Edit tour

Windows Analysis Report
https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884

Overview

General Information

Sample URL:	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884
Analysis ID:	1428746
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish9

Yara detected Phisher

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5500 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2260,i,16925381806868203602,13959119368343850401,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_68	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security
dropped/chromecache_68	JoeSecurity_HtmlPhish_9	Yara detected HtmlPhish_9	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish9

Source: Yara match

File source: dropped/chromecache_68, type: DROPPED

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_68, type: DROPPED

Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=yXfhXW7z1TctwEQdQ8yPo0M-H5o67uKvSJ8NeCDJiu4yhWoKen9BBYaZMjt9u2Kaf65D-qrmRos8lbjWmlsQtdnJ-GHFAcvtOnTkycSU9JrONLLhlTP4JBxNIA-ER1K4eSRFggiZPox_q0ldouNjT1TJ0sSFtsvSm6dhxx0J0C0B9iSgxyE5Kf6n8ZB65xW9uYFtNBfp9m1vNd47_QEvNU9S2LWFc9vsQFPCeddhX_9bkkDC7QvuzFsCg1QYTzSNOugmIR2-HK67HAthHcKgZxMo7CG1icU&cb=zi39nrm9z11q	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=yXfhXW7z1TctwEQdQ8yPo0M-H5o67uKvSJ8NeCDJiu4yhWoKen9BBYaZMjt9u2Kaf65D-qrmRos8lbjWmlsQtdnJ-GHFAcvtOnTkycSU9JrONLLhlTP4JBxNIA-ER1K4eSRFggiZPox_q0ldouNjT1TJ0sSFtsvSm6dhxx0J0C0B9iSgxyE5Kf6n8ZB65xW9uYFtNBfp9m1vNd47_QEvNU9S2LWFc9vsQFPCeddhX_9bkkDC7QvuzFsCg1QYTzSNOugmIR2-HK67HAthHcKgZxMo7CG1icU&cb=zi39nrm9z11q	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49737 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49718 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49737 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=yXfhXW7z1TctwEQdQ8yPo0M-H5o67uKvSJ8NeCDJiu4yhWoKen9BBYaZMjt9u2Kaf65D-qrmRos8lbjWmlsQtdnJ-GHFAcvtOnTkycSU9JrONLLhlTP4JBxNIA-ER1K4eSRFggiZPox_q0ldouNjT1TJ0sSFtsvSm6dhxx0J0C0B9iSgxyE5Kf6n8ZB65xW9uYFtNBfp9m1vNd47_QEvNU9S2LWFc9vsQFPCeddhX_9bkkDC7QvuzFsCg1QYTzSNOugmIR2-HK67HAthHcKgZxMo7CG1icU&cb=zi39nrm9z11q HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
Source: global traffic	HTTP traffic detected: GET /js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=yXfhXW7z1TctwEQdQ8yPo0M-H5o67uKvSJ8NeCDJiu4yhWoKen9BBYaZMjt9u2Kaf65D-qrmRos8lbjWmlsQtdnJ-GHFAcvtOnTkycSU9JrONLLhlTP4JBxNIA-ER1K4eSRFggiZPox_q0ldouNjT1TJ0sSFtsvSm6dhxx0J0C0B9iSgxyE5Kf6n8ZB65xW9uYFtNBfp9m1vNd47_QEvNU9S2LWFc9vsQFPCeddhX_9bkkDC7QvuzFsCg1QYTzSNOugmIR2-HK67HAthHcKgZxMo7CG1icU&cb=zi39nrm9z11qAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm- HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=yXfhXW7z1TctwEQdQ8yPo0M-H5o67uKvSJ8NeCDJiu4yhWoKen9BBYaZMjt9u2Kaf65D-qrmRos8lbjWmlsQtdnJ-GHFAcvtOnTkycSU9JrONLLhlTP4JBxNIA-ER1K4eSRFggiZPox_q0ldouNjT1TJ0sSFtsvSm6dhxx0J0C0B9iSgxyE5Kf6n8ZB65xW9uYFtNBfp9m1vNd47_QEvNU9S2LWFc9vsQFPCeddhX_9bkkDC7QvuzFsCg1QYTzSNOugmIR2-HK67HAthHcKgZxMo7CG1icU&cb=zi39nrm9z11qAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaiDvZiMdbo1yJv8Mv__UwW8paAFf-LZaGJ3my55xJbxgh3fc03p3tnaoy4fZ-qgaGbwCXtJOEiMU52z2Yg; AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA5iV1k7FM9SM7_t9xIbwi9UgqdvXSXbhooYk-Hd9rLYhYsqcg0ZTFPEiEzKRKfYXz1G4M95wVmJUCc057g9RKdPqpYfE_dVRdrkPzBnxn-Q34G6PulDowhZhFY4BuJ7gTQwK8QnCX3G_xfLFqmmd6z2gFUE9snjTtbaKF-JKgZIj5_mxDpwTV6vkJ8YYLFnfxxBKrBs&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaiDvZiMdbo1yJv8Mv__UwW8paAFf-LZaGJ3my55xJbxgh3fc03p3tnaoy4fZ-qgaGbwCXtJOEiMU52z2Yg; AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA5iV1k7FM9SM7_t9xIbwi9UgqdvXSXbhooYk-Hd9rLYhYsqcg0ZTFPEiEzKRKfYXz1G4M95wVmJUCc057g9RKdPqpYfE_dVRdrkPzBnxn-Q34G6PulDowhZhFY4BuJ7gTQwK8QnCX3G_xfLFqmmd6z2gFUE9snjTtbaKF-JKgZIj5_mxDpwTV6vkJ8YYLFnfxxBKrBs&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaiDvZiMdbo1yJv8Mv__UwW8paAFf-LZaGJ3my55xJbxgh3fc03p3tnaoy4fZ-qgaGbwCXtJOEiMU52z2Yg; AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713531181035&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: chromecache_86.1.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_86.1.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_86.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_86.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_86.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_86.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_86.1.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_86.1.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_86.1.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_86.1.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_86.1.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_68.1.dr	String found in binary or memory: https://www.google.com/
Source: chromecache_86.1.dr, chromecache_72.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_86.1.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__.
Source: chromecache_72.1.dr, chromecache_79.1.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49718 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@17/45@4/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2260,i,16925381806868203602,13959119368343850401,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2260,i,16925381806868203602,13959119368343850401,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://recaptcha.net	0%	URL Reputation	safe
https://www.gstatic.c..?/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
www.google.com	142.250.9.105	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/recaptcha/api.js	false	high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA5iV1k7FM9SM7_t9xIbwi9UgqdvXSXbhooYk-Hd9rLYhYsqcg0ZTFPEiEzKRKfYXz1G4M95wVmJUCc057g9RKdPqpYfE_dVRdrkPzBnxn-Q34G6PulDowhZhFY4BuJ7gTQwK8QnCX3G_xfLFqmmd6z2gFUE9snjTtbaKF-JKgZIj5_mxDpwTV6vkJ8YYLFnfxxBKrBs&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
about:blank	false	low
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=yXfhXW7z1TctwEQdQ8yPo0M-H5o67uKvSJ8NeCDJiu4yhWoKen9BBYaZMjt9u2Kaf65D-qrmRos8lbjWmlsQtdnJ-GHFAcvtOnTkycSU9JrONLLhlTP4JBxNIA-ER1K4eSRFggiZPox_q0ldouNjT1TJ0sSFtsvSm6dhxx0J0C0B9iSgxyE5Kf6n8ZB65xW9uYFtNBfp9m1vNd47_QEvNU9S2LWFc9vsQFPCeddhX_9bkkDC7QvuzFsCg1QYTzSNOugmIR2-HK67HAthHcKgZxMo7CG1icU&cb=zi39nrm9z11q	false	high
https://www.google.com/	false	high
https://www.google.com/favicon.ico	false	high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/log?format=json&hasfast=true	chromecache_86.1.dr	false		high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_86.1.dr	false		high
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_86.1.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_86.1.dr	false		high
https://support.google.com/recaptcha#6262736	chromecache_86.1.dr	false		high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_86.1.dr	false		high
https://recaptcha.net	chromecache_86.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/api2/	chromecache_86.1.dr, chromecache_72.1.dr	false		high
https://www.gstatic.c..?/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__.	chromecache_86.1.dr	false	URL Reputation: safe	low
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_86.1.dr	false		high
https://cloud.google.com/contact	chromecache_86.1.dr	false		high
https://support.google.com/recaptcha	chromecache_86.1.dr	false		high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_86.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.253.124.99	unknown	United States	15169	GOOGLEUS	false
142.250.9.105	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428746
Start date and time:	2024-04-19 14:52:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@17/45@4/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.9.94, 142.251.15.101, 142.251.15.102, 142.251.15.113, 142.251.15.139, 142.251.15.138, 142.251.15.100, 74.125.136.84, 34.104.35.123, 20.251.162.34, 74.125.136.94, 108.177.122.95, 172.217.215.95, 172.253.124.95, 64.233.177.95, 64.233.176.95, 74.125.138.95, 142.251.15.95, 142.250.105.95, 142.250.9.95, 173.194.219.95, 64.233.185.95, 74.125.136.95, 74.125.138.94, 64.233.176.94, 13.85.23.86, 199.232.210.172, 192.229.211.108, 20.242.39.171, 142.251.15.94, 72.21.81.240
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 11:53:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.979593439393065
Encrypted:	false
SSDEEP:	48:8Qd5ThVMHZidAKZdA19ehwiZUklqehqy+3:867epy
MD5:	34D4C3C8630B1C9CB329093EC742AAFD
SHA1:	7F0638DB79C259DE018B4A479ECBCA56B54D83D3
SHA-256:	CBC561CB03CE7A60D0167AB6D4F525DB5F3AAA30D79552BCA725FCE3931FE48E
SHA-512:	0AA14B18C51BA49A5456E0E1C360849967E3829080F61269FA452FFE04CE585CF635EC6C4487FB1C2FCF2BD1CFC0D81795B8FD9F4DBE5790114F7A8B120CE0F5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........X...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.f....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.f....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.f....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.f..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.f...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 11:53:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.988858775893631
Encrypted:	false
SSDEEP:	48:8Id5ThVMHZidAKZdA1weh/iZUkAQkqehZy+2:8y789QQy
MD5:	C11F500AB564F4E14231952F9BCE1FAD
SHA1:	F65B94AFF81FCC6CDC1D85ED1FEC818656D5DC98
SHA-256:	A4FA3F30A8BC2530697F3F20DAC0A590C3E95E2FCF6DCBEFD64B875D8155D9D3
SHA-512:	8CB23C3C42186C9E61BB126D90DA14605EE3BA4F107103F9FDF854ACAB78D1B6B38B611273AAAB9CAC629250EE0DCF6A772BF6DB70F0AEBA1083E1A5C29D9623
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....jy.X...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.f....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.f....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.f....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.f..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.f...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.004136310593953
Encrypted:	false
SSDEEP:	48:8xed5ThVsHZidAKZdA14tseh7sFiZUkmgqeh7sny+BX:8xs70n1y
MD5:	4535843D2F562FA246111D0BB9D98C69
SHA1:	2E6C60071B8E18B38F2FCE3725696039EE44D129
SHA-256:	39E5E96873E1D7C1F20A0B6B8BEECD0CC1A7D068823069191329671D588947DA
SHA-512:	D808670D76E68C4DE1D5C5E9C5D112F77D56E4C0E8EBD63ED6DA109742EC324767B485A1D88BDEBD5DE5100E9E85D18B55605A66469397847525F7B012F420F9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.f....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.f....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.f....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.f..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 11:53:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.987288966094932
Encrypted:	false
SSDEEP:	48:8Jd5ThVMHZidAKZdA1vehDiZUkwqehNy+R:8F7H/y
MD5:	0F1FB6A21F6E269A780AC95BFDE52718
SHA1:	91AC70AA51CA08E3EE73D1943C40E10519918148
SHA-256:	E78110BE6C061AF27E4C380FD57E6B430C70476DF03E9D69354961AEBF12AB73
SHA-512:	53DCDD10E40A52E51061E2D5CD661DA0EA0AA45A6A314A079FB61B56321992E2703D908AF33DE0F1388B5B454049AF036F019C842B6922911815C801C63EF8AD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....lt.X...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.f....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.f....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.f....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.f..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.f...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 11:53:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9797008805250615
Encrypted:	false
SSDEEP:	48:82d5ThVMHZidAKZdA1hehBiZUk1W1qehDy+C:8k739jy
MD5:	867D4260B6DAADF1CE517C9918D300DF
SHA1:	5BCB533E9050AAB5C18DC1B2AD4603E60D598283
SHA-256:	1B3694E29C348419B4982BB647DE1A73ACED116B15084B7A16387C30ECFAA4A8
SHA-512:	5E7414C33AE7AC5C3281D7AF62D160ACE5D3365188E33AAFB35DE41C406D481E8E6BA934770A5CF3583D6E1BBF5317830BDA866F07A0DFD353D05633D319808C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Zp..X...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.f....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.f....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.f....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.f..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.f...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 11:53:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.990206600201854
Encrypted:	false
SSDEEP:	48:8Md5ThVMHZidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb1y+yT+:8G7/T/TbxWOvTb1y7T
MD5:	194CCFDDD31A7D42407BB848149D3AB8
SHA1:	C3A32B838980AFAD9FC8987CAFBB4A85F4206F49
SHA-256:	B874119DECEB29ADFE3C6E74FCB23DEDC11F024B43945D128484EC893457573B
SHA-512:	E25F03BABAB1F95B11DE2DEBEC720F5281A7D85F5B76A85996DE87EB1C027D3EE07EF788CC9AE9A380B4F42A39702A040BDC59CED2F9D5C257BB80EBC647334F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......l.X...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.f....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.f....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.f....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.f..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.f...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	low
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17696)
Category:	downloaded
Size (bytes):	18291
Entropy (8bit):	5.675040290596522
Encrypted:	false
SSDEEP:	384:A10ZNodN7X9fo6Gfx+VfvBZbIPGIu/9xJMD5RjTORps0E30cIMW4XdiGZ0ZeaeoR:A10ZY7XNo6Gfx+dvBZkPGt/97K5lTORP
MD5:	8D120D4D5CB207E52720218A143FEF17
SHA1:	DAE68D4F786BDA08FE39D89AB6F3366B1199CB8B
SHA-256:	AC88D994CF1935F39E5504E88EDB7938FB98F589C4D02013F36B46D15F98517D
SHA-512:	4611F40996ABD45761C5D56FD3EE000A3733ED872C6CFA89E112E32104E328AF632B0330C20E125E248F6D5718116D848A1D0CA28F01626CEDE564610319D629
Malicious:	false
Reputation:	low
URL:	https://www.google.com/js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var a=this\|\|self,K=function(z,w){if(!(w=(z=null,a.trustedTypes),w)\|\|!w.createPolicy)return z;try{z=w.createPolicy("bg",{createHTML:m,createScript:m,createScriptURL:m})}catch(F){a.console&&a.console.error(F.message)}return z},m=function(z){return z};(0,eval)(function(z,w){return(w=K())&&1===z.eval(w.createScript("1"))?function(F){return w.createScript(F)}:function(F){return""+F}}(a)(Array(7824Math.random()\|0).join("\n")+['(function(){/',.'',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var is=function(z,w){((w.push(z[0]<<24\|z[1]<<16\|z[2]<<8\|z[3]),w).push(z[4]<<24\|z[5]<<16\|z[6]<<8\|z[7]),w).push(z[8]<<24\|z[9]<<16\|z[10]<<8\|z[11])},zc=function(z,w){return z[w]<<24\|z[(w\|0)+1]<<16\|z[(w\|0)+2]<<8\|z[(w\|0)+3]},Fk=function(z,w,a,m,q){(((m=(a=(m=B((w&=(q=w&4,3),z)),B(z)),G)(z,m),q)&&(m=wk(""+m)),w)&&e(a,U(m.length,2),z),e)(a,m,z)},Q=function(z,w,a,m,q,M){if(!w.SQ&&(q=void 0,a&&a[0]===H&&(q=a[2]

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	101
Entropy (8bit):	4.676576247103658
Encrypted:	false
SSDEEP:	3:gnkAqRAdu6/GY7ovoX1mOkADYncSLIVIAIMwa:7AqJmOoemYnjLI+Mwa
MD5:	2404AF761BF0E15075083A7ADD25B545
SHA1:	EE799763A2AC937D5DB8381FD8A3EB216DE2A30D
SHA-256:	479B3AEF58E8CD792B2DF47C8F2BF94B54DC77ADB973A5D7D5A05702EC2654C8
SHA-512:	49E3C79793BFD1C732E6181D4C8D867578DA3EDE521DDA1F53C74A80B8270FDD4188EC8773CE81332FC04E7F168DB3B483519773FEF9E80691B1C43B22D84BA2
Malicious:	false
Reputation:	low
URL:	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/close.html
Preview:	<script type="text/javascript">....window.location.href="https://www.google.com/";....</script>......

