--;)M.R[w]=G(z,M.R[w]);return(M.kt=G(z,a),M).OO=G(z,m),M},Gc=function(z,w,a,m,q,M){if(!w.D){w.K++;try{for(q=(a=(M=void 0,w.W),0);--z;)try{if(m=void 0,w.G)M=KI(w,w.G);else{if(q=G(w,64),q>=a)break;M=(
2024-04-19 09:36:19 UTC	1255	IN	Data Raw: 2c 50 3d 7b 70 61 73 73 69 76 65 3a 74 72 75 65 2c 63 61 70 74 75 72 65 3a 74 72 75 65 7d 2c 79 4d 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 2c 61 2c 6d 29 7b 66 6f 72 28 3b 7a 2e 6c 2e 6c 65 6e 67 74 68 3b 29 7b 6d 3d 28 7a 2e 67 3d 6e 75 6c 6c 2c 7a 2e 6c 29 2e 70 6f 70 28 29 3b 74 72 79 7b 61 3d 62 73 28 7a 2c 6d 29 7d 63 61 74 63 68 28 71 29 7b 6e 28 7a 2c 71 29 7d 69 66 28 77 26 26 7a 2e 67 29 7b 77 3d 7a 2e 67 2c 77 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4f 28 7a 2c 74 72 75 65 2c 74 72 75 65 29 7d 29 3b 62 72 65 61 6b 7d 7d 72 65 74 75 72 6e 20 61 7d 2c 78 34 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 2c 61 2c 6d 2c 71 2c 4d 2c 74 29 7b 66 6f 72 28 4d 3d 28 7a 2e 64 31 3d 28 7a 2e 67 31 3d 61 57 28 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 Data Ascii: ,P={passive:true,capture:true},yM=function(z,w,a,m){for(;z.l.length;){m=(z.g=null,z.l).pop();try{a=bs(z,m)}catch(q){n(z,q)}if(w&&z.g){w=z.g,w(function(){O(z,true,true)});break}}return a},x4=function(z,w,a,m,q,M,t){for(M=(z.d1=(z.g1=aW({get:function(){retu
2024-04-19 09:36:19 UTC	1255	IN	Data Raw: 7a 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 2c 79 29 7b 28 4b 3d 47 28 28 79 3d 30 21 3d 47 28 46 2c 28 79 3d 42 28 46 29 2c 4b 3d 42 28 46 29 2c 79 29 29 2c 46 29 2c 4b 29 2c 79 29 26 26 41 28 36 34 2c 46 2c 4b 29 7d 29 29 2c 30 29 2c 30 5d 29 2c 67 29 29 2c 7a 29 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 2c 79 2c 62 29 7b 21 44 28 74 72 75 65 2c 66 61 6c 73 65 2c 4b 2c 46 29 26 26 28 4b 3d 57 74 28 46 29 2c 79 3d 4b 2e 4f 4f 2c 62 3d 4b 2e 6b 74 2c 46 2e 5a 3d 3d 46 7c 7c 79 3d 3d 46 2e 48 5a 26 26 62 3d 3d 46 29 26 26 28 41 28 4b 2e 56 6f 2c 46 2c 79 2e 61 70 70 6c 79 28 62 2c 4b 2e 52 29 29 2c 46 2e 41 3d 46 2e 59 28 29 29 7d 29 2c 7a 29 2c 5b 5d 29 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 2c 79 2c 62 2c 57 2c 64 Data Ascii: z),function(){}),function(F,K,y){(K=G((y=0!=G(F,(y=B(F),K=B(F),y)),F),K),y)&&A(64,F,K)})),0),0]),g)),z),function(F,K,y,b){!D(true,false,K,F)&&(K=Wt(F),y=K.OO,b=K.kt,F.Z==F\|\|y==F.HZ&&b==F)&&(A(K.Vo,F,y.apply(b,K.R)),F.A=F.Y())}),z),[]),function(F,K,y,b,W,d
2024-04-19 09:36:19 UTC	1255	IN	Data Raw: 62 2c 46 2c 66 75 6e 63 74 69 6f 6e 28 59 2c 5a 2c 78 2c 66 2c 72 29 7b 66 6f 72 28 72 3d 28 5a 3d 28 66 3d 5b 5d 2c 30 29 2c 5b 5d 29 3b 5a 3c 53 3b 5a 2b 2b 29 7b 69 66 28 21 28 78 3d 6c 5b 5a 5d 2c 57 5b 5a 5d 29 29 7b 66 6f 72 28 3b 78 3e 3d 66 2e 6c 65 6e 67 74 68 3b 29 66 2e 70 75 73 68 28 42 28 59 29 29 3b 78 3d 66 5b 78 5d 7d 72 2e 70 75 73 68 28 78 29 7d 59 2e 48 3d 55 36 28 28 59 2e 47 3d 55 36 28 64 2e 73 6c 69 63 65 28 29 2c 59 29 2c 72 29 2c 59 29 7d 29 7d 29 29 2c 7a 29 2e 50 5a 3d 30 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 2c 79 2c 62 29 7b 41 28 28 4b 3d 42 28 28 79 3d 28 62 3d 42 28 46 29 2c 42 29 28 46 29 2c 46 29 29 2c 4b 29 2c 46 2c 47 28 46 2c 62 29 7c 7c 47 28 46 2c 79 29 29 7d 29 29 2c 37 34 29 2c 7a 2c 4a 28 34 29 29 2c 7a 29 2c 35 Data Ascii: b,F,function(Y,Z,x,f,r){for(r=(Z=(f=[],0),[]);Z<S;Z++){if(!(x=l[Z],W[Z])){for(;x>=f.length;)f.push(B(Y));x=f[x]}r.push(x)}Y.H=U6((Y.G=U6(d.slice(),Y),r),Y)})})),z).PZ=0,function(F,K,y,b){A((K=B((y=(b=B(F),B)(F),F)),K),F,G(F,b)\|\|G(F,y))})),74),z,J(4)),z),5
2024-04-19 09:36:19 UTC	1255	IN	Data Raw: 57 29 7d 29 2c 7a 29 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 2c 79 2c 62 2c 57 2c 64 2c 6c 29 7b 66 6f 72 28 62 3d 28 6c 3d 28 57 3d 28 4b 3d 28 64 3d 42 28 46 29 2c 4d 78 28 46 29 29 2c 22 22 29 2c 47 28 46 2c 31 33 35 29 29 2c 6c 2e 6c 65 6e 67 74 68 29 2c 79 3d 30 3b 4b 2d 2d 3b 29 79 3d 28 28 79 7c 30 29 2b 28 4d 78 28 46 29 7c 30 29 29 25 62 2c 57 2b 3d 74 5b 6c 5b 79 5d 5d 3b 41 28 64 2c 46 2c 57 29 7d 29 2c 41 29 28 33 30 32 2c 7a 2c 30 29 2c 66 75 6e 63 74 69 6f 6e 28 46 29 7b 74 73 28 46 2c 31 29 7d 29 29 2c 7a 29 2c 7b 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 29 7b 28 46 3d 28 4b 3d 42 28 46 29 2c 47 28 46 2e 5a 2c 4b 29 29 2c 46 29 5b 30 5d 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 46 5b 31 5d 2c 46 5b 32 5d 2c 50 29 7d Data Ascii: W)}),z),function(F,K,y,b,W,d,l){for(b=(l=(W=(K=(d=B(F),Mx(F)),""),G(F,135)),l.length),y=0;K--;)y=((y\|0)+(Mx(F)\|0))%b,W+=t[l[y]];A(d,F,W)}),A)(302,z,0),function(F){ts(F,1)})),z),{}),function(F,K){(F=(K=B(F),G(F.Z,K)),F)[0].removeEventListener(F[1],F[2],P)}
