Edit tour

Windows Analysis Report
http://c.conversionlogic.net

Overview

General Information

Sample URL:	http://c.conversionlogic.net
Analysis ID:	1432206
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2184,i,4750710094024023776,5290538666169249574,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4392 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://c.conversionlogic.net" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4788Host: login.live.com

Source: chromecache_60.2.dr	String found in binary or memory: https://btloader.com/tag?o=5097926782615552&upapi=true
Source: chromecache_59.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_59.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_59.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_59.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_59.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=
Source: chromecache_58.2.dr, chromecache_74.2.dr	String found in binary or memory: https://godaddy.com/domain-parking/forsale/conversionlogic.net
Source: chromecache_60.2.dr	String found in binary or memory: https://img1.wsimg.com/parking-lander/static/css/main.8a1d19af.css
Source: chromecache_60.2.dr	String found in binary or memory: https://img1.wsimg.com/parking-lander/static/js/main.9bfaa532.js
Source: chromecache_70.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_70.2.dr	String found in binary or memory: https://partner.googleadservices.com/gampad/cookie.js
Source: chromecache_59.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_59.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_59.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_59.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_59.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_59.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_70.2.dr	String found in binary or memory: https://syndicatedsearch.goog
Source: chromecache_59.2.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: chromecache_60.2.dr	String found in binary or memory: https://www.google.com/adsense/domains/caf.js?abp=1&gdabp=true
Source: chromecache_59.2.dr, chromecache_54.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_59.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__.
Source: chromecache_55.2.dr, chromecache_54.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.7:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49778 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@18/45@34/13