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:	12:6v/7OEUT9vceKKNtY3kM8O+mucROzZbJOAjPBE2Iq8AnxT9:bTdcVIM8tfHzzjy2IdKT9
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:	12:6v/7OEUelyuRs56fyKgIEInu5VLJBZInmJhd/3VqQXD8GBm1:belFRs56fuIEIu5VNBZInMTICfBO
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/info_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	low
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1222), with no line terminators
Category:	downloaded
Size (bytes):	1222
Entropy (8bit):	5.812687833352702
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCLTLv138EgFB5vtTGJTlWtB31ngirLOGsLqo40RWUnYN:VKEctKonR3evtTA8/1/OXLrwUnG
MD5:	3F1B1790C083261F6FD3CF02FB56F2F8
SHA1:	BF1B289456E260CF5C5F0AF7C1B0F4E9BA7EB97B
SHA-256:	A58FF2DE4D6A14E055A553E83A4E67AEA6AAF589A57364305EEC36105CCE9EF3
SHA-512:	99D52B4D79A3B36CDAF0640C37FA504518DAF3C23A2FEAAE6A4966633D5407F1941F726741BE59E25A6726698614D202033BC6BD3D34DD2A352789088C54F0DE
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-eZG8e4nRp0gEpRB75JBNzhS0vVseDRBVprGQYHJN

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:	12:6v/7OEUelyuRs56fyKgIEInu5VLJBZInmJhd/3VqQXD8GBm1:belFRs56fuIEIu5VNBZInMTICfBO
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3
Category:	dropped
Size (bytes):	51112
Entropy (8bit):	7.975228569361247
Encrypted:	false
SSDEEP:	768:eJrGI0am1ZgPqm/tz7FxrG/a1SC0qd1doJTDOfO0cpo2yUR5n2D/uwmRR3P3ol:eEI0JgimRDXZjGleGYHl
MD5:	B87D8278843DABF458FED437CEC313B9
SHA1:	58F208B49B0573F7E18DABBEF52B9409E60ED29A
SHA-256:	13E574B6DE14EF047BEA034DD15E3E2DDB60E40B1BC5F6B84FF484E29716FF05
SHA-512:	8E9320579123C04AE617102EE3AC321F1218CFCF91FE523841BFD261CC1CD4C70E1FF7F62DE457BE84AFEB85A49956261ED19AB0B9CD0F373E3092FACEFBC380
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(m.\|I..C. *..v.J._.@0.=.?........J.;........:C!.v.'..Y.Pd=3......b.Rv-..M..lr.y.\...}Z..B+..t.,8....,1..9..Gr....B..x.s].Q.s...b2)...J.!...n..e-..9l...9.y...z.t....3.#..^....\|<2\.K.T.....j.RV3.4........O+iby..C,...K"......^Y.mj.#p...]..ki.......)9X..k....b.5w!...sS\|..lm\|0.6..R4...US.=....t.~...3<...._...f.->T7%./.eH.e86...d..G.V...,.j...0f.z.T....L...R.!c.

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3
Category:	downloaded
Size (bytes):	51112
Entropy (8bit):	7.975228569361247
Encrypted:	false
SSDEEP:	768:eJrGI0am1ZgPqm/tz7FxrG/a1SC0qd1doJTDOfO0cpo2yUR5n2D/uwmRR3P3ol:eEI0JgimRDXZjGleGYHl
MD5:	B87D8278843DABF458FED437CEC313B9
SHA1:	58F208B49B0573F7E18DABBEF52B9409E60ED29A
SHA-256:	13E574B6DE14EF047BEA034DD15E3E2DDB60E40B1BC5F6B84FF484E29716FF05
SHA-512:	8E9320579123C04AE617102EE3AC321F1218CFCF91FE523841BFD261CC1CD4C70E1FF7F62DE457BE84AFEB85A49956261ED19AB0B9CD0F373E3092FACEFBC380
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA5iV1k7FM9SM7_t9xIbwi9UgqdvXSXbhooYk-Hd9rLYhYsqcg0ZTFPEiEzKRKfYXz1G4M95wVmJUCc057g9RKdPqpYfE_dVRdrkPzBnxn-Q34G6PulDowhZhFY4BuJ7gTQwK8QnCX3G_xfLFqmmd6z2gFUE9snjTtbaKF-JKgZIj5_mxDpwTV6vkJ8YYLFnfxxBKrBs&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b
Preview:	......JFIF.............C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(m.\|I..C. *..v.J._.@0.=.?........J.;........:C!.v.'..Y.Pd=3......b.Rv-..M..lr.y.\...}Z..B+..t.,8....,1..9..Gr....B..x.s].Q.s...b2)...J.!...n..e-..9l...9.y...z.t....3.#..^....\|<2\.K.T.....j.RV3.4........O+iby..C,...K"......^Y.mj.#p...]..ki.......)9X..k....b.5w!...sS\|..lm\|0.6..R4...US.=....t.~...3<...._...f.->T7%./.eH.e86...d..G.V...,.j...0f.z.T....L...R.!c.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:	12:6v/7OEUT9vceKKNtY3kM8O+mucROzZbJOAjPBE2Iq8AnxT9:bTdcVIM8tfHzzjy2IdKT9
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/refresh_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.87377555746297
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKeHZQx66FTEVgWaee:PLKdXNQKOyo6FIVgL
MD5:	701C50FE2F9D8CFCA61542DEE7684552
SHA1:	952A04F81A291E11F5D4ECD7364A3840412BA65E
SHA-256:	9FC5DFC54DE18E9C98733BBEA6EBDCBC1F01C0B23F985556F24684EE96DC0582
SHA-512:	5CA3C342F4BE563EE68235F32BCB8B25B62215A961B903B3568C496FCAD4508B9408FBDE00C6592085A819826630462863630F888FE73348F13FC037A9AB2C99
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js');

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0
Category:	downloaded
Size (bytes):	15340
Entropy (8bit):	7.983406336508752
Encrypted:	false
SSDEEP:	384:F2gPJde0V2iGrQyD8b3k/tigCdeNqOUd47SH0tsGm:4gPVV2NQE8b3ldeNWH0Wb
MD5:	19B7A0ADFDD4F808B53AF7E2CE2AD4E5
SHA1:	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA
SHA-256:	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
SHA-512:	49DA16000687AC81FC4CA9E9112BDCA850BB9F32E0AF2FE751ABC57A8E9C3382451B50998CEB9DE56FC4196F1DC7EF46BBA47933FC47EB4538124870B7630036
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Preview:	wOF2......;........d..;..........................d..z..J.`..L.Z..<.....\..`..^...x.6.$..6. ..\|. ..8..z%......Q.{..q...FF.kd .8.(..d..).!C...Y.JA...r. ..GH8F......nW...".2&....2<..+C...p...b..SC.......J......z.-..Q..#6&1zUe../\...l.....<.....9s...E~.]B-..B.wY..o......Q..A.F..1j.......-.`P% .. ,..@1.0..~.....WWW.d.u<c{..^.R.+..w....&.........A......+C....(.N.....0.~..0.J.;.Nu..7....]..m.H.....[h.GL3....?)....c.H...2.3.}y........SXI\|..iVN'%E.D.W....r..<`....i....6;E$.....U.$j.@...._.......R2....WS...k.vz.R.'a9!^...N....h.._.....c.%."..S.2.16B...o.2}.pmU[.\|.LI....2.....OWQLO1-....s..8.(...".\|6...6R.. ..M-.zO.}w)..v..mXxX...c..3#.+.v....F`.Z;.zQ.......r,....Yo.....g.h....+.....O.3Y..)Y.8.!....elX......._.3.}k~u.{ C..H.z..FP........@...d..)T.R...L.H.J.j.@..............$...E......y...3.b...I.h u.+%.HA.\..9..8..X.!....gx...].:..V..C...._..X..!....6..)...GM:E.....O.Z.}k.;.T.k..D.k.O..D5.r..."......?..T.Q.A...CF...3g.5.Dn<.QPy..G..1.9..Q..0..

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:	12:6v/7OEUhUxzPKmghSn8nazyk+k8/OzxQcxNMvVb:bhUxzlvWkT8FcxK1
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/audio_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.184482755717443
Encrypted:	false
SSDEEP:	6:otqWtxbQLZVVi7GeqlAGmwbQLZVZYZ7qT:o7xbK95eqKVaKiM
MD5:	B54D0452E2FDB8C0D91C455D1C5495F9
SHA1:	DDD85730B9CB4CB9905B1D7E7643F595D2F33CB8
SHA-256:	F4138D99EC6E17514BB87CEEAD1C1D2A204219C970864FC85BFF00949EE18082
SHA-512:	6883DE3ABB2A7B71CBDE6EDA0854D5B9EC696A0656735843BBB6329007D758B502D2557CB36D5A1CEFC7B4D0AB5DCBC227C88DE9163662741C60F9D561F5A367
Malicious:	false
Reputation:	low
Preview:	<HTML>.<HEAD>.<TITLE>HTTP method GET is not supported by this URL</TITLE>.</HEAD>.<BODY BGCOLOR="#FFFFFF" TEXT="#000000">. GSE Default Error -->.<H1>HTTP method GET is not supported by this URL</H1>.<H2>Error 405</H2>.</BODY>.</HTML>.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56398), with no line terminators
Category:	downloaded
Size (bytes):	56398
Entropy (8bit):	5.907604034780877
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKYlebyB5lxRx54PHSGdXXwW7MFWwXVuE2:4UcW6v+0B5chXwW49z2
MD5:	EB4BC511F79F7A1573B45F5775B3A99B
SHA1:	D910FB51AD7316AA54F055079374574698E74B35
SHA-256:	7859A62E04B0ACB06516EB12454DE6673883ECFAEAED6C254659BCA7CD59C050
SHA-512:	EC9BDF1C91B6262B183FD23F640EAC22016D1F42DB631380676ED34B962E01BADDA91F9CBDFA189B42FE3182A992F1B95A7353AF41E41B2D6E1DAB17E87637A0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (554)
Category:	downloaded
Size (bytes):	510578
Entropy (8bit):	5.695280300193632
Encrypted:	false
SSDEEP:	6144:/LJaSgOPDcwWOTEmzYSU9F0Gx95F+SiT1i7uiv5VQgDx212FC:IS4sGx97+SihiSrFIC
MD5:	E9CCB3DBDE79BA5FFDF9CAD4B32D59FD
SHA1:	3A8CD67ADC7C885BDF683F1E7F491E6A4A50679F
SHA-256:	8F2C6777C7CCC01AB67290FA8ACD5A4C4866BE64129F39DFAEB9197DFA15E137
SHA-512:	5CA7C8439030C9B4B966760C660640A094B0D6E30E10DF85D7B900C6F9108B0E309298ED93C006634BB3F437BAB3CFF1B83A5D1B18C666C04346F0856294C461
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0./.var y=function(){return[function(E,X,B,M,c,v,Y,I,h,J,F,a,C,R,P){return E+4>>3==(E-8<<2>=(R=[1,"F",22],E)&&(E+2&12)<E&&(M=u[32](4,B[R[1]]),P=A[16](32,0,X,B[R[1]],M)),R[0])&&(M=void 0===M?null:M,Y=[3,341,278],c=d[46](16,21,X,u[31](32,B)),J=e[48](7,Y[0],X,u[31](35,X),u[31](28,Y[R[0]])),I=g[27](77,15,u[31](29,X),X,u[31](33,438)),v=u[31](38,Y[2]),a=A[32](R[2],l[13](2,d[9](48,36),X),[u[7](24,v),u[31](34,X)]),C=[c,J,I,a],null!=M&&(h=A[8](73),F=A[8](72),C=[W[30](8,h,u[31](28,B),u[31](37,0))].concat(C,[W[30](8,.F,R[0],R[0]),h,e[39](12,M,X),F])),P=C),P}]}(),g=function(){return[function(E,X,B,M,c,v){return 3<=((((E^(v=[7,"W",2],19))&v[0]\|\|(this[v