2024-04-19 09:36:19 UTC	1255	IN	Data Raw: 34 5d 26 26 28 7a 2e 69 3d 74 72 75 65 29 2c 77 5b 35 5d 26 26 28 7a 2e 49 3d 74 72 75 65 29 2c 77 5b 36 5d 26 26 28 7a 2e 54 3d 74 72 75 65 29 2c 7a 2e 6a 28 77 29 3b 65 6c 73 65 20 69 66 28 71 3d 3d 6b 34 29 7a 2e 42 3d 74 72 75 65 2c 7a 2e 6a 28 77 29 3b 65 6c 73 65 20 69 66 28 71 3d 3d 63 74 29 7b 7a 2e 49 3d 74 72 75 65 3b 74 72 79 7b 66 6f 72 28 6d 3d 30 3b 6d 3c 7a 2e 46 2e 6c 65 6e 67 74 68 3b 6d 2b 2b 29 74 72 79 7b 61 3d 7a 2e 46 5b 6d 5d 2c 61 5b 30 5d 5b 61 5b 31 5d 5d 28 61 5b 32 5d 29 7d 63 61 74 63 68 28 4d 29 7b 7d 7d 63 61 74 63 68 28 4d 29 7b 7d 28 30 2c 77 5b 31 5d 29 28 66 75 6e 63 74 69 6f 6e 28 4d 2c 74 29 7b 7a 2e 6f 73 28 4d 2c 74 72 75 65 2c 74 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 4d 29 7b 28 28 4d 3d 21 7a 2e 6c 2e 6c 65 6e 67 74 Data Ascii: 4]&&(z.i=true),w[5]&&(z.I=true),w[6]&&(z.T=true),z.j(w);else if(q==k4)z.B=true,z.j(w);else if(q==ct){z.I=true;try{for(m=0;m<z.F.length;m++)try{a=z.F[m],a[0][a[1]](a[2])}catch(M){}}catch(M){}(0,w[1])(function(M,t){z.os(M,true,t)},function(M){((M=!z.l.lengt
2024-04-19 09:36:19 UTC	1255	IN	Data Raw: 63 74 69 6f 6e 28 7a 2c 77 29 7b 69 66 28 28 77 3d 67 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 7a 3d 6e 75 6c 6c 2c 21 77 29 7c 7c 21 77 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 7a 3b 74 72 79 7b 7a 3d 77 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 53 45 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 53 45 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 53 45 7d 29 7d 63 61 74 63 68 28 61 29 7b 67 2e 63 6f 6e 73 6f 6c 65 26 26 67 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 61 2e 6d 65 73 73 61 67 65 29 7d 72 65 74 75 72 6e 20 7a 7d 2c 44 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 2c 61 2c 6d 2c 71 2c 4d 2c 74 2c 46 2c 4b 29 7b 69 66 28 28 28 28 74 3d 28 71 3d 28 4b 3d 30 3c 28 7a 7c 7c 6d Data Ascii: ction(z,w){if((w=g.trustedTypes,z=null,!w)\|\|!w.createPolicy)return z;try{z=w.createPolicy("bg",{createHTML:SE,createScript:SE,createScriptURL:SE})}catch(a){g.console&&g.console.error(a.message)}return z},D=function(z,w,a,m,q,M,t,F,K){if((((t=(q=(K=0<(z\|\|m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49758	74.125.136.105	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:19 UTC	1156	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:20 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Apr 2024 02:08:46 GMT Expires: Thu, 25 Apr 2024 02:08:46 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 199654 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 09:36:20 UTC	548	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-04-19 09:36:20 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C;
2024-04-19 09:36:20 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4S4
2024-04-19 09:36:20 UTC	1255	IN	Data Raw: ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-04-19 09:36:20 UTC	1117	IN	Data Raw: ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49761	74.125.136.105	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:20 UTC	1345	OUT	GET /recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:21 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 19 Apr 2024 09:36:20 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-CH76S8VriOxgCLEdmXXiqg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 09:36:21 UTC	364	IN	Data Raw: 31 64 31 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 Data Ascii: 1d11<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face
2024-04-19 09:36:21 UTC	1255	IN	Data Raw: 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e Data Ascii: v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fon
2024-04-19 09:36:21 UTC	1255	IN	Data Raw: 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 Data Ascii: 20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E0
2024-04-19 09:36:21 UTC	1255	IN	Data Raw: 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b Data Ascii: U+04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-19 09:36:21 UTC	1255	IN	Data Raw: 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b Data Ascii: ce { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+
2024-04-19 09:36:21 UTC	1255	IN	Data Raw: 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 Data Ascii: tic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight
2024-04-19 09:36:21 UTC	810	IN	Data Raw: 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 43 48 37 36 53 38 56 72 69 4f 78 67 43 4c 45 64 6d 58 58 69 71 67 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f Data Ascii: }</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/styles__ltr.css"><script nonce="CH76S8VriOxgCLEdmXXiqg" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.co