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2184,i,4750710094024023776,5290538666169249574,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://c.conversionlogic.net"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2184,i,4750710094024023776,5290538666169249574,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://c.conversionlogic.net	0%	Avira URL Cloud	safe
http://c.conversionlogic.net	2%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
www10.smartname.com	0%	Virustotal	Browse
api.btloader.com	0%	Virustotal	Browse
ww1.conversionlogic.net	0%	Virustotal	Browse
ad-delivery.net	0%	Virustotal	Browse
c.conversionlogic.net	2%	Virustotal	Browse
btloader.com	0%	Virustotal	Browse
gddomainparking.com	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.btloader.com/mw/state?bt_env=prod	0%	URL Reputation	safe
https://syndicatedsearch.goog	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://ad-delivery.net/px.gif?ch=2	0%	URL Reputation	safe
http://ww1.conversionlogic.net/	0%	Avira URL Cloud	safe
https://btloader.com/tag?o=5097926782615552&upapi=true	0%	Avira URL Cloud	safe
https://btloader.com/tag?o=5097926782615552&upapi=true	0%	Virustotal		Browse
https://ad-delivery.net/px.gif?ch=1&e=0.27612668333241763	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
http://c.conversionlogic.net/	0%	Avira URL Cloud	safe
https://www.gstatic.c..?/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__.	0%	Avira URL Cloud	safe
http://ww1.conversionlogic.net/	0%	Virustotal		Browse
http://c.conversionlogic.net/	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gddomainparking.com	52.13.101.202	true	false	0%, Virustotal, Browse	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
www3.l.google.com	172.217.165.206	true	false		high
api.btloader.com	130.211.23.194	true	false	0%, Virustotal, Browse	unknown
c.conversionlogic.net	63.141.242.46	true	false	2%, Virustotal, Browse	unknown
ad.doubleclick.net	142.251.35.230	true	false		high
www.google.com	142.250.217.228	true	false		high
btloader.com	172.67.41.60	true	false	0%, Virustotal, Browse	unknown
www10.smartname.com	15.197.204.56	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
ad-delivery.net	104.26.3.70	true	false	0%, Virustotal, Browse	unknown
img1.wsimg.com	unknown	unknown	false		high
api.aws.parking.godaddy.com	unknown	unknown	false		high
ww1.conversionlogic.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.adsensecustomsearchads.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://btloader.com/tag?o=5097926782615552&upapi=true	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ww1.conversionlogic.net/lander	false		unknown
https://api.btloader.com/mw/state?bt_env=prod	false	URL Reputation: safe	unknown
http://ww1.conversionlogic.net/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ad-delivery.net/px.gif?ch=1&e=0.27612668333241763	false	Avira URL Cloud: safe	unknown
about:blank	false	Avira URL Cloud: safe	low
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250	false		high
https://ad-delivery.net/px.gif?ch=2	false	URL Reputation: safe	unknown
https://api.aws.parking.godaddy.com/v1/domains/domain?domain=ww1.conversionlogic.net&portfolioId=&abp=1&gdabp=true	false		high
https://www.google.com/recaptcha/api.js	false		high
http://c.conversionlogic.net/	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false		high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m	false		high
https://www.google.com/js/bg/lkTXq49YG5_ej1w7m4T9Nw_1Lx1Ocd1gteWQpsfV_Tk.js	false		high
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=ou76cc1SFuQyT9YeBPJC8JqqhMnzIft4uTanx-4-9sbqWE4NrVoMd-dFwdVYPVy9o3yHUAf1R87w9OYaEq5iMxhuMJfKl7Y4rbqoIwa393lC9jfkZ1_8zl4VBhX3MAVG92zSN7Fu_2Phxhmh1k-qITmQC5muNW6T1bmxaTlkcze6rrmHMzWEOtVvguGRbiWT8fq4lQmtHBi_uoOzTJc24CG4ZcAKxjOnbOG15IdVyEK_NCwPA33jV9ivnR_L9oFbmgH9wDdkOvwoBV0NuSUZsCMLKawzUnw&cb=hoty0np8z5p9	false		high
https://www.google.com/adsense/domains/caf.js?abp=1&gdabp=true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://img1.wsimg.com/parking-lander/static/css/main.8a1d19af.css	chromecache_60.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_59.2.dr	false		high
https://syndicatedsearch.goog	chromecache_70.2.dr	false	URL Reputation: safe	unknown
https://support.google.com/recaptcha#6262736	chromecache_59.2.dr	false		high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_59.2.dr	false		high
https://recaptcha.net	chromecache_59.2.dr	false	URL Reputation: safe	unknown
https://www.apache.org/licenses/	chromecache_59.2.dr	false		high
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_59.2.dr	false		high
https://cloud.google.com/contact	chromecache_59.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_59.2.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_59.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_59.2.dr	false		high
https://img1.wsimg.com/parking-lander/static/js/main.9bfaa532.js	chromecache_60.2.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_59.2.dr	false		high
https://www.gstatic.c..?/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__.	chromecache_59.2.dr	false	Avira URL Cloud: safe	low
https://godaddy.com/domain-parking/forsale/conversionlogic.net	chromecache_58.2.dr, chromecache_74.2.dr	false		high
https://www.google.com/recaptcha/api2/	chromecache_59.2.dr, chromecache_54.2.dr	false		high
https://support.google.com/recaptcha	chromecache_59.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.178.50.36	unknown	United States	15169	GOOGLEUS	false
104.26.3.70	ad-delivery.net	United States	13335	CLOUDFLARENETUS	false
172.217.165.206	www3.l.google.com	United States	15169	GOOGLEUS	false
63.141.242.46	c.conversionlogic.net	United States	33387	NOCIXUS	false
130.211.23.194	api.btloader.com	United States	15169	GOOGLEUS	false
52.13.101.202	gddomainparking.com	United States	16509	AMAZON-02US	false
142.251.35.230	ad.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.217.228	www.google.com	United States	15169	GOOGLEUS	false
15.197.204.56	www10.smartname.com	United States	7430	TANDEMUS	false
172.67.41.60	btloader.com	United States	13335	CLOUDFLARENETUS	false
142.250.217.174	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432206
Start date and time:	2024-04-26 17:16:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://c.conversionlogic.net
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@18/45@34/13
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.178.50.67, 74.125.196.84, 192.178.50.46, 34.104.35.123, 23.208.28.179, 23.208.28.169, 52.165.165.26, 192.229.211.108, 172.217.165.194, 13.85.23.206, 199.232.214.172, 142.250.217.195, 192.178.50.74, 172.217.2.202, 172.217.165.202, 142.250.217.170, 142.250.217.234, 172.217.15.202, 142.250.189.138, 192.178.50.42, 142.250.64.170, 142.250.217.202, 142.251.35.234, 142.250.64.234, 142.250.64.138, 142.250.64.202, 23.50.112.37, 23.50.112.36, 23.50.112.43, 23.50.112.33, 23.50.112.38, 23.50.112.35, 23.50.112.30, 23.50.112.29, 23.50.112.31, 142.250.217.163, 23.50.112.60, 23.50.112.56, 23.50.112.59, 23.50.112.52, 23.50.112.61, 23.50.112.48, 23.50.112.50, 23.50.112.54, 23.50.112.58, 142.250.217.227, 23.50.112.34, 23.50.112.45, 23.50.112.46, 23.50.112.41
Excluded domains from analysis (whitelisted): e40258.g.akamaiedge.net, slscr.update.microsoft.com, partner.googleadservices.com, clientservices.googleapis.com, partner46.googleadservices.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, www.gstatic.com, global-wildcard.wsimg.com.sni-only.edgekey.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, fonts.gstatic.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, wwwprod.www-bing-com.akadns.net, clients.l.google.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0950611313667666
Encrypted:	false
SSDEEP:	3:CUMllRPQEsJ9pse:Gl3QEsJLse
MD5:	AD4B0F606E0F8465BC4C4C170B37E1A3
SHA1:	50B30FD5F87C85FE5CBA2635CB83316CA71250D7
SHA-256:	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
SHA-512:	EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
Malicious:	false
Reputation:	low
URL:	https://ad-delivery.net/px.gif?ch=2
Preview:	GIF89a.............!.......,...........L..;