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:	12:6v/7OEUhUxzPKmghSn8nazyk+k8/OzxQcxNMvVb:bhUxzlvWkT8FcxK1
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk8dqZYMe7mkRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 14:53:10.934473991 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:10.934607029 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:11.028260946 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:20.496346951 CEST	49713	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:20.496429920 CEST	443	49713	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:20.496509075 CEST	49713	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:20.497967958 CEST	49713	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:20.498004913 CEST	443	49713	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:20.537118912 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:20.552891970 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:20.629256010 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:20.752830029 CEST	443	49713	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:20.753299952 CEST	49713	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:20.753355980 CEST	443	49713	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:20.754980087 CEST	443	49713	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:20.755074978 CEST	49713	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:20.759886980 CEST	49713	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:20.759978056 CEST	443	49713	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:20.761075020 CEST	49713	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:20.761092901 CEST	443	49713	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:20.805736065 CEST	49713	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:21.501082897 CEST	443	49713	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:21.501238108 CEST	443	49713	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:21.501281977 CEST	49713	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:21.501396894 CEST	49713	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:21.502589941 CEST	49713	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:21.502629995 CEST	443	49713	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:21.609905005 CEST	49714	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:21.609945059 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:21.610552073 CEST	49714	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:21.610552073 CEST	49714	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:21.610589981 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:21.858177900 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:21.861706972 CEST	49714	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:21.861730099 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:21.862199068 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:21.884380102 CEST	49714	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:21.884785891 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:21.885426044 CEST	49714	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:21.932115078 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:21.999089003 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:21.999305010 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:22.105000019 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.105045080 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.105087042 CEST	49714	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:22.105098963 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.105190992 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.105238914 CEST	49714	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:22.122042894 CEST	49714	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:22.122060061 CEST	443	49714	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.299102068 CEST	49715	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:22.299148083 CEST	443	49715	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.299217939 CEST	49715	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:22.299877882 CEST	49715	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:22.299897909 CEST	443	49715	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.515698910 CEST	443	49715	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.522258043 CEST	49715	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:22.522272110 CEST	443	49715	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.522681952 CEST	443	49715	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.545469999 CEST	49715	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:22.545550108 CEST	443	49715	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.546186924 CEST	49715	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:22.588115931 CEST	443	49715	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.745407104 CEST	443	49715	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.745804071 CEST	443	49715	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:22.745867968 CEST	49715	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:22.917762995 CEST	49715	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:22.917788982 CEST	443	49715	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:23.277885914 CEST	49717	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.277925014 CEST	443	49717	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.278081894 CEST	49717	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.306857109 CEST	49717	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.306875944 CEST	443	49717	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.527627945 CEST	443	49717	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.527719021 CEST	49717	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.530742884 CEST	49717	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.530750990 CEST	443	49717	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.531153917 CEST	443	49717	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.583233118 CEST	49717	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.588563919 CEST	49717	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.632129908 CEST	443	49717	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.727070093 CEST	443	49717	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.727145910 CEST	443	49717	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.727221012 CEST	49717	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.727381945 CEST	49717	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.727401972 CEST	443	49717	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.727411985 CEST	49717	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.727416992 CEST	443	49717	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.758953094 CEST	49718	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.758996010 CEST	443	49718	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.759188890 CEST	49718	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.759674072 CEST	49718	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:23.759685040 CEST	443	49718	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.979444027 CEST	443	49718	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:23.979528904 CEST	49718	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:24.359124899 CEST	49718	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:24.359170914 CEST	443	49718	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:24.359612942 CEST	443	49718	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:24.367902994 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.367958069 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.368140936 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.369039059 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.369054079 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.377583027 CEST	49718	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:24.424125910 CEST	443	49718	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:24.482220888 CEST	443	49718	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:24.482378960 CEST	443	49718	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:24.482470036 CEST	49718	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:24.486706018 CEST	49718	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:24.486726046 CEST	443	49718	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:24.486793995 CEST	49718	443	192.168.2.5	184.31.62.93
Apr 19, 2024 14:53:24.486800909 CEST	443	49718	184.31.62.93	192.168.2.5
Apr 19, 2024 14:53:24.616596937 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.617801905 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.617847919 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.618959904 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.619796038 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.619977951 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.620239019 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.620302916 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.891273022 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.891415119 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.891468048 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.891490936 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.891585112 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.891638041 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.891644955 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.891738892 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.892025948 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.892033100 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.899127960 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.899214983 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.899224043 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.907490969 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.907663107 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.907672882 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.913625956 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.913712025 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.913722038 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:24.960091114 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:24.960122108 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.006268978 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.010134935 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.014250994 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.014292955 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.014965057 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.014986038 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.015254974 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.022648096 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.031094074 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.031176090 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.031191111 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.039469004 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.039644003 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.039659977 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.047801971 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.047888041 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.047903061 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.056119919 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.056180954 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.056195974 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.063720942 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.063800097 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.063813925 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.071444035 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.071527958 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.071542025 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.079054117 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.079139948 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.079154015 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.086721897 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.086883068 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.086896896 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.094424009 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.094510078 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.094557047 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.094578981 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.094783068 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.101946115 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.106089115 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.106184959 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.106393099 CEST	49719	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.106421947 CEST	443	49719	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.968033075 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.968055010 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:25.968307972 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.968689919 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:25.968707085 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:26.187052011 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:26.300875902 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.257992029 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.258033037 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.259541035 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.266423941 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.266611099 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.266961098 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.289546013 CEST	49724	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.289632082 CEST	443	49724	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.289726019 CEST	49724	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.290086031 CEST	49724	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.290123940 CEST	443	49724	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.308161974 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.375600100 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.375718117 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.375775099 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.375792980 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.375911951 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.375966072 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.375977039 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.376079082 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.376172066 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.376183033 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.382364988 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.382407904 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.382412910 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.389671087 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.389714956 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.389719963 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.396941900 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.396995068 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.397000074 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.479655981 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.479718924 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.479737043 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.482970953 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.483016968 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.483023882 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.483098030 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.483139038 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.483608007 CEST	49723	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.483624935 CEST	443	49723	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.532912016 CEST	443	49724	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.533494949 CEST	49724	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.533562899 CEST	443	49724	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.534672976 CEST	443	49724	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.535816908 CEST	49724	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.535923958 CEST	443	49724	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.536185026 CEST	49724	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.536218882 CEST	443	49724	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.786927938 CEST	443	49724	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.787261963 CEST	443	49724	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.787332058 CEST	49724	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.839423895 CEST	49724	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.839479923 CEST	443	49724	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.879132986 CEST	49727	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.879218102 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:28.879292965 CEST	49727	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.879693031 CEST	49727	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:28.879726887 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.098752022 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.101731062 CEST	49727	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.101763010 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.102873087 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.103451967 CEST	49727	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.103579998 CEST	49727	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.103585958 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.103622913 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.106026888 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.106120110 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.106206894 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.106574059 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.106607914 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.285645008 CEST	49727	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.313664913 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.313800097 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.313869953 CEST	49727	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.313900948 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.314002037 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.314060926 CEST	49727	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.314074993 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.316545963 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.316612005 CEST	49727	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.316859007 CEST	49727	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.316888094 CEST	443	49727	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.323987007 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.324213982 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.324275970 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.325007915 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.325283051 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.325376987 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.325392962 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.372140884 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.426300049 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.426383018 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.426470041 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.426662922 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.426700115 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.504075050 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.550592899 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.550730944 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.550805092 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.550822020 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.550849915 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.550898075 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.550940990 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.551081896 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.551177025 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.551187038 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.560013056 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.560107946 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.562784910 CEST	49729	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:29.562803030 CEST	443	49729	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:29.644943953 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.645314932 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.645353079 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.646852016 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.646934986 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.647177935 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.647257090 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.647305965 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.688129902 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.801251888 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.801311016 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.858357906 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.858453035 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.858454943 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.858483076 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.858547926 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.858566999 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.861221075 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:29.861291885 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.861474991 CEST	49730	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:29.861505985 CEST	443	49730	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:32.191245079 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:32.191344023 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:32.198808908 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:32.198869944 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:32.198962927 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:32.199821949 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:32.199851990 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:32.343128920 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:32.343154907 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:32.522947073 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:32.523049116 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:33.015783072 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:33.015850067 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:33.017113924 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:33.017193079 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:33.017565966 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:33.017637968 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:33.017754078 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:33.017766953 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:33.398473978 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:33.398571968 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:33.398623943 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:33.398682117 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:33.398755074 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 19, 2024 14:53:33.398819923 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 19, 2024 14:53:39.939130068 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:39.939177036 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:39.939397097 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:39.939852953 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:39.939865112 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.161200047 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.162939072 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.162966967 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.164475918 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.165111065 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.165344954 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.165350914 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.165514946 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.165579081 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.416260004 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.421659946 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.421742916 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.421766996 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.421902895 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.421957970 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.421966076 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.429177046 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.429266930 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.429271936 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.429302931 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.429464102 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.436455965 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.443867922 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.443958998 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.443972111 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.492527962 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.492548943 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.521008015 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.521079063 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.521090031 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.524507999 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.524586916 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.524594069 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.531899929 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.532124996 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.532130957 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.539623976 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.539701939 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.540055037 CEST	49739	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.540070057 CEST	443	49739	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.545543909 CEST	49740	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:40.545579910 CEST	443	49740	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:40.545663118 CEST	49740	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:40.546031952 CEST	49740	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:40.546046019 CEST	443	49740	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:40.596327066 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.596363068 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.596451044 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.597033024 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.597059965 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.766377926 CEST	443	49740	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:40.766874075 CEST	49740	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:40.766886950 CEST	443	49740	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:40.768377066 CEST	443	49740	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:40.769462109 CEST	49740	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:40.769876957 CEST	443	49740	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:40.778954029 CEST	49740	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:40.820116997 CEST	443	49740	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:40.835072041 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.859672070 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.859700918 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.860076904 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.860984087 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.861057997 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.862718105 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:40.862745047 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:40.997133017 CEST	443	49740	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:40.997294903 CEST	443	49740	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:40.997512102 CEST	49740	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:40.999661922 CEST	49740	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:40.999680996 CEST	443	49740	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.092051983 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.092109919 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.092142105 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.092170000 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.092199087 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.092372894 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.093585968 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.100053072 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.100071907 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.100117922 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.100133896 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.100187063 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.108237028 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.116471052 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.116496086 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.116549015 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.116564989 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.116611958 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.124680042 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.176522017 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.208998919 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.212973118 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.212991953 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.213047981 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.213067055 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.213119984 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.221029997 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.229321003 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.229346037 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.229393005 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.229408026 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.229460955 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.237375975 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.245651960 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.245687008 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.245707989 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.245727062 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.245831013 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.253907919 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.261499882 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.261518002 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.261569977 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.261584044 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.261732101 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.269011974 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.276602030 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.276623964 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.276669979 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.276683092 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.276730061 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.284181118 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.291785955 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.291804075 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.291827917 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.291841030 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.291892052 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.299452066 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.307051897 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.307066917 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.307102919 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.307116032 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.307271957 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.314874887 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.315114975 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.315172911 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.315388918 CEST	49744	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:53:41.315416098 CEST	443	49744	142.250.9.105	192.168.2.5
Apr 19, 2024 14:53:41.321655989 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.321705103 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.321769953 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.321947098 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.321964979 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.541464090 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.541810036 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.541874886 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.543057919 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.543562889 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.543746948 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.543762922 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.543826103 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.598836899 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.768290043 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.768368006 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.768400908 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.768429995 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.768464088 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.768533945 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.769007921 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.775362015 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.775396109 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.775446892 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.775464058 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.775506020 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.782780886 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.789999008 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.790060043 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.790081024 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.790100098 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.790153027 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.797226906 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.840457916 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.872843981 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.876343966 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.876446009 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.876528978 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.876578093 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.876633883 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.883557081 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.890810013 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.890897036 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.891076088 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.891138077 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.891208887 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.898324013 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.905602932 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.905821085 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.906004906 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.906066895 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.906116962 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.912848949 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.919666052 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.919751883 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.920077085 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.920139074 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.920463085 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.926451921 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.933284044 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.933362007 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.933500051 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.933562994 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.934142113 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.939960003 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.946799040 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.946873903 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.947067022 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.947128057 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.947424889 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.953701019 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.960416079 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.960494995 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.960891962 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.960953951 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.961040974 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:41.967170954 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.967375994 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:53:41.972893953 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:42.116931915 CEST	49750	443	192.168.2.5	172.253.124.99
Apr 19, 2024 14:53:42.116996050 CEST	443	49750	172.253.124.99	192.168.2.5
Apr 19, 2024 14:54:21.709393978 CEST	49753	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:54:21.709420919 CEST	443	49753	142.250.9.105	192.168.2.5
Apr 19, 2024 14:54:21.709539890 CEST	49753	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:54:21.710561991 CEST	49753	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:54:21.710573912 CEST	443	49753	142.250.9.105	192.168.2.5
Apr 19, 2024 14:54:21.948925018 CEST	443	49753	142.250.9.105	192.168.2.5
Apr 19, 2024 14:54:21.950196028 CEST	49753	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:54:21.950206041 CEST	443	49753	142.250.9.105	192.168.2.5
Apr 19, 2024 14:54:21.950949907 CEST	443	49753	142.250.9.105	192.168.2.5
Apr 19, 2024 14:54:21.951678991 CEST	49753	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:54:21.951731920 CEST	443	49753	142.250.9.105	192.168.2.5
Apr 19, 2024 14:54:22.005953074 CEST	49753	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:54:31.953239918 CEST	443	49753	142.250.9.105	192.168.2.5
Apr 19, 2024 14:54:31.953319073 CEST	443	49753	142.250.9.105	192.168.2.5
Apr 19, 2024 14:54:31.953372002 CEST	49753	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:54:33.652725935 CEST	49753	443	192.168.2.5	142.250.9.105
Apr 19, 2024 14:54:33.652756929 CEST	443	49753	142.250.9.105	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 14:53:17.359836102 CEST	53	54118	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:17.399377108 CEST	53	55079	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:17.987286091 CEST	53	55331	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:18.627163887 CEST	53	54052	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:20.371767998 CEST	52083	53	192.168.2.5	1.1.1.1
Apr 19, 2024 14:53:20.381850004 CEST	54338	53	192.168.2.5	1.1.1.1
Apr 19, 2024 14:53:20.481029987 CEST	53	52083	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:20.490741014 CEST	53	54338	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:23.030435085 CEST	53	58716	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:24.507256031 CEST	53	60929	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:28.396351099 CEST	53	63975	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:28.643148899 CEST	53	56262	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:29.320805073 CEST	52889	53	192.168.2.5	1.1.1.1
Apr 19, 2024 14:53:29.320883989 CEST	51665	53	192.168.2.5	1.1.1.1
Apr 19, 2024 14:53:29.425496101 CEST	53	51665	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:29.425519943 CEST	53	52889	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:35.334023952 CEST	53	59006	1.1.1.1	192.168.2.5
Apr 19, 2024 14:53:54.157761097 CEST	53	50927	1.1.1.1	192.168.2.5
Apr 19, 2024 14:54:17.013515949 CEST	53	51294	1.1.1.1	192.168.2.5
Apr 19, 2024 14:54:17.554388046 CEST	53	64758	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 14:53:20.371767998 CEST	192.168.2.5	1.1.1.1	0x6c90	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:20.381850004 CEST	192.168.2.5	1.1.1.1	0xfdbb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 19, 2024 14:53:29.320805073 CEST	192.168.2.5	1.1.1.1	0x4031	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:29.320883989 CEST	192.168.2.5	1.1.1.1	0xd5d	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 14:53:20.481029987 CEST	1.1.1.1	192.168.2.5	0x6c90	No error (0)	www.google.com		142.250.9.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:20.481029987 CEST	1.1.1.1	192.168.2.5	0x6c90	No error (0)	www.google.com		142.250.9.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:20.481029987 CEST	1.1.1.1	192.168.2.5	0x6c90	No error (0)	www.google.com		142.250.9.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:20.481029987 CEST	1.1.1.1	192.168.2.5	0x6c90	No error (0)	www.google.com		142.250.9.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:20.481029987 CEST	1.1.1.1	192.168.2.5	0x6c90	No error (0)	www.google.com		142.250.9.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:20.481029987 CEST	1.1.1.1	192.168.2.5	0x6c90	No error (0)	www.google.com		142.250.9.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:20.490741014 CEST	1.1.1.1	192.168.2.5	0xfdbb	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 14:53:29.425496101 CEST	1.1.1.1	192.168.2.5	0xd5d	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 14:53:29.425519943 CEST	1.1.1.1	192.168.2.5	0x4031	No error (0)	www.google.com		172.253.124.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:29.425519943 CEST	1.1.1.1	192.168.2.5	0x4031	No error (0)	www.google.com		172.253.124.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:29.425519943 CEST	1.1.1.1	192.168.2.5	0x4031	No error (0)	www.google.com		172.253.124.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:29.425519943 CEST	1.1.1.1	192.168.2.5	0x4031	No error (0)	www.google.com		172.253.124.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:29.425519943 CEST	1.1.1.1	192.168.2.5	0x4031	No error (0)	www.google.com		172.253.124.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:29.425519943 CEST	1.1.1.1	192.168.2.5	0x4031	No error (0)	www.google.com		172.253.124.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:31.615396023 CEST	1.1.1.1	192.168.2.5	0xc61d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:31.615396023 CEST	1.1.1.1	192.168.2.5	0xc61d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:31.951373100 CEST	1.1.1.1	192.168.2.5	0x10d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 14:53:31.951373100 CEST	1.1.1.1	192.168.2.5	0x10d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:53:45.204771996 CEST	1.1.1.1	192.168.2.5	0xad0a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 14:53:45.204771996 CEST	1.1.1.1	192.168.2.5	0xad0a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:54:09.471417904 CEST	1.1.1.1	192.168.2.5	0x94a2	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 14:54:09.471417904 CEST	1.1.1.1	192.168.2.5	0x94a2	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 14:54:29.923051119 CEST	1.1.1.1	192.168.2.5	0x7eac	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 14:54:29.923051119 CEST	1.1.1.1	192.168.2.5	0x7eac	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