2024-04-19 09:36:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49762	142.250.105.103	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:21 UTC	699	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:21 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 15 Apr 2024 14:07:06 GMT Expires: Tue, 23 Apr 2024 14:07:06 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 329355 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 09:36:21 UTC	548	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-04-19 09:36:21 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C;
2024-04-19 09:36:21 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4S4
2024-04-19 09:36:21 UTC	1255	IN	Data Raw: ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-04-19 09:36:21 UTC	1117	IN	Data Raw: ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49765	74.125.136.105	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:36 UTC	1164	OUT	POST /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 7719 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:36 UTC	7719	OUT	Data Raw: 0a 18 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 12 ce 10 30 33 41 46 63 57 65 41 36 74 76 58 44 72 4f 41 41 34 46 53 47 51 48 56 72 70 44 38 68 38 4f 56 2d 4c 2d 64 41 2d 38 67 71 79 6e 56 37 67 38 57 75 56 75 6d 63 76 4d 36 66 6f 6b 6e 58 32 7a 53 64 52 4f 6e 5f 4f 30 45 44 53 58 42 77 6d 4a 68 4d 6a 4d 36 79 5f 73 4e 65 42 4e 6a 4c 59 51 36 67 71 4c 4b 5f 46 50 30 50 43 6a 74 35 6e 6b 46 39 30 35 33 51 68 71 6e 70 7a 58 62 64 58 55 57 46 38 65 6f 77 58 39 71 7a 75 66 42 48 73 32 58 5f 78 34 75 7a 4a 6e 4a 5a 6d 77 78 61 58 71 38 7a 30 77 41 35 67 38 5a 38 57 56 34 49 79 58 5a 4c 67 58 44 2d 59 65 55 6c 49 33 59 70 36 35 4a 58 32 47 66 65 76 36 64 36 38 77 61 76 7a 5f 37 35 43 43 32 4d 57 78 42 64 70 64 50 49 34 49 58 41 54 Data Ascii: rz4DvU-cY2JYCwHSTck0_qm-03AFcWeA6tvXDrOAA4FSGQHVrpD8h8OV-L-dA-8gqynV7g8WuVumcvM6foknX2zSdROn_O0EDSXBwmJhMjM6y_sNeBNjLYQ6gqLK_FP0PCjt5nkF9053QhqnpzXbdXUWF8eowX9qzufBHs2X_x4uzJnJZmwxaXq8z0wA5g8Z8WV4IyXZLgXD-YeUlI3Yp65JX2Gfev6d68wavz_75CC2MWxBdpdPI4IXAT
2024-04-19 09:36:37 UTC	696	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Fri, 19 Apr 2024 09:36:37 GMT Expires: Fri, 19 Apr 2024 09:36:37 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U;Path=/recaptcha;Expires=Wed, 16-Oct-2024 09:36:37 GMT;Secure;HttpOnly;Priority=HIGH;SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 09:36:37 UTC	559	IN	Data Raw: 32 33 61 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 35 6b 43 78 75 59 38 4b 43 42 50 66 47 4e 58 7a 6a 33 5f 44 76 62 41 63 79 55 31 4b 4d 36 4f 48 46 61 44 71 70 34 64 31 44 38 4e 67 75 2d 53 6c 70 58 44 64 55 69 73 7a 49 56 4d 41 37 65 72 71 30 6d 78 76 31 35 38 62 34 45 31 66 6a 51 4a 79 58 2d 4c 79 53 48 59 4c 64 68 4c 49 53 42 69 6e 4f 75 70 68 4d 77 4f 31 58 44 48 42 51 5a 6c 4b 6d 2d 77 62 51 78 52 71 36 78 30 6e 71 36 5a 6e 6f 66 76 6c 71 58 42 4d 78 4a 36 53 67 74 71 4c 32 71 6f 37 56 77 4a 34 33 43 46 4b 6e 32 30 61 51 69 6e 75 69 5a 31 72 71 49 49 54 68 59 59 46 4d 5a 6f 41 4b 47 4f 45 59 53 56 43 45 48 55 4d 39 55 39 38 61 6d 4a 5a 76 62 64 73 71 7a 7a 31 61 4a 69 5f 78 49 47 77 4d 4a 7a 5a 4b 59 51 37 38 72 30 Data Ascii: 23a)]}'["rresp","03AFcWeA5kCxuY8KCBPfGNXzj3_DvbAcyU1KM6OHFaDqp4d1D8Ngu-SlpXDdUiszIVMA7erq0mxv158b4E1fjQJyX-LySHYLdhLISBinOuphMwO1XDHBQZlKm-wbQxRq6x0nq6ZnofvlqXBMxJ6SgtqL2qo7VwJ43CFKn20aQinuiZ1rqIIThYYFMZoAKGOEYSVCEHUM9U98amJZvbdsqzz1aJi_xIGwMJzZKYQ78r0
2024-04-19 09:36:37 UTC	18	IN	Data Raw: 63 5a 30 50 33 63 55 45 53 35 6b 74 51 37 46 4e 0d 0a Data Ascii: cZ0P3cUES5ktQ7FN
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 61 34 34 0d 0a 56 39 38 31 77 63 4a 4f 47 4e 71 4f 69 4c 35 78 67 4f 6e 62 41 41 44 69 74 33 70 47 51 65 36 6d 74 33 62 54 73 4e 47 6e 51 74 78 79 7a 32 50 78 32 34 4c 6b 74 4c 78 53 30 38 61 70 4a 33 58 52 73 68 52 51 45 62 71 44 41 7a 33 6d 64 43 71 42 34 6b 70 44 4f 73 79 37 6a 7a 65 46 78 2d 36 63 4d 35 49 6b 33 58 6a 49 39 45 6d 7a 58 47 31 39 51 57 2d 4e 74 62 69 7a 6d 72 41 38 49 79 45 4e 4e 43 69 68 7a 42 53 36 4d 50 30 36 5a 34 6d 4a 66 51 48 5a 39 41 6f 72 6d 5a 70 44 5f 57 79 5f 37 67 34 31 36 6c 46 47 73 77 4f 76 53 41 37 7a 73 2d 51 31 52 33 65 6c 59 5f 41 6b 42 36 33 75 76 46 57 53 5a 45 36 68 4b 43 70 41 77 59 4d 63 5a 5f 5f 57 33 45 55 74 4f 36 4a 4c 6f 70 4a 73 6e 39 59 56 58 6f 39 66 61 5f 53 4a 61 31 42 36 68 6d 41 68 76 36 4b 64 33 4f Data Ascii: a44V981wcJOGNqOiL5xgOnbAADit3pGQe6mt3bTsNGnQtxyz2Px24LktLxS08apJ3XRshRQEbqDAz3mdCqB4kpDOsy7jzeFx-6cM5Ik3XjI9EmzXG19QW-NtbizmrA8IyENNCihzBS6MP06Z4mJfQHZ9AormZpD_Wy_7g416lFGswOvSA7zs-Q1R3elY_AkB63uvFWSZE6hKCpAwYMcZ__W3EUtO6JLopJsn9YVXo9fa_SJa1B6hmAhv6Kd3O
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 4d 47 5a 39 41 4a 77 6b 54 33 55 78 4c 56 54 6e 6b 2d 55 39 77 79 6b 6c 30 46 4a 57 6b 7a 38 49 6b 64 52 34 58 77 61 70 51 76 39 31 77 4c 77 4b 44 65 47 6a 7a 5a 7a 56 5a 38 31 65 71 65 33 61 38 48 47 74 70 30 51 64 68 57 4e 6f 43 51 69 33 52 43 4d 38 4b 57 6f 6d 38 51 74 78 45 4b 74 63 44 46 54 66 30 5f 44 59 5f 33 51 68 41 47 44 62 5a 50 56 58 42 69 74 5a 38 42 6f 45 39 48 6f 75 4d 76 68 54 6c 4f 66 51 47 50 63 6f 68 62 6b 6f 48 39 4c 57 33 52 7a 5f 75 4b 63 37 65 4c 52 41 35 37 72 42 38 35 65 4a 33 42 78 74 54 6e 59 4f 43 4c 4a 2d 34 31 5a 41 37 38 4e 33 34 49 62 39 33 6b 4e 47 72 38 76 59 69 6d 6a 47 76 43 79 51 77 4a 70 64 5f 56 30 77 4e 74 53 34 69 6f 37 6d 62 62 70 46 66 4c 58 54 5f 6a 67 57 73 43 6c 50 6b 6b 70 69 44 39 78 2d 47 6d 72 39 6f 30 59 Data Ascii: MGZ9AJwkT3UxLVTnk-U9wykl0FJWkz8IkdR4XwapQv91wLwKDeGjzZzVZ81eqe3a8HGtp0QdhWNoCQi3RCM8KWom8QtxEKtcDFTf0_DY_3QhAGDbZPVXBitZ8BoE9HouMvhTlOfQGPcohbkoH9LW3Rz_uKc7eLRA57rB85eJ3BxtTnYOCLJ-41ZA78N34Ib93kNGr8vYimjGvCyQwJpd_V0wNtS4io7mbbpFfLXT_jgWsClPkkpiD9x-Gmr9o0Y
2024-04-19 09:36:37 UTC	125	IN	Data Raw: 4b 43 51 39 33 73 52 66 6a 4e 6b 63 4b 37 6d 35 79 54 69 51 75 58 63 74 71 59 32 48 38 48 77 4b 4f 45 54 57 52 79 75 38 6e 38 50 6f 4c 35 78 6e 6d 77 73 49 79 42 41 73 4d 4c 64 56 6b 63 42 38 49 65 43 59 44 33 79 6b 76 72 41 5f 77 54 68 62 68 6f 63 51 6d 68 5a 71 5f 63 47 49 69 58 4a 59 61 71 32 44 72 4b 50 5a 5a 74 4f 69 43 42 49 58 6e 44 61 44 73 52 38 57 2d 74 61 0d 0a Data Ascii: KCQ93sRfjNkcK7m5yTiQuXctqY2H8HwKOETWRyu8n8PoL5xnmwsIyBAsMLdVkcB8IeCYD3ykvrA_wThbhocQmhZq_cGIiXJYaq2DrKPZZtOiCBIXnDaDsR8W-ta
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 31 35 38 33 0d 0a 59 5a 41 36 79 35 72 31 54 7a 5f 36 52 7a 33 6f 77 76 57 54 50 56 59 42 78 77 46 46 75 6b 70 69 4e 39 6d 55 2d 6e 52 6e 78 30 74 63 5f 66 61 5f 6a 64 62 59 6d 36 4f 51 69 62 75 37 42 70 35 39 49 49 30 6d 55 73 56 73 6f 79 30 74 61 57 4c 6b 36 41 38 57 48 32 59 62 4d 35 39 39 50 4e 44 30 57 52 31 31 4c 47 50 70 48 6d 70 37 39 72 42 79 76 36 72 42 48 69 48 64 61 75 49 4b 45 39 58 32 42 55 32 63 72 48 49 53 6a 6a 66 52 6c 6c 4e 45 54 6f 72 4f 43 75 39 4c 77 70 6a 4d 62 4a 39 5a 6a 5f 47 4f 73 51 38 45 59 62 79 53 38 39 2d 56 74 6e 4c 55 51 69 45 73 69 6c 65 76 39 6d 78 49 75 44 4f 49 4c 72 4b 41 59 2d 6b 58 34 55 68 55 66 34 73 2d 35 6a 72 4d 2d 31 4e 77 69 33 71 4d 50 69 63 32 2d 54 34 6e 79 57 63 31 30 64 7a 57 66 30 37 51 6c 76 75 54 46 Data Ascii: 1583YZA6y5r1Tz_6Rz3owvWTPVYBxwFFukpiN9mU-nRnx0tc_fa_jdbYm6OQibu7Bp59II0mUsVsoy0taWLk6A8WH2YbM599PND0WR11LGPpHmp79rByv6rBHiHdauIKE9X2BU2crHISjjfRllNETorOCu9LwpjMbJ9Zj_GOsQ8EYbyS89-VtnLUQiEsilev9mxIuDOILrKAY-kX4UhUf4s-5jrM-1Nwi3qMPic2-T4nyWc10dzWf07QlvuTF
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 52 30 39 51 6b 4a 47 79 63 34 76 52 2d 66 58 67 67 4e 6b 31 30 68 52 5a 6d 41 6b 59 79 42 54 65 59 4e 66 38 41 49 64 77 48 50 7a 4f 49 38 5a 7a 58 6f 6f 37 66 4b 4e 39 2d 6c 65 31 30 6a 66 2d 46 52 52 33 46 38 69 74 70 38 70 35 48 62 7a 44 70 74 44 49 69 51 2d 76 6d 50 50 49 34 54 66 45 75 39 65 6f 38 31 73 46 6f 61 59 6e 6e 49 56 42 6e 4b 67 64 79 49 49 4b 6b 6b 6d 4e 46 4e 52 39 67 56 6c 42 33 4e 35 71 54 39 68 50 62 73 4c 57 78 67 4e 53 6e 68 75 5a 4f 70 61 58 66 45 41 4a 45 57 6e 73 5a 4f 59 49 68 47 5a 64 33 42 32 50 4d 79 48 31 75 72 6f 6f 69 55 45 62 55 36 58 51 6d 67 32 6b 54 7a 76 46 67 54 6d 55 66 42 58 4d 59 4c 56 6d 63 70 68 39 35 4a 4f 43 48 68 5f 56 32 67 74 5f 4d 31 54 71 32 36 32 67 4f 76 78 7a 53 44 39 2d 6f 55 59 51 72 35 35 48 2d 31 48 Data Ascii: R09QkJGyc4vR-fXggNk10hRZmAkYyBTeYNf8AIdwHPzOI8ZzXoo7fKN9-le10jf-FRR3F8itp8p5HbzDptDIiQ-vmPPI4TfEu9eo81sFoaYnnIVBnKgdyIIKkkmNFNR9gVlB3N5qT9hPbsLWxgNSnhuZOpaXfEAJEWnsZOYIhGZd3B2PMyH1urooiUEbU6XQmg2kTzvFgTmUfBXMYLVmcph95JOCHh_V2gt_M1Tq262gOvxzSD9-oUYQr55H-1H
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 30 38 63 50 30 6b 73 46 36 33 43 4d 52 4a 4c 5f 39 52 63 54 78 46 49 54 56 4c 56 41 59 6c 68 61 4a 51 64 31 54 66 6b 30 75 4c 42 56 42 4a 69 42 56 75 43 31 56 59 51 45 4b 42 5f 44 61 30 34 48 73 39 53 73 6a 32 50 6d 37 70 62 6d 36 62 38 77 58 4a 6a 76 77 69 46 4d 32 57 37 62 44 37 50 6f 70 66 4b 55 30 37 6b 71 30 6a 43 52 32 54 79 6d 45 42 64 79 64 33 35 4d 55 39 73 50 4e 35 35 7a 4b 42 74 31 55 37 4d 67 69 65 4a 69 49 41 33 2d 50 38 6c 74 72 73 41 4c 63 4e 70 38 6a 55 77 6e 38 5f 34 53 51 41 47 6c 30 4c 30 52 38 53 5a 7a 33 75 36 34 56 62 7a 71 6c 39 6b 34 6b 69 46 54 77 56 33 34 74 77 53 53 54 6a 75 53 46 4c 4c 72 2d 34 62 58 79 45 78 50 50 37 75 76 66 6f 50 48 54 66 31 5a 63 76 2d 43 54 5a 53 71 65 68 56 46 56 49 6c 39 36 36 62 34 6c 70 62 42 48 59 49 Data Ascii: 08cP0ksF63CMRJL_9RcTxFITVLVAYlhaJQd1Tfk0uLBVBJiBVuC1VYQEKB_Da04Hs9Ssj2Pm7pbm6b8wXJjvwiFM2W7bD7PopfKU07kq0jCR2TymEBdyd35MU9sPN55zKBt1U7MgieJiIA3-P8ltrsALcNp8jUwn8_4SQAGl0L0R8SZz3u64Vbzql9k4kiFTwV34twSSTjuSFLLr-4bXyExPP7uvfoPHTf1Zcv-CTZSqehVFVIl966b4lpbBHYI