www.google.com

www.bing.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	142.250.9.105	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:20 UTC	809	OUT	GET / HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 12:53:21 UTC	2085	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIwdKJsQYQg9_JzAESBFG1OTQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-4Q-qVZwYOz4Fn5K2pAS1Dw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 19 Apr 2024 12:53:21 GMT Server: gws Content-Length: 398 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; expires=Wed, 16-Oct-2024 12:53:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4; expires=Sat, 19-Oct-2024 12:53:20 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 12:53:21 UTC	398	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 26 61 6d 70 3b 71 3d 45 67 52 52 74 54 6b 30 47 4d 44 53 69 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	142.250.9.105	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:21 UTC	1237	OUT	GET /sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:22 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 19 Apr 2024 12:53:22 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3054 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 12:53:22 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/</title></head><body style="font
2024-04-19 12:53:22 UTC	1255	IN	Data Raw: 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 79 58 66 68 58 57 37 7a 31 54 63 74 77 45 51 64 51 38 79 50 6f 30 4d 2d 48 35 6f 36 37 75 4b 76 53 4a 38 4e 65 43 44 4a 69 75 34 79 68 57 6f 4b 65 6e 39 42 Data Ascii: onse) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="yXfhXW7z1TctwEQdQ8yPo0M-H5o67uKvSJ8NeCDJiu4yhWoKen9B
2024-04-19 12:53:22 UTC	900	IN	Data Raw: 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e 67 20 74 68 65 20 61 62 6f 76 65 20 43 41 50 54 43 48 41 20 77 69 6c 6c 20 6c 65 74 20 79 6f 75 20 63 6f 6e 74 69 Data Ascii: ming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solving the above CAPTCHA will let you conti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	142.250.9.105	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:22 UTC	1110	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:22 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Fri, 19 Apr 2024 12:53:22 GMT Date: Fri, 19 Apr 2024 12:53:22 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 12:53:22 UTC	727	IN	Data Raw: 34 63 36 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 4c6/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-04-19 12:53:22 UTC	502	IN	Data Raw: 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 3b 70 6f 2e 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 65 5a 47 38 65 34 6e 52 70 30 67 45 70 52 42 37 35 Data Ascii: cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-eZG8e4nRp0gEpRB75
2024-04-19 12:53:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49717	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:23 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 12:53:23 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=151798 Date: Fri, 19 Apr 2024 12:53:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:24 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 12:53:24 UTC	805	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 52EA27DBDE0C4533B819423583F6692E Ref B: CH1AA2040902052 Ref C: 2023-07-09T23:10:08Z X-MSEdge-Ref: Ref A: 528BB8D443C042AA9AEA4EC3F75C7762 Ref B: CHI30EDGE0111 Ref C: 2023-07-09T23:11:11Z Content-Type: application/octet-stream X-Azure-Ref: 01uvbYwAAAACkqWtaEMjWQL/4cpisZkorTUVNMzBFREdFMDgxMQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=151818 Date: Fri, 19 Apr 2024 12:53:24 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-19 12:53:24 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49719	142.250.9.105	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:24 UTC	1717	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=yXfhXW7z1TctwEQdQ8yPo0M-H5o67uKvSJ8NeCDJiu4yhWoKen9BBYaZMjt9u2Kaf65D-qrmRos8lbjWmlsQtdnJ-GHFAcvtOnTkycSU9JrONLLhlTP4JBxNIA-ER1K4eSRFggiZPox_q0ldouNjT1TJ0sSFtsvSm6dhxx0J0C0B9iSgxyE5Kf6n8ZB65xW9uYFtNBfp9m1vNd47_QEvNU9S2LWFc9vsQFPCeddhX_9bkkDC7QvuzFsCg1QYTzSNOugmIR2-HK67HAthHcKgZxMo7CG1icU&cb=zi39nrm9z11q HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:24 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 19 Apr 2024 12:53:24 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-ldhEQ_xAxWwN0tzjl3BGZw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 12:53:24 UTC	364	IN	Data Raw: 32 61 65 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2ae3<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-04-19 12:53:24 UTC	1255	IN	Data Raw: 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 Data Ascii: 18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//font
2024-04-19 12:53:24 UTC	1255	IN	Data Raw: 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 Data Ascii: 0AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00
2024-04-19 12:53:24 UTC	1255	IN	Data Raw: 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 Data Ascii: +04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-19 12:53:24 UTC	1255	IN	Data Raw: 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 Data Ascii: e { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0
2024-04-19 12:53:24 UTC	1255	IN	Data Raw: 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a Data Ascii: ic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2024-04-19 12:53:24 UTC	1255	IN	Data Raw: 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 6c 64 68 45 51 5f 78 41 78 57 77 4e 30 74 7a 6a 6c 33 42 47 5a 77 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d Data Ascii: </style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/styles__ltr.css"><script nonce="ldhEQ_xAxWwN0tzjl3BGZw" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com
2024-04-19 12:53:24 UTC	1255	IN	Data Raw: 39 65 51 59 53 78 6d 42 64 33 4e 75 34 46 64 79 6a 57 43 55 56 79 64 50 2d 71 6f 4a 43 4a 39 58 70 39 46 4e 4f 2d 43 6f 5a 34 4d 73 6c 78 2d 61 45 33 52 67 4d 49 4e 6f 4d 58 72 41 45 7a 54 61 57 45 37 7a 5a 49 64 70 36 6b 42 59 52 68 50 6c 39 4b 79 56 54 42 59 77 45 45 48 58 61 46 57 59 64 47 6f 76 64 37 5a 6c 4c 65 6b 79 55 50 57 42 78 52 73 36 2d 2d 65 48 71 6b 6e 6b 52 77 46 6a 46 43 66 4a 53 74 63 72 78 77 63 43 53 59 47 59 65 38 71 4d 56 4c 71 30 76 7a 39 6f 52 70 43 6e 6a 77 4d 73 65 33 48 61 56 6d 4a 74 31 47 69 76 53 43 73 61 6f 74 42 4a 63 32 64 34 57 59 58 5f 74 42 51 4f 79 6b 65 52 56 47 55 4e 4c 56 6d 56 55 48 5f 4d 33 39 4e 74 4e 47 7a 75 77 79 44 36 5a 4b 6f 63 77 61 4f 30 6b 41 65 69 35 49 79 67 36 47 55 75 48 78 61 38 4e 79 6e 65 78 2d 61 Data Ascii: 9eQYSxmBd3Nu4FdyjWCUVydP-qoJCJ9Xp9FNO-CoZ4Mslx-aE3RgMINoMXrAEzTaWE7zZIdp6kBYRhPl9KyVTBYwEEHXaFWYdGovd7ZlLekyUPWBxRs6--eHqknkRwFjFCfJStcrxwcCSYGYe8qMVLq0vz9oRpCnjwMse3HaVmJt1GivSCsaotBJc2d4WYX_tBQOykeRVGUNLVmVUH_M39NtNGzuwyD6ZKocwaO0kAei5Iyg6GUuHxa8Nynex-a
2024-04-19 12:53:24 UTC	1255	IN	Data Raw: 35 74 48 4f 41 51 69 50 44 48 5a 33 6e 67 4e 35 46 76 4a 6c 59 46 57 35 6e 65 4f 59 51 5f 30 59 4e 6f 50 43 70 38 67 7a 34 49 78 44 45 76 66 52 68 35 52 42 54 37 6f 59 57 75 6c 59 47 4b 52 6d 52 33 4f 74 34 2d 51 39 44 77 47 4e 43 6a 69 62 53 6d 36 6e 49 76 63 5f 4e 65 31 78 38 4e 31 76 78 37 64 33 4b 4f 36 34 74 48 7a 34 30 47 6c 35 51 75 64 51 5f 35 7a 67 6b 5a 69 54 5f 46 55 30 62 33 5f 35 74 74 66 53 6a 6b 4b 51 33 4d 41 4a 38 4d 4a 41 63 57 73 71 5a 59 73 4e 62 32 55 41 6b 68 4e 67 45 5a 63 4a 79 78 66 79 73 48 4b 57 53 51 6e 39 78 54 78 59 4d 58 77 2d 7a 53 50 73 73 50 4f 46 47 51 78 65 42 2d 74 39 4f 44 4a 30 41 72 6b 39 6f 4c 41 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d Data Ascii: 5tHOAQiPDHZ3ngN5FvJlYFW5neOYQ_0YNoPCp8gz4IxDEvfRh5RBT7oYWulYGKRmR3Ot4-Q9DwGNCjibSm6nIvc_Ne1x8N1vx7d3KO64tHz40Gl5QudQ_5zgkZiT_FU0b3_5ttfSjkKQ3MAJ8MJAcWsqZYsNb2UAkhNgEZcJyxfysHKWSQn9xTxYMXw-zSPssPOFGQxeB-t9ODJ0Ark9oLA"><script type="text/javascript" nonce=
2024-04-19 12:53:24 UTC	583	IN	Data Raw: 5a 7a 53 31 6b 77 64 6b 78 45 65 57 35 49 53 56 6c 73 54 44 52 4a 4e 46 4a 76 4f 46 56 4c 5a 47 31 6a 4e 44 42 53 5a 30 4a 30 56 54 6c 4c 56 6d 6c 4d 55 30 4e 74 61 43 74 56 62 54 67 76 56 30 35 49 54 55 38 32 4e 55 46 53 64 6b 70 6d 51 6d 63 30 53 43 73 34 4e 58 68 69 56 32 68 46 57 55 70 4b 56 56 51 31 53 69 74 4a 54 57 35 4e 4e 46 52 72 65 56 4e 5a 63 6b 39 36 4f 55 52 47 57 6c 4e 44 64 45 77 31 52 43 73 7a 5a 57 35 44 56 6a 56 5a 4f 55 4d 33 62 46 6c 78 57 6b 6f 31 4f 57 35 6e 52 54 41 76 4e 46 4d 30 54 58 64 74 55 6b 78 71 56 6c 4a 36 59 58 6c 56 4e 57 6b 33 61 58 56 43 4d 48 46 70 65 56 42 35 62 58 4e 34 64 33 6b 33 4d 58 52 43 52 6a 5a 44 64 53 74 70 56 46 5a 30 65 6b 67 33 61 47 74 4b 63 55 5a 69 62 55 35 32 4c 30 56 5a 52 33 4a 61 57 46 5a 47 54 Data Ascii: ZzS1kwdkxEeW5ISVlsTDRJNFJvOFVLZG1jNDBSZ0J0VTlLVmlMU0NtaCtVbTgvV05ITU82NUFSdkpmQmc0SCs4NXhiV2hFWUpKVVQ1SitJTW5NNFRreVNZck96OURGWlNDdEw1RCszZW5DVjVZOUM3bFlxWko1OW5nRTAvNFM0TXdtUkxqVlJ6YXlVNWk3aXVCMHFpeVB5bXN4d3k3MXRCRjZDdStpVFZ0ekg3aGtKcUZibU52L0VZR3JaWFZGT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	142.250.9.105	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:28 UTC	1432	OUT	GET /js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=yXfhXW7z1TctwEQdQ8yPo0M-H5o67uKvSJ8NeCDJiu4yhWoKen9BBYaZMjt9u2Kaf65D-qrmRos8lbjWmlsQtdnJ-GHFAcvtOnTkycSU9JrONLLhlTP4JBxNIA-ER1K4eSRFggiZPox_q0ldouNjT1TJ0sSFtsvSm6dhxx0J0C0B9iSgxyE5Kf6n8ZB65xW9uYFtNBfp9m1vNd47_QEvNU9S2LWFc9vsQFPCeddhX_9bkkDC7QvuzFsCg1QYTzSNOugmIR2-HK67HAthHcKgZxMo7CG1icU&cb=zi39nrm9z11q Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:28 UTC	799	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18291 Date: Fri, 19 Apr 2024 12:53:28 GMT Expires: Sat, 19 Apr 2025 12:53:28 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 04 Apr 2024 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 12:53:28 UTC	456	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 4b 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 29 7b 69 66 28 21 28 77 3d 28 7a 3d 6e 75 6c 6c 2c 61 2e 74 72 75 73 74 65 64 54 79 70 65 73 29 2c 77 29 7c 7c 21 77 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 7a 3b 74 72 79 7b 7a 3d 77 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 6d 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 6d 2c 63 72 65 61 74 Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var a=this\|\|self,K=function(z,w){if(!(w=(z=null,a.trustedTypes),w)\|\|!w.createPolicy)return z;try{z=w.createPolicy("bg",{createHTML:m,createScript:m,creat
2024-04-19 12:53:28 UTC	1255	IN	Data Raw: 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 46 29 7b 72 65 74 75 72 6e 22 22 2b 46 7d 7d 28 61 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 5b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 27 2c 0a 27 27 2c 0a 27 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 69 73 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 29 7b 28 28 77 2e 70 75 73 68 28 7a 5b 30 5d 3c 3c 32 34 7c 7a 5b 31 5d 3c 3c 31 36 7c 7a 5b 32 5d 3c 3c 38 7c 7a 5b 33 5d 29 2c 77 29 2e 70 75 73 68 28 7a 5b 34 5d 3c 3c 32 34 7c 7a 5b 35 5d 3c 3c 31 36 7c 7a 5b 36 5d 3c 3c 38 7c 7a 5b 37 5d 29 2c 77 29 2e 70 75 73 68 28 7a 5b 38 5d 3c Data Ascii: )}:function(F){return""+F}}(a)(Array(7824Math.random()\|0).join("\n")+['(function(){/','',' SPDX-License-Identifier: Apache-2.0','*/','var is=function(z,w){((w.push(z[0]<<24\|z[1]<<16\|z[2]<<8\|z[3]),w).push(z[4]<<24\|z[5]<<16\|z[6]<<8\|z[7]),w).push(z[8]<