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 57 4e 4d 55 6d 6f 7a 4d 48 52 35 52 6b 31 68 51 6c 70 74 61 30 70 77 51 6a 56 4a 53 79 74 78 54 47 52 75 4d 45 46 7a 52 45 31 4d 5a 31 45 30 4b 31 55 79 64 30 5a 7a 61 56 6c 4f 61 57 4e 4c 4d 6c 5a 57 61 46 6c 74 56 32 68 35 65 6c 46 51 52 31 64 50 64 45 74 54 51 6a 56 51 61 58 63 31 56 48 67 33 51 31 42 49 4b 32 70 6c 56 30 68 31 63 30 55 35 4e 6c 51 32 63 6b 4a 5a 52 48 4e 4f 62 47 5a 6d 62 6b 56 68 63 47 51 32 4d 6b 52 31 4e 30 52 70 51 7a 56 34 4e 33 4a 6a 62 6c 6c 32 54 45 51 30 57 6d 6b 31 59 7a 46 6b 4d 58 59 34 64 46 42 7a 61 55 56 33 4d 44 68 32 55 57 55 7a 62 57 46 57 63 46 4e 70 57 54 55 72 59 33 64 73 56 30 52 57 64 54 4a 52 53 56 4e 6c 5a 47 35 6e 5a 54 4e 4e 53 6b 5a 44 54 6d 6c 7a 61 79 39 31 5a 6b 68 70 62 6b 68 31 4e 6e 4a 6c 54 57 38 33 Data Ascii: WNMUmozMHR5Rk1hQlpta0pwQjVJSytxTGRuMEFzRE1MZ1E0K1Uyd0ZzaVlOaWNLMlZWaFltV2h5elFQR1dPdEtTQjVQaXc1VHg3Q1BIK2plV0h1c0U5NlQ2ckJZRHNObGZmbkVhcGQ2MkR1N0RpQzV4N3Jjbll2TEQ0Wmk1YzFkMXY4dFBzaUV3MDh2UWUzbWFWcFNpWTUrY3dsV0RWdTJRSVNlZG5nZTNNSkZDTmlzay91Zkhpbkh1NnJlTW83

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49766	142.250.105.103	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:37 UTC	855	OUT	GET /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:37 UTC	518	IN	HTTP/1.1 405 HTTP method GET is not supported by this URL Content-Type: text/html; charset=UTF-8 Date: Fri, 19 Apr 2024 09:36:37 GMT Expires: Fri, 19 Apr 2024 09:36:37 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 09:36:37 UTC	244	IN	Data Raw: 65 65 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 21 2d 2d 20 47 53 45 20 44 65 66 61 75 6c 74 20 45 72 72 6f 72 20 2d 2d 3e 0a 3c 48 31 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 48 31 3e 0a 3c 48 32 3e 45 72 72 6f 72 20 34 30 35 3c 2f 48 32 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 0d 0a Data Ascii: ee<HTML><HEAD><TITLE>HTTP method GET is not supported by this URL</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000">... GSE Default Error --><H1>HTTP method GET is not supported by this URL</H1><H2>Error 405</H2></BODY></HTML>
2024-04-19 09:36:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49770	74.125.136.105	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:37 UTC	1445	OUT	GET /recaptcha/api2/payload?p=06AFcWeA407PX6KZPO_EZMp_NZbasNkhse1n9EzmIo2dBbRb4x9Gi9vRNiZyFRManWTdB3isufJ6LkOCy4Xga80NHHoKO85DUdTIlvj-_OeAbbdpD7MppuLHIJzJgBUQRn4GP9mi-KPxzCaEUkHF1v2lrTYZWJePF7qtkgN9glOLLs2BEZnXT9boVDHOf75I3XVsoLG0JYbXKc&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:37 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Fri, 19 Apr 2024 09:36:37 GMT Date: Fri, 19 Apr 2024 09:36:37 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 09:36:37 UTC	6	IN	Data Raw: 42 34 31 41 0d 0a Data Ascii: B41A
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 c2 01 c2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC!"$"$C"}!1AQa"q2
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 6e f5 7b a7 6c 7c c2 35 02 b5 ed 3e 0b 78 3a 1c 19 7e db 3f fb d2 e3 f9 57 a5 11 c5 2a ae 71 c1 aa 72 11 c3 37 c3 2f 05 d8 d9 4d 34 1a 38 32 c7 1b 32 b3 c8 cd 82 01 20 f3 5e 18 b8 24 81 8c d7 d5 37 d1 31 d3 ee 3e 53 8f 29 fb 7b 1a f9 5b 01 67 66 3d 89 e2 b9 ea 3b b3 48 5c ce d6 46 3e cd 9c 71 28 af ae 21 8a 24 89 0c 71 a2 7c a3 a2 81 da be 48 d6 39 54 76 3d 24 cd 7d 17 27 c4 df 02 db c1 1e ff 00 10 40 ec 11 41 11 a3 31 ce 3e 94 e9 bb 20 98 9f 19 33 ff 00 08 25 c3 7a 4d 1f f3 af 36 d0 5b 7f 83 b5 5c f6 b9 84 fe 86 ba 0f 1f fc 44 f0 af 88 7c 39 71 a4 69 57 57 13 5c b3 2b ae e8 4a ae 01 c9 e4 d7 37 e1 fc ff 00 c2 21 ac 28 c7 13 40 7f 9d 67 53 57 f7 15 07 a1 a3 61 35 b4 7a 6b ae 0f 9c dd 0f 60 2b b8 f8 7c ca de 1b 24 76 73 5e 6d 68 47 96 47 b5 7a 37 c3 7c 1f Data Ascii: n{l\|5>x:~?W*qr7/M4822 ^$71>S){[gf=;H\F>q(!$q\|H9Tv=$}'@A1> 3%zM6[\D\|9qiWW\+J7!(@gSWa5zk`+\|$vs^mhGGz7\|
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: cf fe 3e 29 4a c9 6c 07 01 a7 7c 2b f1 86 a3 6f 06 a5 a8 f8 a6 37 89 91 66 d8 f3 4b 23 11 8c e3 9e 2b 8c 94 0f 3e 41 9c 28 72 33 f8 d7 d3 1a 07 cf e1 7b 1f 7b 24 ff 00 d0 2b e6 4b c4 cd dc cb 9e 04 ad fc eb 3a aa d2 b2 34 81 47 57 50 6d b2 70 7e 6a f7 4d 2b e0 d7 81 be c7 6f 3c d6 d7 d7 0d 24 4a ed be e8 80 49 00 ff 00 0e 2b c3 35 35 ff 00 43 39 fe f5 7d 63 a2 b1 6d 16 c1 bd 6d a3 3f f8 e0 a7 47 44 d8 a7 73 c0 87 87 f4 8b 3b ef 1c c5 6f 64 8b fd 97 2c 49 68 72 49 8d 59 b9 19 ef f8 d4 fa 10 ff 00 8a 5b 5b 51 ff 00 4c 1b ff 00 1e ab f7 bc 78 87 e2 5c 7d c9 81 87 e6 2a 86 81 ff 00 22 f6 b6 bf f4 c2 13 ff 00 8f 56 75 7a 7c 8a 83 f7 48 6d 89 d9 c9 ed 5e 8f f0 c4 ff 00 c5 3f 2a fa 48 6b cd 2d b9 8a bd 1b e1 63 67 43 9c 1e d2 1a 55 7e 11 c4 b7 ab e3 79 ae 6a f0 Data Ascii: >)Jl\|+o7fK#+>A(r3{{$+K:4GWPmp~jM+o<$JI+55C9}cmm?GDs;od,IhrIY[[QLx\}"Vuz\|Hm^?Hk-cgCU~yj
2024-04-19 09:36:37 UTC	333	IN	Data Raw: cc de f0 c4 d7 55 ac 26 e0 dd 2b 97 bb 46 0c 73 59 c0 96 65 4c 37 74 aa 6e 08 e0 8e 71 5a 0f 19 ed 55 26 43 d4 8a d9 31 15 5c 64 81 d3 8a 8d 81 06 9f 27 de ff 00 eb 52 37 23 be 6a 86 c6 11 db 8a 4f ad 3b 03 a1 a6 73 bb 22 81 0c 6e 08 e0 d0 51 ca 99 02 12 8a 40 2d e8 4d 39 81 a6 9f 4a a0 39 19 ff 00 e3 f6 41 ff 00 4d 0f f3 ad 6b 66 3b 40 24 62 b2 ae f8 d4 25 c7 fc f4 3d 7e b5 a5 6e 7f 76 a4 f6 f5 a2 23 96 85 b6 ea 07 f2 a1 47 38 34 d0 70 33 db d2 94 12 df 95 51 04 a0 9c e3 3d a9 ca 78 c6 06 08 ea 6a 05 39 3d 7a 1a 78 26 98 89 88 db 80 c2 9c 07 bd 31 5f 72 85 6c 7b 53 99 71 c8 e6 80 b9 22 0c b7 3c d2 16 f9 a9 bb 8a 2f 1d e9 a1 c0 e0 fe 35 36 02 4f a9 eb 52 29 15 0e 72 41 c9 cd 3c 12 0f 7a 07 72 60 48 00 56 2f 8b c1 fb 02 9e 31 bc 56 c2 9e 46 2b 23 c5 84 9d Data Ascii: U&+FsYeL7tnqZU&C1\d'R7#jO;s"nQ@-M9J9AMkf;@$b%=~nv#G84p3Q=xj9=zx&1_rl{Sq"</56OR)rA<zr`HV/1VF+#
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 8c 7a d0 29 7a d2 01 be f4 62 97 1c d2 91 40 c6 91 46 3b 53 b1 9a a1 e2 2d 6b 4b f0 ee 95 2e a9 ab dd 2d bd bc 7f 8b 39 ec aa 3b 93 e9 4b 61 96 ee 67 b7 b3 b5 92 ea ee 78 e0 b7 89 77 49 24 8d b5 54 7a 93 5e 09 f1 23 e2 5e a1 e2 ab 99 34 0f 0a 09 60 d3 89 db 2d c7 2a f3 8f fd 95 3f 53 fa 56 77 8a 3c 4d e2 2f 8a 1a b0 b1 b2 8a 5b 4d 1d 64 c4 70 27 25 8f 62 df de 6f 6e 82 bd 67 e1 c7 c3 bb 0f 0e db c7 3d d4 49 2d df 50 a7 90 a7 d4 fa 9f d0 52 b7 36 af 62 92 ea ce 5f e1 6f c2 b8 ad a3 8f 52 d6 a3 3f 30 0c b1 30 c3 3f fb de 83 db a9 ef 5d af 8f 3c 65 a2 78 22 d4 49 75 b5 a7 68 40 b5 b2 8b 01 9f 04 ff 00 df 2b ef 58 ff 00 14 fe 27 d9 f8 68 b6 93 a3 84 bf d6 db e5 d8 bf 32 40 4f f7 b1 d5 bf d9 fc eb 87 d2 3e 1d 6a ba b6 9f a9 f8 af c6 77 13 b5 e3 da 49 3c 31 33 Data Ascii: z)zb@F;S-kK.-9;KagxwI$Tz^#^4`-*?SVw<M/[Mdp'%bong=I-PR6b_oR?00?]<ex"Iuh@+X'h2@O>jwI<13
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 2f a7 85 85 23 f3 95 3e 79 88 c0 51 df 1e 83 de bc f3 e2 17 c4 cb dd 57 50 3e 16 f0 0a bd cd cc 87 cb 96 f6 31 9f 62 23 f6 ff 00 6b f2 ac 1f 1a 78 f3 54 f8 85 ad c3 e1 6f 0f 3b 58 69 77 33 08 7c c7 f9 5a 73 fe d7 a2 f1 f7 7f 3a f5 9f 87 de 06 d2 3c 1d 62 23 b4 41 35 eb 8f df 5c b8 f9 98 fa 0f 41 42 f7 b5 7b 07 a9 e6 bf 02 3c 2f 6f 07 8c b5 e8 75 ab 64 b8 d4 74 b6 40 19 ce f0 1c 96 dc 7d fa 0a f5 df 12 82 fa 4d f2 7f 7a ca 61 ff 00 8e d7 11 f0 ff 00 f7 7f 19 fc 75 17 f7 bc b7 fd 7f fa f5 de 6b 40 9b 49 c0 ef 6f 28 ff 00 c7 68 9e b4 d7 a0 5e e7 1d f0 05 f7 7c 2e d3 81 fe 17 94 7f e3 e6 8f 8f ab bb e1 76 a2 7f bb 2c 07 ff 00 22 0f f1 a8 7f 67 b6 cf c3 48 17 ba 5c cc a7 fe fb 35 77 e3 9a 6f f8 59 ac 0f ee 88 9b f2 95 69 d5 df ee 03 a5 f0 e3 6f f0 e6 98 fe b6 Data Ascii: /#>yQWP>1b#kxTo;Xiw3\|Zs:<b#A5\AB{</oudt@}Mzauk@Io(h^\|.v,"gH\5woYio
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 80 b9 d4 a6 ff 00 ae 7f d6 bb 68 c1 0d 50 69 2d c9 b2 7d 68 a5 c5 14 ae 2b 9e d0 7f e3 eb d3 2b 52 fd 05 46 df f1 f2 bc 75 53 52 57 4a 39 43 f1 a2 81 40 19 a6 30 1d 33 4e 55 c9 a5 00 00 49 c0 00 64 93 c6 05 78 df c5 4f 89 b2 5c 49 2f 86 bc 1b 2b 3c cd 94 b8 be 8c f4 1d d6 33 fc db f2 f5 a8 94 ac 34 ae cd 3f 8a ff 00 14 62 d1 19 f4 2f 0d 94 ba d6 1b e4 79 54 6e 4b 73 e8 3f bc de dd 07 7f 4a e5 7e 19 7c 37 bd d6 af bf b7 75 f9 24 7d ef bd a4 90 ee 66 6e f8 cf 53 ef d0 56 bf c2 6f 85 eb 1a a6 af ad 21 25 fe 60 ad d5 ff 00 c0 7b f5 35 df 78 ff 00 c6 9a 2f 81 f4 a5 6b 8d 8f 72 57 16 d6 51 90 19 bd 3f dd 5f 7a 34 8e ac ab 72 97 75 cd 5b 41 f0 57 87 8d cd db a5 ad a4 43 11 46 bc bc ad e8 07 52 7d eb c7 02 78 a7 e3 26 b6 b2 4b bf 4d f0 e5 bb fc a9 fc 3f 5f f6 9b Data Ascii: hPi-}h++RFuSRWJ9C@03NUIdxO\I/+<34?b/yTnKs?J~\|7u$}fnSVo!%`{5x/krWQ?_z4ru[AWCFR}x&KM?_
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 8f a7 f5 7f da c3 5a 90 91 a4 78 42 ce 11 d9 ae 2e 5a 43 f9 28 1f ce b9 cb bf da 3f e2 4e a9 ba d5 64 d2 74 f4 97 e5 26 de d4 97 00 f1 c1 66 38 fc ab e7 d9 75 a8 c7 02 4b 83 ef bd 47 f2 15 b7 e0 e9 fe db ba 7c 33 6d 97 1f 33 6e 3d a8 69 bd c1 5a e3 a2 72 2f 67 de 49 26 46 dc 7d 4e 6b ab b1 05 a1 4f a5 72 32 8d ba 95 c8 f4 95 bf 9d 77 5e 18 b8 d3 a3 68 8e a7 6d 34 f6 fb 40 61 0c 9b 1c 74 e4 12 08 ad 60 ec 89 99 b3 e1 cd 13 58 d4 84 97 1a 5d a3 cd f6 5f 9a 46 5e 02 81 cf 24 d5 9d 53 5c ba b8 b6 36 af 1a 23 2e 43 1c 73 53 eb 3e 23 8a 08 7e c5 e1 a7 96 cb 4c 27 3b 77 1f 32 43 eb 21 1f 78 fe 95 ce cc c6 56 f3 59 b0 c4 64 8f 5a d6 9d 59 6f d0 c6 70 4c 50 01 6c 91 d0 75 a6 91 fb cd d8 e6 95 18 94 cd 26 e5 2d d2 b4 e6 4c 9e 56 89 15 70 33 43 9c 9e d4 d2 ec 17 8e Data Ascii: ZxB.ZC(?Ndt&f8uKG\|3m3n=iZr/gI&F}NkOr2w^hm4@at`X]_F^$S\6#.CsS>#~L';w2C!xVYdZYopLPlu&-LVp3C