2024-04-19 12:53:28 UTC	1255	IN	Data Raw: 2c 61 3e 3e 3e 31 36 26 32 35 35 2c 61 3e 3e 3e 38 26 32 35 35 2c 61 3e 3e 3e 30 26 32 35 35 5d 7d 2c 73 36 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 68 69 73 2e 43 3d 74 68 69 73 2e 50 3d 74 68 69 73 2e 6e 3d 30 7d 72 65 74 75 72 6e 20 77 3d 28 61 2e 70 72 6f 74 6f 74 79 70 65 2e 4e 68 3d 28 61 2e 70 72 6f 74 6f 74 79 70 65 2e 62 50 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 30 3d 3d 3d 74 68 69 73 2e 6e 3f 30 3a 4d 61 74 68 2e 73 71 72 74 28 74 68 69 73 2e 43 2f 74 68 69 73 2e 6e 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 6d 2c 71 29 7b 28 74 68 69 73 2e 50 2b 3d 28 71 3d 6d 2d 74 68 69 73 2e 50 2c 74 68 69 73 2e 6e 2b 2b 2c 71 29 2f 74 68 69 73 2e 6e 2c 74 68 69 73 29 2e 43 2b 3d 71 2a 28 6d 2d 74 68 Data Ascii: ,a>>>16&255,a>>>8&255,a>>>0&255]},s6=function(z,w){function a(){this.C=this.P=this.n=0}return w=(a.prototype.Nh=(a.prototype.bP=function(){return 0===this.n?0:Math.sqrt(this.C/this.n)},function(m,q){(this.P+=(q=m-this.P,this.n++,q)/this.n,this).C+=q*(m-th
2024-04-19 12:53:28 UTC	1255	IN	Data Raw: 5a 3d 3d 7a 3f 28 76 28 7a 29 7c 30 29 2d 31 3a 31 29 2c 42 28 7a 29 29 2c 30 29 3b 71 3c 77 3b 71 2b 2b 29 4d 2e 52 2e 70 75 73 68 28 42 28 7a 29 29 3b 66 6f 72 28 3b 77 2d 2d 3b 29 4d 2e 52 5b 77 5d 3d 47 28 7a 2c 4d 2e 52 5b 77 5d 29 3b 72 65 74 75 72 6e 28 4d 2e 6b 74 3d 47 28 7a 2c 61 29 2c 4d 29 2e 4f 4f 3d 47 28 7a 2c 6d 29 2c 4d 7d 2c 47 63 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 2c 61 2c 6d 2c 71 2c 4d 29 7b 69 66 28 21 77 2e 44 29 7b 77 2e 4b 2b 2b 3b 74 72 79 7b 66 6f 72 28 71 3d 28 61 3d 28 4d 3d 76 6f 69 64 20 30 2c 77 2e 57 29 2c 30 29 3b 2d 2d 7a 3b 29 74 72 79 7b 69 66 28 6d 3d 76 6f 69 64 20 30 2c 77 2e 47 29 4d 3d 4b 49 28 77 2c 77 2e 47 29 3b 65 6c 73 65 7b 69 66 28 71 3d 47 28 77 2c 36 34 29 2c 71 3e 3d 61 29 62 72 65 61 6b 3b 4d 3d 28 Data Ascii: Z==z?(v(z)\|0)-1:1),B(z)),0);q<w;q++)M.R.push(B(z));for(;w--;)M.R[w]=G(z,M.R[w]);return(M.kt=G(z,a),M).OO=G(z,m),M},Gc=function(z,w,a,m,q,M){if(!w.D){w.K++;try{for(q=(a=(M=void 0,w.W),0);--z;)try{if(m=void 0,w.G)M=KI(w,w.G);else{if(q=G(w,64),q>=a)break;M=(
2024-04-19 12:53:28 UTC	1255	IN	Data Raw: 2c 50 3d 7b 70 61 73 73 69 76 65 3a 74 72 75 65 2c 63 61 70 74 75 72 65 3a 74 72 75 65 7d 2c 79 4d 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 2c 61 2c 6d 29 7b 66 6f 72 28 3b 7a 2e 6c 2e 6c 65 6e 67 74 68 3b 29 7b 6d 3d 28 7a 2e 67 3d 6e 75 6c 6c 2c 7a 2e 6c 29 2e 70 6f 70 28 29 3b 74 72 79 7b 61 3d 62 73 28 7a 2c 6d 29 7d 63 61 74 63 68 28 71 29 7b 6e 28 7a 2c 71 29 7d 69 66 28 77 26 26 7a 2e 67 29 7b 77 3d 7a 2e 67 2c 77 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4f 28 7a 2c 74 72 75 65 2c 74 72 75 65 29 7d 29 3b 62 72 65 61 6b 7d 7d 72 65 74 75 72 6e 20 61 7d 2c 78 34 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 2c 61 2c 6d 2c 71 2c 4d 2c 74 29 7b 66 6f 72 28 4d 3d 28 7a 2e 64 31 3d 28 7a 2e 67 31 3d 61 57 28 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 Data Ascii: ,P={passive:true,capture:true},yM=function(z,w,a,m){for(;z.l.length;){m=(z.g=null,z.l).pop();try{a=bs(z,m)}catch(q){n(z,q)}if(w&&z.g){w=z.g,w(function(){O(z,true,true)});break}}return a},x4=function(z,w,a,m,q,M,t){for(M=(z.d1=(z.g1=aW({get:function(){retu
2024-04-19 12:53:28 UTC	1255	IN	Data Raw: 7a 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 2c 79 29 7b 28 4b 3d 47 28 28 79 3d 30 21 3d 47 28 46 2c 28 79 3d 42 28 46 29 2c 4b 3d 42 28 46 29 2c 79 29 29 2c 46 29 2c 4b 29 2c 79 29 26 26 41 28 36 34 2c 46 2c 4b 29 7d 29 29 2c 30 29 2c 30 5d 29 2c 67 29 29 2c 7a 29 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 2c 79 2c 62 29 7b 21 44 28 74 72 75 65 2c 66 61 6c 73 65 2c 4b 2c 46 29 26 26 28 4b 3d 57 74 28 46 29 2c 79 3d 4b 2e 4f 4f 2c 62 3d 4b 2e 6b 74 2c 46 2e 5a 3d 3d 46 7c 7c 79 3d 3d 46 2e 48 5a 26 26 62 3d 3d 46 29 26 26 28 41 28 4b 2e 56 6f 2c 46 2c 79 2e 61 70 70 6c 79 28 62 2c 4b 2e 52 29 29 2c 46 2e 41 3d 46 2e 59 28 29 29 7d 29 2c 7a 29 2c 5b 5d 29 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 2c 79 2c 62 2c 57 2c 64 Data Ascii: z),function(){}),function(F,K,y){(K=G((y=0!=G(F,(y=B(F),K=B(F),y)),F),K),y)&&A(64,F,K)})),0),0]),g)),z),function(F,K,y,b){!D(true,false,K,F)&&(K=Wt(F),y=K.OO,b=K.kt,F.Z==F\|\|y==F.HZ&&b==F)&&(A(K.Vo,F,y.apply(b,K.R)),F.A=F.Y())}),z),[]),function(F,K,y,b,W,d
2024-04-19 12:53:28 UTC	1255	IN	Data Raw: 62 2c 46 2c 66 75 6e 63 74 69 6f 6e 28 59 2c 5a 2c 78 2c 66 2c 72 29 7b 66 6f 72 28 72 3d 28 5a 3d 28 66 3d 5b 5d 2c 30 29 2c 5b 5d 29 3b 5a 3c 53 3b 5a 2b 2b 29 7b 69 66 28 21 28 78 3d 6c 5b 5a 5d 2c 57 5b 5a 5d 29 29 7b 66 6f 72 28 3b 78 3e 3d 66 2e 6c 65 6e 67 74 68 3b 29 66 2e 70 75 73 68 28 42 28 59 29 29 3b 78 3d 66 5b 78 5d 7d 72 2e 70 75 73 68 28 78 29 7d 59 2e 48 3d 55 36 28 28 59 2e 47 3d 55 36 28 64 2e 73 6c 69 63 65 28 29 2c 59 29 2c 72 29 2c 59 29 7d 29 7d 29 29 2c 7a 29 2e 50 5a 3d 30 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 2c 79 2c 62 29 7b 41 28 28 4b 3d 42 28 28 79 3d 28 62 3d 42 28 46 29 2c 42 29 28 46 29 2c 46 29 29 2c 4b 29 2c 46 2c 47 28 46 2c 62 29 7c 7c 47 28 46 2c 79 29 29 7d 29 29 2c 37 34 29 2c 7a 2c 4a 28 34 29 29 2c 7a 29 2c 35 Data Ascii: b,F,function(Y,Z,x,f,r){for(r=(Z=(f=[],0),[]);Z<S;Z++){if(!(x=l[Z],W[Z])){for(;x>=f.length;)f.push(B(Y));x=f[x]}r.push(x)}Y.H=U6((Y.G=U6(d.slice(),Y),r),Y)})})),z).PZ=0,function(F,K,y,b){A((K=B((y=(b=B(F),B)(F),F)),K),F,G(F,b)\|\|G(F,y))})),74),z,J(4)),z),5
2024-04-19 12:53:28 UTC	1255	IN	Data Raw: 57 29 7d 29 2c 7a 29 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 2c 79 2c 62 2c 57 2c 64 2c 6c 29 7b 66 6f 72 28 62 3d 28 6c 3d 28 57 3d 28 4b 3d 28 64 3d 42 28 46 29 2c 4d 78 28 46 29 29 2c 22 22 29 2c 47 28 46 2c 31 33 35 29 29 2c 6c 2e 6c 65 6e 67 74 68 29 2c 79 3d 30 3b 4b 2d 2d 3b 29 79 3d 28 28 79 7c 30 29 2b 28 4d 78 28 46 29 7c 30 29 29 25 62 2c 57 2b 3d 74 5b 6c 5b 79 5d 5d 3b 41 28 64 2c 46 2c 57 29 7d 29 2c 41 29 28 33 30 32 2c 7a 2c 30 29 2c 66 75 6e 63 74 69 6f 6e 28 46 29 7b 74 73 28 46 2c 31 29 7d 29 29 2c 7a 29 2c 7b 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 4b 29 7b 28 46 3d 28 4b 3d 42 28 46 29 2c 47 28 46 2e 5a 2c 4b 29 29 2c 46 29 5b 30 5d 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 46 5b 31 5d 2c 46 5b 32 5d 2c 50 29 7d Data Ascii: W)}),z),function(F,K,y,b,W,d,l){for(b=(l=(W=(K=(d=B(F),Mx(F)),""),G(F,135)),l.length),y=0;K--;)y=((y\|0)+(Mx(F)\|0))%b,W+=t[l[y]];A(d,F,W)}),A)(302,z,0),function(F){ts(F,1)})),z),{}),function(F,K){(F=(K=B(F),G(F.Z,K)),F)[0].removeEventListener(F[1],F[2],P)}
2024-04-19 12:53:28 UTC	1255	IN	Data Raw: 34 5d 26 26 28 7a 2e 69 3d 74 72 75 65 29 2c 77 5b 35 5d 26 26 28 7a 2e 49 3d 74 72 75 65 29 2c 77 5b 36 5d 26 26 28 7a 2e 54 3d 74 72 75 65 29 2c 7a 2e 6a 28 77 29 3b 65 6c 73 65 20 69 66 28 71 3d 3d 6b 34 29 7a 2e 42 3d 74 72 75 65 2c 7a 2e 6a 28 77 29 3b 65 6c 73 65 20 69 66 28 71 3d 3d 63 74 29 7b 7a 2e 49 3d 74 72 75 65 3b 74 72 79 7b 66 6f 72 28 6d 3d 30 3b 6d 3c 7a 2e 46 2e 6c 65 6e 67 74 68 3b 6d 2b 2b 29 74 72 79 7b 61 3d 7a 2e 46 5b 6d 5d 2c 61 5b 30 5d 5b 61 5b 31 5d 5d 28 61 5b 32 5d 29 7d 63 61 74 63 68 28 4d 29 7b 7d 7d 63 61 74 63 68 28 4d 29 7b 7d 28 30 2c 77 5b 31 5d 29 28 66 75 6e 63 74 69 6f 6e 28 4d 2c 74 29 7b 7a 2e 6f 73 28 4d 2c 74 72 75 65 2c 74 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 4d 29 7b 28 28 4d 3d 21 7a 2e 6c 2e 6c 65 6e 67 74 Data Ascii: 4]&&(z.i=true),w[5]&&(z.I=true),w[6]&&(z.T=true),z.j(w);else if(q==k4)z.B=true,z.j(w);else if(q==ct){z.I=true;try{for(m=0;m<z.F.length;m++)try{a=z.F[m],a[0][a[1]](a[2])}catch(M){}}catch(M){}(0,w[1])(function(M,t){z.os(M,true,t)},function(M){((M=!z.l.lengt
2024-04-19 12:53:28 UTC	1255	IN	Data Raw: 63 74 69 6f 6e 28 7a 2c 77 29 7b 69 66 28 28 77 3d 67 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 7a 3d 6e 75 6c 6c 2c 21 77 29 7c 7c 21 77 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 7a 3b 74 72 79 7b 7a 3d 77 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 53 45 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 53 45 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 53 45 7d 29 7d 63 61 74 63 68 28 61 29 7b 67 2e 63 6f 6e 73 6f 6c 65 26 26 67 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 61 2e 6d 65 73 73 61 67 65 29 7d 72 65 74 75 72 6e 20 7a 7d 2c 44 3d 66 75 6e 63 74 69 6f 6e 28 7a 2c 77 2c 61 2c 6d 2c 71 2c 4d 2c 74 2c 46 2c 4b 29 7b 69 66 28 28 28 28 74 3d 28 71 3d 28 4b 3d 30 3c 28 7a 7c 7c 6d Data Ascii: ction(z,w){if((w=g.trustedTypes,z=null,!w)\|\|!w.createPolicy)return z;try{z=w.createPolicy("bg",{createHTML:SE,createScript:SE,createScriptURL:SE})}catch(a){g.console&&g.console.error(a.message)}return z},D=function(z,w,a,m,q,M,t,F,K){if((((t=(q=(K=0<(z\|\|m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49724	142.250.9.105	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:28 UTC	1444	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm- HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=yXfhXW7z1TctwEQdQ8yPo0M-H5o67uKvSJ8NeCDJiu4yhWoKen9BBYaZMjt9u2Kaf65D-qrmRos8lbjWmlsQtdnJ-GHFAcvtOnTkycSU9JrONLLhlTP4JBxNIA-ER1K4eSRFggiZPox_q0ldouNjT1TJ0sSFtsvSm6dhxx0J0C0B9iSgxyE5Kf6n8ZB65xW9uYFtNBfp9m1vNd47_QEvNU9S2LWFc9vsQFPCeddhX_9bkkDC7QvuzFsCg1QYTzSNOugmIR2-HK67HAthHcKgZxMo7CG1icU&cb=zi39nrm9z11q Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:28 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Fri, 19 Apr 2024 12:53:28 GMT Date: Fri, 19 Apr 2024 12:53:28 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 12:53:28 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js');
2024-04-19 12:53:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49727	142.250.9.105	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:29 UTC	1165	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:29 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 12 Apr 2024 15:00:22 GMT Expires: Sat, 20 Apr 2024 15:00:22 GMT Cache-Control: public, max-age=691200 Age: 597187 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 12:53:29 UTC	548	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-04-19 12:53:29 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C;
2024-04-19 12:53:29 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4S4
2024-04-19 12:53:29 UTC	1255	IN	Data Raw: ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-04-19 12:53:29 UTC	1117	IN	Data Raw: ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49729	142.250.9.105	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:29 UTC	1354	OUT	GET /recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GMDSibEGIjDi5rcUlbbhOREq26cBp8-EYYl9rGBczFjgGp4q4wVQlSwgwDfoTSNOyVr9r91JIwcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:29 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 19 Apr 2024 12:53:29 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-IKI-dkPvDL8MKep8q0hUAQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 12:53:29 UTC	364	IN	Data Raw: 31 64 31 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 Data Ascii: 1d11<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face
2024-04-19 12:53:29 UTC	1255	IN	Data Raw: 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e Data Ascii: v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fon
2024-04-19 12:53:29 UTC	1255	IN	Data Raw: 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 Data Ascii: 20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E0
2024-04-19 12:53:29 UTC	1255	IN	Data Raw: 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b Data Ascii: U+04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-19 12:53:29 UTC	1255	IN	Data Raw: 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b Data Ascii: ce { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+
2024-04-19 12:53:29 UTC	1255	IN	Data Raw: 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 Data Ascii: tic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight
2024-04-19 12:53:29 UTC	810	IN	Data Raw: 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 49 4b 49 2d 64 6b 50 76 44 4c 38 4d 4b 65 70 38 71 30 68 55 41 51 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f Data Ascii: }</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/styles__ltr.css"><script nonce="IKI-dkPvDL8MKep8q0hUAQ" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.co
2024-04-19 12:53:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49730	172.253.124.99	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:29 UTC	700	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:29 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 12 Apr 2024 14:48:14 GMT Expires: Sat, 20 Apr 2024 14:48:14 GMT Cache-Control: public, max-age=691200 Age: 597915 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 12:53:29 UTC	548	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-04-19 12:53:29 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C;
2024-04-19 12:53:29 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4S4
2024-04-19 12:53:29 UTC	1255	IN	Data Raw: ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-04-19 12:53:29 UTC	1117	IN	Data Raw: ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49737	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:33 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713531181035&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-19 12:53:33 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-19 12:53:33 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-19 12:53:33 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: BEFE8CD074C74F7BB94B0EBF838DC7F6 Ref B: LAX311000115007 Ref C: 2024-04-19T12:53:33Z Date: Fri, 19 Apr 2024 12:53:33 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1713531213.1130bcbf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49739	142.250.9.105	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:40 UTC	1173	OUT	POST /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 7876 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:40 UTC	7876	OUT	Data Raw: 0a 18 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 12 e4 10 30 33 41 46 63 57 65 41 37 61 54 6e 2d 6c 6c 7a 58 6e 31 4b 62 65 4b 6b 57 47 5f 4b 68 62 5a 47 35 63 70 33 6b 4e 47 4b 4f 61 4e 73 7a 51 56 6f 75 58 63 2d 4d 43 46 61 36 57 69 79 54 41 72 52 43 51 65 33 34 48 31 59 37 78 58 74 77 32 44 54 49 61 70 42 4d 74 50 34 30 77 51 57 6c 77 5f 36 78 67 42 57 71 4e 41 79 4d 78 31 64 47 4e 4f 71 2d 48 4d 48 76 50 4a 2d 4f 4e 4e 5f 68 70 4a 75 7a 48 65 69 41 76 32 62 47 74 4f 73 74 57 51 53 72 47 70 53 79 72 76 32 42 64 59 47 47 75 55 31 52 34 30 42 6d 43 45 4b 38 38 69 64 4c 4e 36 4f 4f 41 4d 37 30 55 48 5a 65 6b 54 36 79 54 50 56 74 54 6c 6d 41 36 32 64 49 32 36 4f 31 46 4a 77 53 76 4e 54 57 54 45 4b 6d 4d 4f 45 71 4c 33 5a 43 73 Data Ascii: rz4DvU-cY2JYCwHSTck0_qm-03AFcWeA7aTn-llzXn1KbeKkWG_KhbZG5cp3kNGKOaNszQVouXc-MCFa6WiyTArRCQe34H1Y7xXtw2DTIapBMtP40wQWlw_6xgBWqNAyMx1dGNOq-HMHvPJ-ONN_hpJuzHeiAv2bGtOstWQSrGpSyrv2BdYGGuU1R40BmCEK88idLN6OOAM70UHZekT6yTPVtTlmA62dI26O1FJwSvNTWTEKmMOEqL3ZCs
2024-04-19 12:53:40 UTC	696	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Fri, 19 Apr 2024 12:53:40 GMT Expires: Fri, 19 Apr 2024 12:53:40 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: _GRECAPTCHA=09ALYNOaiDvZiMdbo1yJv8Mv__UwW8paAFf-LZaGJ3my55xJbxgh3fc03p3tnaoy4fZ-qgaGbwCXtJOEiMU52z2Yg;Path=/recaptcha;Expires=Wed, 16-Oct-2024 12:53:40 GMT;Secure;HttpOnly;Priority=HIGH;SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 12:53:40 UTC	559	IN	Data Raw: 32 33 36 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 36 4a 6d 41 6c 55 72 62 66 6c 7a 48 79 6e 37 63 6c 35 4f 33 4a 69 32 62 72 54 43 48 47 50 48 44 77 4a 45 68 73 6f 42 62 70 69 70 62 51 5f 76 64 62 39 4c 54 33 36 33 32 4f 78 2d 58 34 36 47 52 66 41 62 63 34 31 34 31 42 76 35 79 57 62 52 59 66 63 50 4d 4d 78 64 78 32 74 30 33 51 77 47 48 30 65 5f 65 70 79 75 7a 56 39 6d 2d 78 72 6f 33 52 4d 6b 6c 72 36 76 33 77 65 48 61 45 57 5f 79 78 5f 47 34 36 77 36 68 77 43 49 5a 44 77 72 45 6f 44 32 44 56 56 65 2d 31 30 38 59 30 55 52 6a 34 37 31 58 54 66 52 74 78 2d 4d 38 77 53 53 34 70 75 5a 50 6b 58 79 78 48 65 61 59 37 32 63 49 4a 61 39 76 75 45 37 6a 6e 54 51 50 55 7a 46 73 70 54 6c 38 56 4b 34 5f 51 2d 64 33 31 54 31 55 62 55 76 Data Ascii: 236)]}'["rresp","03AFcWeA6JmAlUrbflzHyn7cl5O3Ji2brTCHGPHDwJEhsoBbpipbQ_vdb9LT3632Ox-X46GRfAbc4141Bv5yWbRYfcPMMxdx2t03QwGH0e_epyuzV9m-xro3RMklr6v3weHaEW_yx_G46w6hwCIZDwrEoD2DVVe-108Y0URj471XTfRtx-M8wSS4puZPkXyxHeaY72cIJa9vuE7jnTQPUzFspTl8VK4_Q-d31T1UbUv
2024-04-19 12:53:40 UTC	14	IN	Data Raw: 51 49 56 52 56 4a 71 55 46 73 4c 5a 0d 0a Data Ascii: QIVRVJqUFsLZ
2024-04-19 12:53:40 UTC	1255	IN	Data Raw: 61 33 63 0d 0a 5f 69 44 76 47 4d 72 55 73 6a 4b 37 54 5a 79 63 4e 41 68 53 35 70 37 75 37 73 71 39 74 2d 78 78 72 68 41 61 34 57 75 5f 51 79 6f 41 64 5f 35 53 5a 51 6e 6e 33 48 32 56 36 70 32 4e 6d 35 71 6a 65 48 65 4c 49 4a 71 39 65 77 37 4d 59 4f 36 47 75 53 7a 34 34 77 69 6f 73 55 67 34 58 46 66 73 39 32 6c 4d 53 5a 4a 6c 48 64 64 63 56 7a 64 47 69 73 4c 58 4a 56 58 61 67 44 42 30 37 45 62 78 47 45 38 70 66 2d 79 6d 70 77 47 69 74 69 38 37 56 78 44 57 69 35 46 54 5f 62 75 59 2d 39 74 47 43 51 74 79 72 4a 42 6b 37 61 67 34 54 78 6a 37 37 5f 35 38 4b 53 73 76 46 77 44 4f 54 59 31 71 61 4c 43 45 2d 6e 57 43 56 71 67 4c 51 67 54 6b 4f 70 63 78 71 53 48 66 59 74 50 43 78 71 59 70 5a 6a 57 68 71 33 76 79 59 73 63 57 43 71 4d 63 4d 70 59 54 4d 35 39 67 77 6d Data Ascii: a3c_iDvGMrUsjK7TZycNAhS5p7u7sq9t-xxrhAa4Wu_QyoAd_5SZQnn3H2V6p2Nm5qjeHeLIJq9ew7MYO6GuSz44wiosUg4XFfs92lMSZJlHddcVzdGisLXJVXagDB07EbxGE8pf-ympwGiti87VxDWi5FT_buY-9tGCQtyrJBk7ag4Txj77_58KSsvFwDOTY1qaLCE-nWCVqgLQgTkOpcxqSHfYtPCxqYpZjWhq3vyYscWCqMcMpYTM59gwm
2024-04-19 12:53:40 UTC	1255	IN	Data Raw: 45 41 76 68 4a 74 58 4e 74 41 62 70 73 76 6f 74 42 6b 68 38 56 75 77 62 77 74 42 33 41 69 4b 30 30 42 6c 7a 4c 54 76 33 72 50 74 70 35 33 73 37 7a 62 62 5a 4b 4e 32 4c 5f 49 4f 5a 46 35 59 47 42 72 52 53 44 4e 44 54 49 78 37 68 36 78 74 4d 56 36 64 36 41 79 35 36 56 6b 4f 6e 36 63 53 69 6d 68 4b 63 55 33 47 41 59 37 6c 74 39 68 2d 77 37 58 44 55 61 4c 4f 51 33 32 48 49 33 48 42 39 34 36 48 59 31 73 37 6d 33 46 4f 6f 49 47 70 75 42 55 50 56 4c 35 47 42 44 4e 4e 50 32 75 74 31 79 6f 44 49 67 70 6c 39 77 53 64 67 6c 34 39 44 67 50 55 47 48 50 38 70 35 36 69 5f 68 37 47 55 6f 31 62 4d 4a 30 66 72 4e 6b 49 43 33 73 64 68 7a 76 61 67 46 73 4c 57 47 39 6d 64 6e 4f 37 4d 6a 55 4a 5a 50 61 67 6d 31 32 47 74 59 67 55 2d 47 67 73 6a 30 76 35 55 69 49 42 38 69 69 64 Data Ascii: EAvhJtXNtAbpsvotBkh8VuwbwtB3AiK00BlzLTv3rPtp53s7zbbZKN2L_IOZF5YGBrRSDNDTIx7h6xtMV6d6Ay56VkOn6cSimhKcU3GAY7lt9h-w7XDUaLOQ32HI3HB946HY1s7m3FOoIGpuBUPVL5GBDNNP2ut1yoDIgpl9wSdgl49DgPUGHP8p56i_h7GUo1bMJ0frNkIC3sdhzvagFsLWG9mdnO7MjUJZPagm12GtYgU-Ggsj0v5UiIB8iid
2024-04-19 12:53:40 UTC	117	IN	Data Raw: 47 4a 51 56 5f 33 79 78 33 4f 31 66 58 75 62 62 61 6c 4b 52 42 32 6f 79 51 7a 46 32 6d 72 6c 44 54 54 77 71 6f 47 6b 31 62 32 70 39 7a 30 51 41 44 37 4d 65 32 57 32 6c 33 55 42 65 71 32 43 69 36 39 62 2d 68 76 46 59 4b 5f 4a 4d 57 50 55 2d 72 42 48 4f 50 74 46 43 37 4e 2d 34 78 57 79 78 50 4b 69 6f 62 72 51 32 6a 65 31 74 48 44 6a 44 4f 54 49 0d 0a Data Ascii: GJQV_3yx3O1fXubbalKRB2oyQzF2mrlDTTwqoGk1b2p9z0QAD7Me2W2l3UBeq2Ci69b-hvFYK_JMWPU-rBHOPtFC7N-4xWyxPKiobrQ2je1tHDjDOTI
2024-04-19 12:53:40 UTC	1255	IN	Data Raw: 31 35 38 63 0d 0a 73 71 58 37 5f 62 53 71 64 45 41 4a 34 74 62 39 58 39 66 58 67 50 30 58 43 6e 4c 50 34 4e 4c 57 31 4d 50 39 78 33 38 47 59 72 59 46 6a 65 69 7a 66 63 4a 49 4f 67 33 72 69 72 76 32 41 7a 4a 68 6f 38 7a 50 6e 49 34 50 65 66 44 7a 69 73 41 5a 4a 67 5f 65 43 66 39 34 46 47 77 66 33 46 49 55 42 54 42 4a 4c 44 57 54 34 49 6f 59 49 37 67 74 4c 6b 66 57 48 73 41 59 34 64 6c 6b 4a 56 64 53 48 73 4e 4e 48 45 59 43 47 34 2d 51 53 55 59 57 70 56 54 7a 36 66 77 31 67 58 6d 57 5f 36 6c 31 6e 58 64 6d 79 34 35 75 73 43 4f 52 6e 42 68 6e 54 67 59 37 38 75 41 38 55 32 36 7a 36 6e 4f 65 49 68 73 6a 37 57 67 77 41 50 4b 72 51 6e 59 44 41 51 35 4a 45 6c 71 6e 5f 45 65 7a 31 47 70 39 53 65 39 77 59 55 33 30 53 79 55 30 6c 56 6f 6b 57 6d 6b 39 31 48 4a 30 6c Data Ascii: 158csqX7_bSqdEAJ4tb9X9fXgP0XCnLP4NLW1MP9x38GYrYFjeizfcJIOg3rirv2AzJho8zPnI4PefDzisAZJg_eCf94FGwf3FIUBTBJLDWT4IoYI7gtLkfWHsAY4dlkJVdSHsNNHEYCG4-QSUYWpVTz6fw1gXmW_6l1nXdmy45usCORnBhnTgY78uA8U26z6nOeIhsj7WgwAPKrQnYDAQ5JElqn_Eez1Gp9Se9wYU30SyU0lVokWmk91HJ0l
2024-04-19 12:53:40 UTC	1255	IN	Data Raw: 6f 36 74 68 74 38 6f 4c 6f 6d 58 38 68 7a 34 44 48 6b 49 6a 4e 4f 32 58 6b 47 4a 44 38 31 5a 44 34 7a 39 39 49 4a 43 44 4f 47 61 6b 5a 51 31 52 61 6d 34 33 54 36 68 45 5a 62 2d 4b 5a 75 51 66 68 46 5f 7a 66 6a 33 6e 57 52 78 5a 76 61 4c 4c 5a 63 58 33 4a 5f 31 56 35 36 77 6f 6a 65 67 4f 35 52 2d 47 44 66 4e 41 63 61 55 4d 74 42 7a 41 6e 66 4c 66 6d 42 71 4d 6c 38 4a 2d 79 70 65 38 77 6c 72 78 67 6e 72 64 52 50 4d 42 47 41 46 5f 37 68 4b 54 63 4c 4b 74 38 57 43 34 43 4a 4d 51 31 77 4d 54 6d 71 31 41 37 72 36 69 50 41 52 55 75 4f 43 6a 53 65 4b 52 76 49 4d 37 6c 69 46 37 55 6a 64 43 62 2d 5a 33 4b 75 4a 47 52 76 62 6e 6b 36 64 44 73 37 79 31 2d 2d 45 77 78 46 4b 78 6b 4e 70 32 6b 6a 75 43 79 39 4b 62 41 35 32 52 76 76 4a 79 41 31 76 45 55 7a 55 66 76 77 75 Data Ascii: o6tht8oLomX8hz4DHkIjNO2XkGJD81ZD4z99IJCDOGakZQ1Ram43T6hEZb-KZuQfhF_zfj3nWRxZvaLLZcX3J_1V56wojegO5R-GDfNAcaUMtBzAnfLfmBqMl8J-ype8wlrxgnrdRPMBGAF_7hKTcLKt8WC4CJMQ1wMTmq1A7r6iPARUuOCjSeKRvIM7liF7UjdCb-Z3KuJGRvbnk6dDs7y1--EwxFKxkNp2kjuCy9KbA52RvvJyA1vEUzUfvwu