2024-04-19 09:36:37 UTC	1255	IN	Data Raw: 33 6f fe a3 40 d3 23 c7 4d b6 cb fe 15 72 57 7a 88 f1 2f 87 bf 15 6d 3c 2d a0 49 a5 ae 91 71 7c e6 e6 49 95 84 a1 06 18 83 8c 60 d5 7f 14 78 80 f8 a3 51 fe da 36 2d 64 66 40 3c a6 7d c4 6d e3 ae 05 7d 07 16 9f a7 c4 3f 75 61 68 83 fd 98 54 7f 4a f2 3f 8d 51 2c 7e 28 81 91 15 43 5a 2f 00 60 70 48 ac eb 6c 8b 83 57 38 65 1c d6 bf 84 f5 ef 1f 69 f6 13 58 f8 57 4b 37 56 a2 76 66 90 5a f9 98 73 d4 67 38 ac a1 d4 7a e6 bd 3f e0 73 9f ec 6d 4e 3c fd db bc fe 6a 2b 3a 2a f3 2e a7 c2 71 1a 95 b7 c5 ad 6b 54 b2 d4 ae b4 a9 16 ea c5 89 b6 93 c8 8e 3f 2c 9e bf 5f c6 a9 e8 26 68 bc 65 64 2e 46 27 5d 40 09 07 a3 64 e7 f5 af a0 49 c1 fa 57 81 df 7e e7 e2 14 9f ec 6a a0 ff 00 e3 f5 75 95 92 26 8b dc 9f c6 01 53 4d d5 47 43 1d c3 63 f0 7a e1 7e 29 c3 34 f3 4a 60 8d 9e 43 Data Ascii: 3o@#MrWz/m<-Iq\|I`xQ6-df@<}m}?uahTJ?Q,~(CZ/`pHlW8eiXWK7VvfZsg8z?smN<j+:*.qkT?,_&hed.F']@dIW~ju&SMGCcz~)4J`C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49776	142.250.105.103	443	4888	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:36:38 UTC	1065	OUT	GET /recaptcha/api2/payload?p=06AFcWeA407PX6KZPO_EZMp_NZbasNkhse1n9EzmIo2dBbRb4x9Gi9vRNiZyFRManWTdB3isufJ6LkOCy4Xga80NHHoKO85DUdTIlvj-_OeAbbdpD7MppuLHIJzJgBUQRn4GP9mi-KPxzCaEUkHF1v2lrTYZWJePF7qtkgN9glOLLs2BEZnXT9boVDHOf75I3XVsoLG0JYbXKc&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
2024-04-19 09:36:38 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Fri, 19 Apr 2024 09:36:38 GMT Date: Fri, 19 Apr 2024 09:36:38 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 09:36:38 UTC	6	IN	Data Raw: 42 34 31 41 0d 0a Data Ascii: B41A
2024-04-19 09:36:38 UTC	1255	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 c2 01 c2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC!"$"$C"}!1AQa"q2
2024-04-19 09:36:38 UTC	1255	IN	Data Raw: 6e f5 7b a7 6c 7c c2 35 02 b5 ed 3e 0b 78 3a 1c 19 7e db 3f fb d2 e3 f9 57 a5 11 c5 2a ae 71 c1 aa 72 11 c3 37 c3 2f 05 d8 d9 4d 34 1a 38 32 c7 1b 32 b3 c8 cd 82 01 20 f3 5e 18 b8 24 81 8c d7 d5 37 d1 31 d3 ee 3e 53 8f 29 fb 7b 1a f9 5b 01 67 66 3d 89 e2 b9 ea 3b b3 48 5c ce d6 46 3e cd 9c 71 28 af ae 21 8a 24 89 0c 71 a2 7c a3 a2 81 da be 48 d6 39 54 76 3d 24 cd 7d 17 27 c4 df 02 db c1 1e ff 00 10 40 ec 11 41 11 a3 31 ce 3e 94 e9 bb 20 98 9f 19 33 ff 00 08 25 c3 7a 4d 1f f3 af 36 d0 5b 7f 83 b5 5c f6 b9 84 fe 86 ba 0f 1f fc 44 f0 af 88 7c 39 71 a4 69 57 57 13 5c b3 2b ae e8 4a ae 01 c9 e4 d7 37 e1 fc ff 00 c2 21 ac 28 c7 13 40 7f 9d 67 53 57 f7 15 07 a1 a3 61 35 b4 7a 6b ae 0f 9c dd 0f 60 2b b8 f8 7c ca de 1b 24 76 73 5e 6d 68 47 96 47 b5 7a 37 c3 7c 1f Data Ascii: n{l\|5>x:~?W*qr7/M4822 ^$71>S){[gf=;H\F>q(!$q\|H9Tv=$}'@A1> 3%zM6[\D\|9qiWW\+J7!(@gSWa5zk`+\|$vs^mhGGz7\|
2024-04-19 09:36:38 UTC	1255	IN	Data Raw: cf fe 3e 29 4a c9 6c 07 01 a7 7c 2b f1 86 a3 6f 06 a5 a8 f8 a6 37 89 91 66 d8 f3 4b 23 11 8c e3 9e 2b 8c 94 0f 3e 41 9c 28 72 33 f8 d7 d3 1a 07 cf e1 7b 1f 7b 24 ff 00 d0 2b e6 4b c4 cd dc cb 9e 04 ad fc eb 3a aa d2 b2 34 81 47 57 50 6d b2 70 7e 6a f7 4d 2b e0 d7 81 be c7 6f 3c d6 d7 d7 0d 24 4a ed be e8 80 49 00 ff 00 0e 2b c3 35 35 ff 00 43 39 fe f5 7d 63 a2 b1 6d 16 c1 bd 6d a3 3f f8 e0 a7 47 44 d8 a7 73 c0 87 87 f4 8b 3b ef 1c c5 6f 64 8b fd 97 2c 49 68 72 49 8d 59 b9 19 ef f8 d4 fa 10 ff 00 8a 5b 5b 51 ff 00 4c 1b ff 00 1e ab f7 bc 78 87 e2 5c 7d c9 81 87 e6 2a 86 81 ff 00 22 f6 b6 bf f4 c2 13 ff 00 8f 56 75 7a 7c 8a 83 f7 48 6d 89 d9 c9 ed 5e 8f f0 c4 ff 00 c5 3f 2a fa 48 6b cd 2d b9 8a bd 1b e1 63 67 43 9c 1e d2 1a 55 7e 11 c4 b7 ab e3 79 ae 6a f0 Data Ascii: >)Jl\|+o7fK#+>A(r3{{$+K:4GWPmp~jM+o<$JI+55C9}cmm?GDs;od,IhrIY[[QLx\}"Vuz\|Hm^?Hk-cgCU~yj
2024-04-19 09:36:38 UTC	333	IN	Data Raw: cc de f0 c4 d7 55 ac 26 e0 dd 2b 97 bb 46 0c 73 59 c0 96 65 4c 37 74 aa 6e 08 e0 8e 71 5a 0f 19 ed 55 26 43 d4 8a d9 31 15 5c 64 81 d3 8a 8d 81 06 9f 27 de ff 00 eb 52 37 23 be 6a 86 c6 11 db 8a 4f ad 3b 03 a1 a6 73 bb 22 81 0c 6e 08 e0 d0 51 ca 99 02 12 8a 40 2d e8 4d 39 81 a6 9f 4a a0 39 19 ff 00 e3 f6 41 ff 00 4d 0f f3 ad 6b 66 3b 40 24 62 b2 ae f8 d4 25 c7 fc f4 3d 7e b5 a5 6e 7f 76 a4 f6 f5 a2 23 96 85 b6 ea 07 f2 a1 47 38 34 d0 70 33 db d2 94 12 df 95 51 04 a0 9c e3 3d a9 ca 78 c6 06 08 ea 6a 05 39 3d 7a 1a 78 26 98 89 88 db 80 c2 9c 07 bd 31 5f 72 85 6c 7b 53 99 71 c8 e6 80 b9 22 0c b7 3c d2 16 f9 a9 bb 8a 2f 1d e9 a1 c0 e0 fe 35 36 02 4f a9 eb 52 29 15 0e 72 41 c9 cd 3c 12 0f 7a 07 72 60 48 00 56 2f 8b c1 fb 02 9e 31 bc 56 c2 9e 46 2b 23 c5 84 9d Data Ascii: U&+FsYeL7tnqZU&C1\d'R7#jO;s"nQ@-M9J9AMkf;@$b%=~nv#G84p3Q=xj9=zx&1_rl{Sq"</56OR)rA<zr`HV/1VF+#