2024-04-19 12:53:40 UTC	1255	IN	Data Raw: 34 71 5a 41 66 2d 52 36 50 4b 64 35 4f 5f 71 72 34 77 33 50 65 4b 65 61 59 66 62 4f 51 48 30 63 72 31 6f 79 58 49 58 44 73 42 66 43 68 44 63 71 4f 56 4a 6f 41 38 46 4d 4b 33 35 4c 5f 75 66 41 53 59 62 57 49 4f 6d 5f 63 5a 64 5f 35 47 53 32 66 73 59 73 30 5f 5a 36 74 38 78 76 54 4e 76 79 56 77 58 52 48 68 44 68 31 46 54 52 4b 5a 59 50 59 4b 68 33 51 4b 62 74 49 4f 33 35 70 4a 57 39 42 4e 50 2d 4b 31 33 65 76 71 61 72 74 70 4b 31 4a 67 7a 6a 4f 6a 41 67 77 46 45 75 6d 4c 73 69 52 44 48 4b 33 48 54 78 6d 61 58 4d 6b 53 74 34 63 64 56 4d 49 58 70 78 72 45 54 56 53 59 56 5a 37 43 54 59 56 64 30 69 56 6d 71 6f 64 31 61 6a 45 6e 34 77 64 79 69 64 53 4a 79 75 58 77 42 66 7a 73 4b 6c 67 59 46 73 5a 6b 49 4c 71 5a 5a 54 44 49 50 61 62 78 6a 64 4e 39 62 44 63 6d 68 Data Ascii: 4qZAf-R6PKd5O_qr4w3PeKeaYfbOQH0cr1oyXIXDsBfChDcqOVJoA8FMK35L_ufASYbWIOm_cZd_5GS2fsYs0_Z6t8xvTNvyVwXRHhDh1FTRKZYPYKh3QKbtIO35pJW9BNP-K13evqartpK1JgzjOjAgwFEumLsiRDHK3HTxmaXMkSt4cdVMIXpxrETVSYVZ7CTYVd0iVmqod1ajEn4wdyidSJyuXwBfzsKlgYFsZkILqZZTDIPabxjdN9bDcmh
2024-04-19 12:53:40 UTC	1255	IN	Data Raw: 42 6b 59 33 6c 77 53 44 4a 57 59 6e 6b 31 4e 48 46 6b 5a 45 70 58 4c 33 6c 54 59 32 56 53 56 69 73 31 52 54 64 56 4b 32 38 32 55 55 70 56 4c 32 78 79 63 32 46 56 55 30 31 31 56 58 42 43 55 6d 4e 75 4b 31 64 30 53 56 46 78 61 46 49 31 59 58 70 53 56 54 45 7a 65 6d 46 72 4c 7a 64 33 53 31 64 34 53 69 39 32 4c 7a 42 46 61 57 78 75 65 6e 46 6f 56 58 52 4a 4e 56 56 4b 64 6b 64 6f 57 6a 68 4f 55 47 5a 69 55 6b 4d 76 63 45 31 55 4d 30 52 50 53 44 52 77 55 32 45 76 63 46 4a 5a 4e 58 5a 51 62 55 46 59 52 56 64 6d 4f 47 64 4b 51 6e 56 5a 59 55 74 55 61 32 6c 31 55 7a 59 32 54 6b 64 55 59 31 6c 74 53 47 30 35 54 6c 56 74 62 55 6b 7a 63 31 4a 6d 4d 47 46 33 64 45 39 31 62 46 52 4f 57 55 74 47 55 6c 4a 36 65 55 46 54 53 55 35 43 4d 55 64 46 51 6c 64 51 65 46 4a 79 5a Data Ascii: BkY3lwSDJWYnk1NHFkZEpXL3lTY2VSVis1RTdVK282UUpVL2xyc2FVU011VXBCUmNuK1d0SVFxaFI1YXpSVTEzemFrLzd3S1d4Si92LzBFaWxuenFoVXRJNVVKdkdoWjhOUGZiUkMvcE1UM0RPSDRwU2EvcFJZNXZQbUFYRVdmOGdKQnVZYUtUa2l1UzY2TkdUY1ltSG05TlVtbUkzc1JmMGF3dE91bFROWUtGUlJ6eUFTSU5CMUdFQldQeFJyZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49740	172.253.124.99	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:40 UTC	856	OUT	GET /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09ALYNOaiDvZiMdbo1yJv8Mv__UwW8paAFf-LZaGJ3my55xJbxgh3fc03p3tnaoy4fZ-qgaGbwCXtJOEiMU52z2Yg; AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:40 UTC	518	IN	HTTP/1.1 405 HTTP method GET is not supported by this URL Content-Type: text/html; charset=UTF-8 Date: Fri, 19 Apr 2024 12:53:40 GMT Expires: Fri, 19 Apr 2024 12:53:40 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 12:53:40 UTC	244	IN	Data Raw: 65 65 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 21 2d 2d 20 47 53 45 20 44 65 66 61 75 6c 74 20 45 72 72 6f 72 20 2d 2d 3e 0a 3c 48 31 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 48 31 3e 0a 3c 48 32 3e 45 72 72 6f 72 20 34 30 35 3c 2f 48 32 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 0d 0a Data Ascii: ee<HTML><HEAD><TITLE>HTTP method GET is not supported by this URL</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000">... GSE Default Error --><H1>HTTP method GET is not supported by this URL</H1><H2>Error 405</H2></BODY></HTML>
2024-04-19 12:53:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49744	142.250.9.105	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:40 UTC	1454	OUT	GET /recaptcha/api2/payload?p=06AFcWeA5iV1k7FM9SM7_t9xIbwi9UgqdvXSXbhooYk-Hd9rLYhYsqcg0ZTFPEiEzKRKfYXz1G4M95wVmJUCc057g9RKdPqpYfE_dVRdrkPzBnxn-Q34G6PulDowhZhFY4BuJ7gTQwK8QnCX3G_xfLFqmmd6z2gFUE9snjTtbaKF-JKgZIj5_mxDpwTV6vkJ8YYLFnfxxBKrBs&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09ALYNOaiDvZiMdbo1yJv8Mv__UwW8paAFf-LZaGJ3my55xJbxgh3fc03p3tnaoy4fZ-qgaGbwCXtJOEiMU52z2Yg; AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:41 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Fri, 19 Apr 2024 12:53:41 GMT Date: Fri, 19 Apr 2024 12:53:41 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: 43 37 41 38 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 c2 01 c2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: C7A8JFIFC!"$"$C"}!1AQa"q
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: 9b 0d de 97 e3 75 95 61 ce dd 37 e5 69 98 28 27 3c 80 7d 3d 2b 87 83 5b d7 75 2b 15 17 4b 1d cc 6a b9 55 45 c1 27 d0 00 38 15 a3 a2 5a 78 8b 52 bd 12 dd e9 ed 69 0c 43 81 2b 7d ff 00 41 c7 38 af 22 9c 6a 5d a4 be 66 da 23 b3 b7 d1 e1 bb d5 25 be bc 7b 85 9a e8 91 09 b7 8b e4 24 f5 25 bb 81 df d7 15 dc f8 66 5f 0b f8 76 ea 73 15 db 42 cf 6e 9e 63 4d 95 67 c1 3c e3 f2 ae 7e d6 fb 56 8e de dd e0 b7 b7 86 08 62 f2 e4 1b 49 1b bd 8d 52 d4 ee 3e df 22 9b 9b 58 59 80 c6 e2 99 38 1c d7 6c 29 cd 3d 02 4a 29 5c e8 f5 3f 1a b5 bd fc b7 d0 48 91 d9 c8 a0 22 cd 19 0d 2e 07 07 e9 cd 78 b7 c5 4d 4a e3 56 d7 56 f2 e1 e2 79 3c 91 9f 28 61 47 b5 76 da b5 8c 9a b4 db ee ee af 8a 76 8d 67 29 18 ff 00 80 d7 9a 78 fa 15 b0 d7 5a ca 1d e6 25 85 7e fb 97 39 3e e6 b5 8d 29 c6 57 Data Ascii: ua7i('<}=+[u+KjUE'8ZxRiC+}A8"j]f#%{$%f_vsBncMg<~VbIR>"XY8l)=J)\?H".xMJVVy<(aGvvg)xZ%~9>)W
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: d1 ff 00 b5 00 d9 e0 3d 15 3a 1f b4 ae 3f 08 eb e7 21 9c 57 89 88 7a 9c b4 57 ba 14 63 f2 a3 ad 2d 73 5c d8 30 28 a5 e2 8a 63 b1 c2 e8 d2 8d fa e4 f1 65 55 90 81 cf 38 c5 65 f9 92 7d 83 4a b7 24 ec 2c ad 8f 7c d6 ae 9d 05 c4 7f f0 90 46 0c 05 a3 0e 1c b3 00 0e 07 f0 fa 9a ae d6 a1 74 3d 16 e8 b4 65 9a 65 40 a1 fe 6c 75 fb be 9e f5 db ec de cc e5 53 57 0f 17 31 3a ad e1 1d ac 46 6b 0b c3 9b b6 de 91 90 45 bb 56 ff 00 8d 2d da cf 59 d4 11 a5 49 73 64 87 2a 72 39 c5 62 f8 64 0c dd 0e de 49 fe 62 a2 c5 c7 55 73 67 e1 c5 9c 57 9e 25 b2 d3 75 17 6f b3 de 4a b1 c8 43 6d db cf 15 e9 d7 36 92 68 de 19 bf d3 2f 56 68 84 7a c4 86 d9 67 6f 98 c6 17 0b c6 39 18 39 ed 5e 3d 75 a8 0b 2d 48 bc 4d b2 58 a5 dc 9b 78 20 83 c5 7b 27 8a 75 b7 f1 3f 81 f4 ad 66 ea 35 59 27 bb Data Ascii: =:?!WzWc-s\0(ceU8e}J$,\|Ft=ee@luSW1:FkEV-YIsd*r9bdIbUsgW%uoJCm6h/Vhzgo99^=u-HMXx {'u?f5Y'
2024-04-19 12:53:41 UTC	339	IN	Data Raw: 1a 47 92 10 58 92 32 72 4d 73 ff 00 15 74 fd 2a c2 5d 34 69 f6 36 96 ec 43 31 11 20 19 c1 18 27 14 7b 38 ad 8b 85 75 19 a3 df ed 2f ed 67 d3 b4 ab 7d 3e ee c5 ef 60 b7 da be 6b e5 52 41 1a e4 1c 74 e0 9e 95 a1 a3 b2 2e 9f a6 b0 40 33 96 3e 5f 2b b9 b3 c0 fc 4d 7c 8f 0e bb 72 b7 25 4a 0c 2a 83 b9 58 83 93 5d 0e 97 e3 bd 67 4f 88 45 6b a8 de 5b a2 8c 2a ef dc ab f4 1d ab 3e 76 ba 1e 9b c3 e1 2a 2f 72 b6 be 6a c7 ab 78 96 1d 54 6a 33 1b 24 bb 32 5e eb e0 23 21 23 cb 8e 24 19 c7 61 9c 9f ca aa 7e d2 92 5b d9 f8 47 48 5b e0 1d 1e f5 c3 7c bb bb 31 19 fc eb 90 8b e3 6d e6 91 6f 05 b5 db da 49 f3 ef 59 65 88 86 2c 4f 39 3e b5 c2 7e d0 7f 11 b5 0f 18 f8 53 4f b1 8a 4b 45 96 2b cf 33 7d b4 85 49 f9 48 35 2e 6a 4e db 1b 55 c3 4e 50 52 bc 5a 8d f6 7a bf 91 89 a8 68 Data Ascii: GX2rMst]4i6C1 '{8u/g}>`kRAt.@3>_+M\|r%JX]gOEk[>v/rjxTj3$2^#!#$a~[GH[\|1moIYe,O9>~SOKE+3}IH5.jNUNPRZzh
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: d0 35 9c 8e eb 24 4a ee 1b aa 31 ea 2a 8b a0 75 2a 7b d5 cd 59 b3 a8 4b df 0d 81 ec 2a b0 38 e7 bd 6b 17 a1 84 b4 62 80 70 32 2a b5 f4 52 36 d7 8c 93 b7 ef 47 8e 18 55 1d 65 f5 c8 d0 0b 04 59 07 de 2d c6 7e 98 a2 c7 5b 59 a2 db 2d bc a9 2a f0 e3 1d 0f af b5 61 2a b1 7e ec 85 71 d6 d7 10 1b 45 46 54 8d 8c a7 e4 53 93 c5 5f f0 ec b1 4b aa 48 d1 38 60 19 57 35 ca 47 2b c5 a8 34 31 05 91 cc a5 95 c6 08 e7 da ba ab 09 45 ad f4 92 85 5c 07 5d dd be b5 cd 87 9c 9d 49 26 69 17 75 a9 de fc 77 d2 5b 4b f1 54 1a c3 16 78 2f ed e3 59 01 1f 74 88 c0 20 1f a7 35 f3 af c5 39 52 57 b1 78 9b 74 7b 1c 29 f5 1b f1 9a f6 9f 8c 3e 25 bb f1 6d fa bd 92 05 8a 08 c4 50 23 c8 40 c6 d0 37 91 eb 5e 63 a9 78 66 4b ed 3e 18 6f e4 c4 90 13 b1 a3 1b b8 3d 8d 7a 78 2a aa 8d 7e 79 6c 15 Data Ascii: 5$J1u{YK8kbp2R6GUeY-~[Y-a~qEFTS_KH8`W5G+41E\]I&iuw[KTx/Yt 59RWxt{)>%mP#@7^cxfK>o=zx*~yl
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: f4 7f 0e cd 8b 85 21 f7 70 05 77 5e 15 93 74 4e cf 80 03 13 cf 39 15 c2 78 7a db c9 2b 23 e1 78 fc 6b b1 f0 fe c6 57 3b 5f 0a 1b 9c f4 a9 2b a1 e6 50 05 bb d5 7c 53 21 39 0d ab ae 06 3a 80 0f 1f a5 5c 8c cb 9e 54 e4 fa 0a e3 bc 49 aa 5c e9 7e 17 f1 86 a9 65 20 59 53 58 c0 72 b9 3c b1 15 c5 d8 fc 57 f1 22 db a8 36 d6 92 e0 7d e6 4e 4d 2a e9 f3 68 14 a4 b6 67 b7 ae fa e0 be 2f cc a7 fb 22 df 76 5b cd 76 23 db 6e 2b 94 ff 00 85 cb ad 45 93 2e 93 66 7f 31 fd 6b 1a eb c5 17 1e 2b d7 7f b4 2e 60 58 04 50 e0 46 ac 48 e0 1e 79 e9 59 a4 ef 76 6a dd dd 8c 3b 4b b9 49 96 d3 96 8a 79 d5 4a 8f 50 dc 57 74 7c 5f e2 85 b6 16 67 5c 94 c2 83 66 c2 01 18 f4 c1 15 c1 78 7c 89 35 bb 38 8e 32 d7 00 e3 3e 84 d7 65 25 ac 32 5d 33 e0 72 78 19 c0 15 70 69 3d 48 9a d0 b5 73 e2 bf Data Ascii: !pw^tN9xz+#xkW;_+P\|S!9:\TI\~e YSXr<W"6}NM*hg/"v[v#n+E.f1k+.`XPFHyYvj;KIyJPWt\|_g\fx\|582>e%2]3rxpi=Hs
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: 96 26 0a 5e 12 43 2f 60 d9 ae cb c7 6e d7 5e 07 d4 63 39 25 8e de 07 61 27 1f a0 ad 38 ad 60 b7 d7 65 4b 71 b5 3e ce a7 93 9e 77 1a 6c f0 89 34 19 55 9b 01 bc ce 41 e7 82 4d 0d de 57 33 b6 96 3c a7 c5 be 17 8b 5b f1 2a 49 2d c0 88 fd 86 dd 00 03 93 88 c5 61 5d fc 3a b4 8d 7e d1 26 ac 89 1a f2 55 80 07 df 9c d7 ba 47 a5 a4 90 5b 48 26 64 2d 6d 1f 00 0f ee fd 2a 21 a1 db aa ed 57 c6 4f 20 c6 a7 fa 56 15 bd ac e7 a4 ac 8a 8c 13 47 cf 72 e8 f1 2e a1 25 be 93 6e d2 47 b1 41 fd e0 70 09 3d 73 5b fa 2d a4 96 37 42 de 61 87 54 25 b9 cd 7a ee a1 e1 4b 4b d8 fc a6 b8 78 79 c8 68 e3 55 6f cc 0a f3 7b eb 61 69 e2 4b 8b 61 23 48 23 56 50 cd d4 e0 f7 ab a7 16 a4 b5 b9 36 b3 3e 99 fd 9e 06 34 24 3d 39 af 9b fc 52 fb ad fc 54 c4 7c cf aa 48 57 8f fa 6a 4d 7d 29 f0 00 63 Data Ascii: &^C/`n^c9%a'8`eKq>wl4UAMW3<[I-a]:~&UG[H&d-m!WO VGr.%nGAp=s[-7BaT%zKKxyhUo{aiKa#H#VP6>4$=9RT\|HWjM})c
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: 2f 6d 64 f4 63 8c b5 d4 96 d8 b3 78 87 48 2d c0 37 63 6f 1c 70 a7 a9 f5 ad 27 01 6c 67 60 14 93 3a 8c e3 3d 89 eb 59 46 52 fe 22 d2 94 49 88 d6 e7 2a b8 e3 3b 4f 39 ad 18 26 90 c0 61 7f 2f e7 b9 04 8c 76 c1 ff 00 1a ed f6 56 dc de 75 63 b4 4a 85 f1 c7 4a 42 fc 64 d7 d1 86 1f 87 8d 1a 59 c9 a4 e9 f2 cf 0c 4b e6 88 e3 39 ce d1 9c 91 58 3f 68 f8 2f 33 14 73 a6 44 c3 aa b4 92 21 5f 63 c5 0a 9d c4 e6 8f 0e 2e 29 ad 20 3e 95 ef 36 fa 37 c1 fb e6 3f 66 9e ca 52 06 58 45 76 c7 6d 4b 37 81 3e 19 cb f7 77 26 3f bb 79 d3 f3 a1 c2 c5 29 a3 c0 d6 41 ea 2a 44 90 1e f5 ee 4d f0 cb c0 12 fc d1 5e 5d 28 f5 5b a4 22 81 f0 a3 c1 2c 3e 4d 62 f1 47 b4 a8 d4 3a 6b a0 b9 d1 e2 5b fe 94 57 b6 7f c2 a1 f0 af 6d 6e f7 1f 44 a2 a7 d9 a2 f9 91 f2 b2 c7 20 d3 35 96 d8 d8 59 9c 36 3f Data Ascii: /mdcxH-7cop'lg`:=YFR"I;O9&a/vVucJJBdYK9X?h/3sD!_c.) >67?fRXEvmK7>w&?y)ADM^]([",>MbG:k[WmnD 5Y6?
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: 45 11 6d 00 f5 af 4c 93 c1 1a 2a 59 48 3f e1 69 68 cd 74 ce 82 3d b6 f2 94 0b ce e2 4e de bd 30 2b 9d f1 56 94 34 91 3c 31 6b b6 ba d5 bb 40 7c ab 88 10 a0 ea 33 90 40 3d eb 29 53 94 52 63 f7 53 30 3c 2c 80 6a 11 ca 5b 6a ac 6e 73 ff 00 01 35 63 54 6d 32 6b 41 e5 c2 a6 e0 f5 91 7a 9a 87 c3 71 99 4c b1 e4 85 58 1a 40 07 a8 14 ae fb 53 71 8f 9c 70 31 4b 45 2b 8a 6b a1 e9 9a 55 d5 9c 3a 4d a4 72 5d c0 ae b1 28 20 c8 06 38 ac ab 39 e0 ff 00 84 93 cc f3 e2 11 85 7d cd bc 63 db 9a e2 2e de 48 ed c4 b1 c0 f2 02 70 38 ce 4d 67 36 a3 32 64 34 2a 18 76 35 b7 3b 46 0d 2e e7 ac eb 77 76 6f 64 c8 97 50 b1 24 60 07 14 cf 0d cd 6f 1e 90 82 4b 88 95 8b 33 60 b8 1d eb c8 9b 5a 97 77 cb 12 f1 56 60 d5 1d 94 6e 8f 1c f3 cd 0e 6e c0 a2 af b9 d7 f8 ea 44 98 91 14 8a f9 91 30 Data Ascii: EmLYH?iht=N0+V4<1k@\|3@=)SRcS0<,j[jns5cTm2kAzqLX@Sqp1KE+kU:Mr]( 89}c.Hp8Mg62d4v5;F.wvodP$`oK3`ZwV`nnD0