2024-04-19 09:36:38 UTC	1255	IN	Data Raw: 8c 7a d0 29 7a d2 01 be f4 62 97 1c d2 91 40 c6 91 46 3b 53 b1 9a a1 e2 2d 6b 4b f0 ee 95 2e a9 ab dd 2d bd bc 7f 8b 39 ec aa 3b 93 e9 4b 61 96 ee 67 b7 b3 b5 92 ea ee 78 e0 b7 89 77 49 24 8d b5 54 7a 93 5e 09 f1 23 e2 5e a1 e2 ab 99 34 0f 0a 09 60 d3 89 db 2d c7 2a f3 8f fd 95 3f 53 fa 56 77 8a 3c 4d e2 2f 8a 1a b0 b1 b2 8a 5b 4d 1d 64 c4 70 27 25 8f 62 df de 6f 6e 82 bd 67 e1 c7 c3 bb 0f 0e db c7 3d d4 49 2d df 50 a7 90 a7 d4 fa 9f d0 52 b7 36 af 62 92 ea ce 5f e1 6f c2 b8 ad a3 8f 52 d6 a3 3f 30 0c b1 30 c3 3f fb de 83 db a9 ef 5d af 8f 3c 65 a2 78 22 d4 49 75 b5 a7 68 40 b5 b2 8b 01 9f 04 ff 00 df 2b ef 58 ff 00 14 fe 27 d9 f8 68 b6 93 a3 84 bf d6 db e5 d8 bf 32 40 4f f7 b1 d5 bf d9 fc eb 87 d2 3e 1d 6a ba b6 9f a9 f8 af c6 77 13 b5 e3 da 49 3c 31 33 Data Ascii: z)zb@F;S-kK.-9;KagxwI$Tz^#^4`-*?SVw<M/[Mdp'%bong=I-PR6b_oR?00?]<ex"Iuh@+X'h2@O>jwI<13
2024-04-19 09:36:38 UTC	1255	IN	Data Raw: 2f a7 85 85 23 f3 95 3e 79 88 c0 51 df 1e 83 de bc f3 e2 17 c4 cb dd 57 50 3e 16 f0 0a bd cd cc 87 cb 96 f6 31 9f 62 23 f6 ff 00 6b f2 ac 1f 1a 78 f3 54 f8 85 ad c3 e1 6f 0f 3b 58 69 77 33 08 7c c7 f9 5a 73 fe d7 a2 f1 f7 7f 3a f5 9f 87 de 06 d2 3c 1d 62 23 b4 41 35 eb 8f df 5c b8 f9 98 fa 0f 41 42 f7 b5 7b 07 a9 e6 bf 02 3c 2f 6f 07 8c b5 e8 75 ab 64 b8 d4 74 b6 40 19 ce f0 1c 96 dc 7d fa 0a f5 df 12 82 fa 4d f2 7f 7a ca 61 ff 00 8e d7 11 f0 ff 00 f7 7f 19 fc 75 17 f7 bc b7 fd 7f fa f5 de 6b 40 9b 49 c0 ef 6f 28 ff 00 c7 68 9e b4 d7 a0 5e e7 1d f0 05 f7 7c 2e d3 81 fe 17 94 7f e3 e6 8f 8f ab bb e1 76 a2 7f bb 2c 07 ff 00 22 0f f1 a8 7f 67 b6 cf c3 48 17 ba 5c cc a7 fe fb 35 77 e3 9a 6f f8 59 ac 0f ee 88 9b f2 95 69 d5 df ee 03 a5 f0 e3 6f f0 e6 98 fe b6 Data Ascii: /#>yQWP>1b#kxTo;Xiw3\|Zs:<b#A5\AB{</oudt@}Mzauk@Io(h^\|.v,"gH\5woYio
2024-04-19 09:36:38 UTC	1255	IN	Data Raw: 80 b9 d4 a6 ff 00 ae 7f d6 bb 68 c1 0d 50 69 2d c9 b2 7d 68 a5 c5 14 ae 2b 9e d0 7f e3 eb d3 2b 52 fd 05 46 df f1 f2 bc 75 53 52 57 4a 39 43 f1 a2 81 40 19 a6 30 1d 33 4e 55 c9 a5 00 00 49 c0 00 64 93 c6 05 78 df c5 4f 89 b2 5c 49 2f 86 bc 1b 2b 3c cd 94 b8 be 8c f4 1d d6 33 fc db f2 f5 a8 94 ac 34 ae cd 3f 8a ff 00 14 62 d1 19 f4 2f 0d 94 ba d6 1b e4 79 54 6e 4b 73 e8 3f bc de dd 07 7f 4a e5 7e 19 7c 37 bd d6 af bf b7 75 f9 24 7d ef bd a4 90 ee 66 6e f8 cf 53 ef d0 56 bf c2 6f 85 eb 1a a6 af ad 21 25 fe 60 ad d5 ff 00 c0 7b f5 35 df 78 ff 00 c6 9a 2f 81 f4 a5 6b 8d 8f 72 57 16 d6 51 90 19 bd 3f dd 5f 7a 34 8e ac ab 72 97 75 cd 5b 41 f0 57 87 8d cd db a5 ad a4 43 11 46 bc bc ad e8 07 52 7d eb c7 02 78 a7 e3 26 b6 b2 4b bf 4d f0 e5 bb fc a9 fc 3f 5f f6 9b Data Ascii: hPi-}h++RFuSRWJ9C@03NUIdxO\I/+<34?b/yTnKs?J~\|7u$}fnSVo!%`{5x/krWQ?_z4ru[AWCFR}x&KM?_
2024-04-19 09:36:38 UTC	1255	IN	Data Raw: 8f a7 f5 7f da c3 5a 90 91 a4 78 42 ce 11 d9 ae 2e 5a 43 f9 28 1f ce b9 cb bf da 3f e2 4e a9 ba d5 64 d2 74 f4 97 e5 26 de d4 97 00 f1 c1 66 38 fc ab e7 d9 75 a8 c7 02 4b 83 ef bd 47 f2 15 b7 e0 e9 fe db ba 7c 33 6d 97 1f 33 6e 3d a8 69 bd c1 5a e3 a2 72 2f 67 de 49 26 46 dc 7d 4e 6b ab b1 05 a1 4f a5 72 32 8d ba 95 c8 f4 95 bf 9d 77 5e 18 b8 d3 a3 68 8e a7 6d 34 f6 fb 40 61 0c 9b 1c 74 e4 12 08 ad 60 ec 89 99 b3 e1 cd 13 58 d4 84 97 1a 5d a3 cd f6 5f 9a 46 5e 02 81 cf 24 d5 9d 53 5c ba b8 b6 36 af 1a 23 2e 43 1c 73 53 eb 3e 23 8a 08 7e c5 e1 a7 96 cb 4c 27 3b 77 1f 32 43 eb 21 1f 78 fe 95 ce cc c6 56 f3 59 b0 c4 64 8f 5a d6 9d 59 6f d0 c6 70 4c 50 01 6c 91 d0 75 a6 91 fb cd d8 e6 95 18 94 cd 26 e5 2d d2 b4 e6 4c 9e 56 89 15 70 33 43 9c 9e d4 d2 ec 17 8e Data Ascii: ZxB.ZC(?Ndt&f8uKG\|3m3n=iZr/gI&F}NkOr2w^hm4@at`X]_F^$S\6#.CsS>#~L';w2C!xVYdZYopLPlu&-LVp3C
2024-04-19 09:36:38 UTC	1255	IN	Data Raw: 33 6f fe a3 40 d3 23 c7 4d b6 cb fe 15 72 57 7a 88 f1 2f 87 bf 15 6d 3c 2d a0 49 a5 ae 91 71 7c e6 e6 49 95 84 a1 06 18 83 8c 60 d5 7f 14 78 80 f8 a3 51 fe da 36 2d 64 66 40 3c a6 7d c4 6d e3 ae 05 7d 07 16 9f a7 c4 3f 75 61 68 83 fd 98 54 7f 4a f2 3f 8d 51 2c 7e 28 81 91 15 43 5a 2f 00 60 70 48 ac eb 6c 8b 83 57 38 65 1c d6 bf 84 f5 ef 1f 69 f6 13 58 f8 57 4b 37 56 a2 76 66 90 5a f9 98 73 d4 67 38 ac a1 d4 7a e6 bd 3f e0 73 9f ec 6d 4e 3c fd db bc fe 6a 2b 3a 2a f3 2e a7 c2 71 1a 95 b7 c5 ad 6b 54 b2 d4 ae b4 a9 16 ea c5 89 b6 93 c8 8e 3f 2c 9e bf 5f c6 a9 e8 26 68 bc 65 64 2e 46 27 5d 40 09 07 a3 64 e7 f5 af a0 49 c1 fa 57 81 df 7e e7 e2 14 9f ec 6a a0 ff 00 e3 f5 75 95 92 26 8b dc 9f c6 01 53 4d d5 47 43 1d c3 63 f0 7a e1 7e 29 c3 34 f3 4a 60 8d 9e 43 Data Ascii: 3o@#MrWz/m<-Iq\|I`xQ6-df@<}m}?uahTJ?Q,~(CZ/`pHlW8eiXWK7VvfZsg8z?smN<j+:*.qkT?,_&hed.F']@dIW~ju&SMGCcz~)4J`C

Target ID:	0
Start time:	11:35:58
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:36:02
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=2012,i,13379061869876988813,15450211964942131721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:36:05
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884