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: ec 58 ab 43 95 44 99 59 ad 4c 9d 52 38 ef e2 d4 f5 0b 78 84 36 ff 00 6d ca c6 a4 b0 55 63 c0 c9 e7 f3 ab be 0a d4 34 ed 0f c6 9a 6d c6 a5 6e 2e ac a2 b8 5f 3a 12 71 bd 33 c8 aa f7 93 6f b1 d5 c4 50 47 6b 1b dd a9 f2 51 89 54 19 e1 41 3c 9c 7b d6 55 f5 ab 36 ac ec ea 70 b8 6e 78 eb 58 c2 a2 8c f9 82 0d db 53 ea cf da 1e 1f 05 b5 9e 89 73 e1 68 f4 bd d3 2b 34 bf 63 75 24 29 00 ae e5 53 c7 5e fc d7 94 08 c6 c5 e3 b5 73 fe 09 90 cd 67 3a c9 20 25 00 18 ef 8c 57 4c a9 f2 2f d2 a2 a4 d4 99 36 64 26 3a 4f 2f 8a b0 56 90 8e 31 51 b8 22 b1 89 7a 9a 67 96 04 8a 7d ea c6 de b5 1b 8f 9d 7f de 15 50 f8 81 9f 50 7c 15 18 f0 89 c7 fc f1 6f e5 5f 3b 98 d7 cd 90 e3 ab b7 f3 35 f4 4f c1 bf 97 c1 ce 7a 7e e1 ff 00 f4 1a f9 ee 35 2f 23 01 fd e3 8f ce b7 9e c6 6b 72 7d 36 d0 Data Ascii: XCDYLR8x6mUc4mn._:q3oPGkQTA<{U6pnxXSsh+4cu$)S^sg: %WL/6d&:O/V1Q"zg}PP\|o_;5Oz~5/#kr}6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49750	172.253.124.99	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 12:53:41 UTC	1066	OUT	GET /recaptcha/api2/payload?p=06AFcWeA5iV1k7FM9SM7_t9xIbwi9UgqdvXSXbhooYk-Hd9rLYhYsqcg0ZTFPEiEzKRKfYXz1G4M95wVmJUCc057g9RKdPqpYfE_dVRdrkPzBnxn-Q34G6PulDowhZhFY4BuJ7gTQwK8QnCX3G_xfLFqmmd6z2gFUE9snjTtbaKF-JKgZIj5_mxDpwTV6vkJ8YYLFnfxxBKrBs&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09ALYNOaiDvZiMdbo1yJv8Mv__UwW8paAFf-LZaGJ3my55xJbxgh3fc03p3tnaoy4fZ-qgaGbwCXtJOEiMU52z2Yg; AEC=AQTF6HxgC8WkE-ni1uk050tMjhNQfwqH_FndzATXeF4bBBshHpgE9K1mEVA; NID=513=mT2STBWMFGaNA_ZUqKhzxtwvciGZilYXb9ZextghUPoBHd9SYCuinSddgg_nYRtCbX4WBmvABFP2s-A4qMibhMx9JnuyX7ymv66cBfL7-oFkIDPQMDcziiBIbDr7aax9KzodH8VQqujSDjAnWZN7xu57xXCZXCnFxMljcTzsmZ4
2024-04-19 12:53:41 UTC	419	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Fri, 19 Apr 2024 12:53:41 GMT Date: Fri, 19 Apr 2024 12:53:41 GMT Cache-Control: private, max-age=30 Transfer-Encoding: chunked X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: 43 37 41 38 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 c2 01 c2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: C7A8JFIFC!"$"$C"}!1AQa"q
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: 9b 0d de 97 e3 75 95 61 ce dd 37 e5 69 98 28 27 3c 80 7d 3d 2b 87 83 5b d7 75 2b 15 17 4b 1d cc 6a b9 55 45 c1 27 d0 00 38 15 a3 a2 5a 78 8b 52 bd 12 dd e9 ed 69 0c 43 81 2b 7d ff 00 41 c7 38 af 22 9c 6a 5d a4 be 66 da 23 b3 b7 d1 e1 bb d5 25 be bc 7b 85 9a e8 91 09 b7 8b e4 24 f5 25 bb 81 df d7 15 dc f8 66 5f 0b f8 76 ea 73 15 db 42 cf 6e 9e 63 4d 95 67 c1 3c e3 f2 ae 7e d6 fb 56 8e de dd e0 b7 b7 86 08 62 f2 e4 1b 49 1b bd 8d 52 d4 ee 3e df 22 9b 9b 58 59 80 c6 e2 99 38 1c d7 6c 29 cd 3d 02 4a 29 5c e8 f5 3f 1a b5 bd fc b7 d0 48 91 d9 c8 a0 22 cd 19 0d 2e 07 07 e9 cd 78 b7 c5 4d 4a e3 56 d7 56 f2 e1 e2 79 3c 91 9f 28 61 47 b5 76 da b5 8c 9a b4 db ee ee af 8a 76 8d 67 29 18 ff 00 80 d7 9a 78 fa 15 b0 d7 5a ca 1d e6 25 85 7e fb 97 39 3e e6 b5 8d 29 c6 57 Data Ascii: ua7i('<}=+[u+KjUE'8ZxRiC+}A8"j]f#%{$%f_vsBncMg<~VbIR>"XY8l)=J)\?H".xMJVVy<(aGvvg)xZ%~9>)W
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: d1 ff 00 b5 00 d9 e0 3d 15 3a 1f b4 ae 3f 08 eb e7 21 9c 57 89 88 7a 9c b4 57 ba 14 63 f2 a3 ad 2d 73 5c d8 30 28 a5 e2 8a 63 b1 c2 e8 d2 8d fa e4 f1 65 55 90 81 cf 38 c5 65 f9 92 7d 83 4a b7 24 ec 2c ad 8f 7c d6 ae 9d 05 c4 7f f0 90 46 0c 05 a3 0e 1c b3 00 0e 07 f0 fa 9a ae d6 a1 74 3d 16 e8 b4 65 9a 65 40 a1 fe 6c 75 fb be 9e f5 db ec de cc e5 53 57 0f 17 31 3a ad e1 1d ac 46 6b 0b c3 9b b6 de 91 90 45 bb 56 ff 00 8d 2d da cf 59 d4 11 a5 49 73 64 87 2a 72 39 c5 62 f8 64 0c dd 0e de 49 fe 62 a2 c5 c7 55 73 67 e1 c5 9c 57 9e 25 b2 d3 75 17 6f b3 de 4a b1 c8 43 6d db cf 15 e9 d7 36 92 68 de 19 bf d3 2f 56 68 84 7a c4 86 d9 67 6f 98 c6 17 0b c6 39 18 39 ed 5e 3d 75 a8 0b 2d 48 bc 4d b2 58 a5 dc 9b 78 20 83 c5 7b 27 8a 75 b7 f1 3f 81 f4 ad 66 ea 35 59 27 bb Data Ascii: =:?!WzWc-s\0(ceU8e}J$,\|Ft=ee@luSW1:FkEV-YIsd*r9bdIbUsgW%uoJCm6h/Vhzgo99^=u-HMXx {'u?f5Y'
2024-04-19 12:53:41 UTC	339	IN	Data Raw: 1a 47 92 10 58 92 32 72 4d 73 ff 00 15 74 fd 2a c2 5d 34 69 f6 36 96 ec 43 31 11 20 19 c1 18 27 14 7b 38 ad 8b 85 75 19 a3 df ed 2f ed 67 d3 b4 ab 7d 3e ee c5 ef 60 b7 da be 6b e5 52 41 1a e4 1c 74 e0 9e 95 a1 a3 b2 2e 9f a6 b0 40 33 96 3e 5f 2b b9 b3 c0 fc 4d 7c 8f 0e bb 72 b7 25 4a 0c 2a 83 b9 58 83 93 5d 0e 97 e3 bd 67 4f 88 45 6b a8 de 5b a2 8c 2a ef dc ab f4 1d ab 3e 76 ba 1e 9b c3 e1 2a 2f 72 b6 be 6a c7 ab 78 96 1d 54 6a 33 1b 24 bb 32 5e eb e0 23 21 23 cb 8e 24 19 c7 61 9c 9f ca aa 7e d2 92 5b d9 f8 47 48 5b e0 1d 1e f5 c3 7c bb bb 31 19 fc eb 90 8b e3 6d e6 91 6f 05 b5 db da 49 f3 ef 59 65 88 86 2c 4f 39 3e b5 c2 7e d0 7f 11 b5 0f 18 f8 53 4f b1 8a 4b 45 96 2b cf 33 7d b4 85 49 f9 48 35 2e 6a 4e db 1b 55 c3 4e 50 52 bc 5a 8d f6 7a bf 91 89 a8 68 Data Ascii: GX2rMst]4i6C1 '{8u/g}>`kRAt.@3>_+M\|r%JX]gOEk[>v/rjxTj3$2^#!#$a~[GH[\|1moIYe,O9>~SOKE+3}IH5.jNUNPRZzh
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: d0 35 9c 8e eb 24 4a ee 1b aa 31 ea 2a 8b a0 75 2a 7b d5 cd 59 b3 a8 4b df 0d 81 ec 2a b0 38 e7 bd 6b 17 a1 84 b4 62 80 70 32 2a b5 f4 52 36 d7 8c 93 b7 ef 47 8e 18 55 1d 65 f5 c8 d0 0b 04 59 07 de 2d c6 7e 98 a2 c7 5b 59 a2 db 2d bc a9 2a f0 e3 1d 0f af b5 61 2a b1 7e ec 85 71 d6 d7 10 1b 45 46 54 8d 8c a7 e4 53 93 c5 5f f0 ec b1 4b aa 48 d1 38 60 19 57 35 ca 47 2b c5 a8 34 31 05 91 cc a5 95 c6 08 e7 da ba ab 09 45 ad f4 92 85 5c 07 5d dd be b5 cd 87 9c 9d 49 26 69 17 75 a9 de fc 77 d2 5b 4b f1 54 1a c3 16 78 2f ed e3 59 01 1f 74 88 c0 20 1f a7 35 f3 af c5 39 52 57 b1 78 9b 74 7b 1c 29 f5 1b f1 9a f6 9f 8c 3e 25 bb f1 6d fa bd 92 05 8a 08 c4 50 23 c8 40 c6 d0 37 91 eb 5e 63 a9 78 66 4b ed 3e 18 6f e4 c4 90 13 b1 a3 1b b8 3d 8d 7a 78 2a aa 8d 7e 79 6c 15 Data Ascii: 5$J1u{YK8kbp2R6GUeY-~[Y-a~qEFTS_KH8`W5G+41E\]I&iuw[KTx/Yt 59RWxt{)>%mP#@7^cxfK>o=zx*~yl
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: f4 7f 0e cd 8b 85 21 f7 70 05 77 5e 15 93 74 4e cf 80 03 13 cf 39 15 c2 78 7a db c9 2b 23 e1 78 fc 6b b1 f0 fe c6 57 3b 5f 0a 1b 9c f4 a9 2b a1 e6 50 05 bb d5 7c 53 21 39 0d ab ae 06 3a 80 0f 1f a5 5c 8c cb 9e 54 e4 fa 0a e3 bc 49 aa 5c e9 7e 17 f1 86 a9 65 20 59 53 58 c0 72 b9 3c b1 15 c5 d8 fc 57 f1 22 db a8 36 d6 92 e0 7d e6 4e 4d 2a e9 f3 68 14 a4 b6 67 b7 ae fa e0 be 2f cc a7 fb 22 df 76 5b cd 76 23 db 6e 2b 94 ff 00 85 cb ad 45 93 2e 93 66 7f 31 fd 6b 1a eb c5 17 1e 2b d7 7f b4 2e 60 58 04 50 e0 46 ac 48 e0 1e 79 e9 59 a4 ef 76 6a dd dd 8c 3b 4b b9 49 96 d3 96 8a 79 d5 4a 8f 50 dc 57 74 7c 5f e2 85 b6 16 67 5c 94 c2 83 66 c2 01 18 f4 c1 15 c1 78 7c 89 35 bb 38 8e 32 d7 00 e3 3e 84 d7 65 25 ac 32 5d 33 e0 72 78 19 c0 15 70 69 3d 48 9a d0 b5 73 e2 bf Data Ascii: !pw^tN9xz+#xkW;_+P\|S!9:\TI\~e YSXr<W"6}NM*hg/"v[v#n+E.f1k+.`XPFHyYvj;KIyJPWt\|_g\fx\|582>e%2]3rxpi=Hs
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: 96 26 0a 5e 12 43 2f 60 d9 ae cb c7 6e d7 5e 07 d4 63 39 25 8e de 07 61 27 1f a0 ad 38 ad 60 b7 d7 65 4b 71 b5 3e ce a7 93 9e 77 1a 6c f0 89 34 19 55 9b 01 bc ce 41 e7 82 4d 0d de 57 33 b6 96 3c a7 c5 be 17 8b 5b f1 2a 49 2d c0 88 fd 86 dd 00 03 93 88 c5 61 5d fc 3a b4 8d 7e d1 26 ac 89 1a f2 55 80 07 df 9c d7 ba 47 a5 a4 90 5b 48 26 64 2d 6d 1f 00 0f ee fd 2a 21 a1 db aa ed 57 c6 4f 20 c6 a7 fa 56 15 bd ac e7 a4 ac 8a 8c 13 47 cf 72 e8 f1 2e a1 25 be 93 6e d2 47 b1 41 fd e0 70 09 3d 73 5b fa 2d a4 96 37 42 de 61 87 54 25 b9 cd 7a ee a1 e1 4b 4b d8 fc a6 b8 78 79 c8 68 e3 55 6f cc 0a f3 7b eb 61 69 e2 4b 8b 61 23 48 23 56 50 cd d4 e0 f7 ab a7 16 a4 b5 b9 36 b3 3e 99 fd 9e 06 34 24 3d 39 af 9b fc 52 fb ad fc 54 c4 7c cf aa 48 57 8f fa 6a 4d 7d 29 f0 00 63 Data Ascii: &^C/`n^c9%a'8`eKq>wl4UAMW3<[I-a]:~&UG[H&d-m!WO VGr.%nGAp=s[-7BaT%zKKxyhUo{aiKa#H#VP6>4$=9RT\|HWjM})c
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: 2f 6d 64 f4 63 8c b5 d4 96 d8 b3 78 87 48 2d c0 37 63 6f 1c 70 a7 a9 f5 ad 27 01 6c 67 60 14 93 3a 8c e3 3d 89 eb 59 46 52 fe 22 d2 94 49 88 d6 e7 2a b8 e3 3b 4f 39 ad 18 26 90 c0 61 7f 2f e7 b9 04 8c 76 c1 ff 00 1a ed f6 56 dc de 75 63 b4 4a 85 f1 c7 4a 42 fc 64 d7 d1 86 1f 87 8d 1a 59 c9 a4 e9 f2 cf 0c 4b e6 88 e3 39 ce d1 9c 91 58 3f 68 f8 2f 33 14 73 a6 44 c3 aa b4 92 21 5f 63 c5 0a 9d c4 e6 8f 0e 2e 29 ad 20 3e 95 ef 36 fa 37 c1 fb e6 3f 66 9e ca 52 06 58 45 76 c7 6d 4b 37 81 3e 19 cb f7 77 26 3f bb 79 d3 f3 a1 c2 c5 29 a3 c0 d6 41 ea 2a 44 90 1e f5 ee 4d f0 cb c0 12 fc d1 5e 5d 28 f5 5b a4 22 81 f0 a3 c1 2c 3e 4d 62 f1 47 b4 a8 d4 3a 6b a0 b9 d1 e2 5b fe 94 57 b6 7f c2 a1 f0 af 6d 6e f7 1f 44 a2 a7 d9 a2 f9 91 f2 b2 c7 20 d3 35 96 d8 d8 59 9c 36 3f Data Ascii: /mdcxH-7cop'lg`:=YFR"I;O9&a/vVucJJBdYK9X?h/3sD!_c.) >67?fRXEvmK7>w&?y)ADM^]([",>MbG:k[WmnD 5Y6?
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: 45 11 6d 00 f5 af 4c 93 c1 1a 2a 59 48 3f e1 69 68 cd 74 ce 82 3d b6 f2 94 0b ce e2 4e de bd 30 2b 9d f1 56 94 34 91 3c 31 6b b6 ba d5 bb 40 7c ab 88 10 a0 ea 33 90 40 3d eb 29 53 94 52 63 f7 53 30 3c 2c 80 6a 11 ca 5b 6a ac 6e 73 ff 00 01 35 63 54 6d 32 6b 41 e5 c2 a6 e0 f5 91 7a 9a 87 c3 71 99 4c b1 e4 85 58 1a 40 07 a8 14 ae fb 53 71 8f 9c 70 31 4b 45 2b 8a 6b a1 e9 9a 55 d5 9c 3a 4d a4 72 5d c0 ae b1 28 20 c8 06 38 ac ab 39 e0 ff 00 84 93 cc f3 e2 11 85 7d cd bc 63 db 9a e2 2e de 48 ed c4 b1 c0 f2 02 70 38 ce 4d 67 36 a3 32 64 34 2a 18 76 35 b7 3b 46 0d 2e e7 ac eb 77 76 6f 64 c8 97 50 b1 24 60 07 14 cf 0d cd 6f 1e 90 82 4b 88 95 8b 33 60 b8 1d eb c8 9b 5a 97 77 cb 12 f1 56 60 d5 1d 94 6e 8f 1c f3 cd 0e 6e c0 a2 af b9 d7 f8 ea 44 98 91 14 8a f9 91 30 Data Ascii: EmLYH?iht=N0+V4<1k@\|3@=)SRcS0<,j[jns5cTm2kAzqLX@Sqp1KE+kU:Mr]( 89}c.Hp8Mg62d4v5;F.wvodP$`oK3`ZwV`nnD0
2024-04-19 12:53:41 UTC	1255	IN	Data Raw: ec 58 ab 43 95 44 99 59 ad 4c 9d 52 38 ef e2 d4 f5 0b 78 84 36 ff 00 6d ca c6 a4 b0 55 63 c0 c9 e7 f3 ab be 0a d4 34 ed 0f c6 9a 6d c6 a5 6e 2e ac a2 b8 5f 3a 12 71 bd 33 c8 aa f7 93 6f b1 d5 c4 50 47 6b 1b dd a9 f2 51 89 54 19 e1 41 3c 9c 7b d6 55 f5 ab 36 ac ec ea 70 b8 6e 78 eb 58 c2 a2 8c f9 82 0d db 53 ea cf da 1e 1f 05 b5 9e 89 73 e1 68 f4 bd d3 2b 34 bf 63 75 24 29 00 ae e5 53 c7 5e fc d7 94 08 c6 c5 e3 b5 73 fe 09 90 cd 67 3a c9 20 25 00 18 ef 8c 57 4c a9 f2 2f d2 a2 a4 d4 99 36 64 26 3a 4f 2f 8a b0 56 90 8e 31 51 b8 22 b1 89 7a 9a 67 96 04 8a 7d ea c6 de b5 1b 8f 9d 7f de 15 50 f8 81 9f 50 7c 15 18 f0 89 c7 fc f1 6f e5 5f 3b 98 d7 cd 90 e3 ab b7 f3 35 f4 4f c1 bf 97 c1 ce 7a 7e e1 ff 00 f4 1a f9 ee 35 2f 23 01 fd e3 8f ce b7 9e c6 6b 72 7d 36 d0 Data Ascii: XCDYLR8x6mUc4mn._:q3oPGkQTA<{U6pnxXSsh+4cu$)S^sg: %WL/6d&:O/V1Q"zg}PP\|o_;5Oz~5/#kr}6

Target ID:	0
Start time:	14:53:11
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:53:16
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2260,i,16925381806868203602,13959119368343850401,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:53:17
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Windows Analysis Report
https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884