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1222), with no line terminators
Category:	downloaded
Size (bytes):	1222
Entropy (8bit):	5.818804287152988
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCLTLv138EgFB5vtTGJTlWtRcw1MuhtsLqo40RWUnYN:VKEctKonR3evtTA87b1Muh6LrwUnG
MD5:	463D838587C8B5873CB6E4E942B770C9
SHA1:	E69DCF383A6F3F51F123CA2D86F19FC4BE09E612
SHA-256:	1448EC1B3F30A554233BD280AA99A7EAF690D1098647E7DDDEA286C757884F9C
SHA-512:	F02DE64A37B90492D714CC7D132C49BF29CB5117CA945258BAF5B36D087A3A2AED165C6FF37D2ED4E4F10D7199AFB9C2B5E2555BA1BECA1A8D3AE133F4DF4B23
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-0lJkOVHDy3ItYlCbUoEzThjP3hLhLYfEFPAkVOCx

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.8013557344442175
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKVnIwN4wECWaee:PLKdXNQKVnDoCL
MD5:	284B36421A1CF446F32CB8F7987B1091
SHA1:	EB14D6298C9DA3FB26D75B54C087EA2DF9F3F05F
SHA-256:	94AB2BE973685680D0BE9C08D4E1A7465F3C09053CF631126BD33F49CC2F939B
SHA-512:	093F3F5624DE2E43E43EB06036107FF3260237F9E47E1F86FDFBA7C7036522187A9B47B291F5443C566658A8EF555E5033C7F2AC0C9F4FA8EB69EB8E2540B372
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js');

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17673)
Category:	downloaded
Size (bytes):	18268
Entropy (8bit):	5.619856960314813
Encrypted:	false
SSDEEP:	384:Va/VuX6x1E4rZ5gIcAGn5o86/TZeIeaedo/939zg:Ukqxe4rZ5gIcAGnQ/tEaeE9C
MD5:	9FBB8606566EBF96C502666BFFFD254A
SHA1:	FEB80CB296B30432EC659D7EEDFE3C6022A450E2
SHA-256:	9644D7AB8F581B9FDE8F5C3B9B84FD370FF52F1D4E71DD60B5E590A6C7D5FD39
SHA-512:	7C9C38D0710B52EE4761EEAC4E50BB8F5E319C5AFA49253888D0F45B42DB03DE244181AF62A0BC0431D0AB963AB04A5FD2263907CE0B1188BCB1F6954622204C
Malicious:	false
Reputation:	low
URL:	https://www.google.com/js/bg/lkTXq49YG5_ej1w7m4T9Nw_1Lx1Ocd1gteWQpsfV_Tk.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var f=function(R,N){if(!(N=(R=e.trustedTypes,null),R)\|\|!R.createPolicy)return N;try{N=R.createPolicy("bg",{createHTML:p,createScript:p,createScriptURL:p})}catch(P){e.console&&e.console.error(P.message)}return N},p=function(R){return R},e=this\|\|self;(0,eval)(function(R,N){return(N=f())&&1===R.eval(N.createScript("1"))?function(P){return N.createScript(P)}:function(P){return""+P}}(e)(Array(7824Math.random()\|0).join("\n")+['(function(){/',.'',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var Re=function(R,N){return R[N]<<24\|R[(N\|0)+1]<<16\|R[(N\|0)+2]<<8\|R[(N\|0)+3]},d=function(R,N,p){if(438==R\|\|331==R)N.X[R]?N.X[R].concat(p):N.X[R]=N_(p,N);else{if(N.ri&&247!=R)return;466==R\|\|163==R\|\|161==R\|\|301==R\|\|172==R\|\|120==R\|\|59==R\|\|298==R\|\|344==R?N.X[R]\|\|(N.X[R]=PR(N,p,R,142)):N.X[R]=PR(N,p,R,49)}247==R&&(N.h=q(false,32,N),N.R=void 0)},eZ=function(R,N,p,e){W((e=V((p=V(R),R)),e),R,z(N,Z(p,R)))},sH=

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	785
Entropy (8bit):	5.067114195077553
Encrypted:	false
SSDEEP:	24:Ye7/FvTjrL2+toGyGzfvTdm1DGCh9V8GxVbl53YGw:YeTFLfL2+EEfxwD/B8Mlip
MD5:	FAB4B3ABF84AB50177869FFECD1722CD
SHA1:	E0B3FAD545F29E323D115A42DB9EA9B09EFCA74F
SHA-256:	3E6FD114D2E01B5AF1236AEC7CB94077B428A2A2B43A0D1ADCA5706E1BF094F8
SHA-512:	C896D5A8700F5B03CF3384A9C1D5541D5EB51C8A88D3C1C108A71C3AFC3767B31C699ED41998CC35339D5C563FC152E688763BA5913FB26AB5C03F419D8EFED1
Malicious:	false
Reputation:	low
URL:	https://api.aws.parking.godaddy.com/v1/domains/domain?domain=ww1.conversionlogic.net&portfolioId=&abp=1&gdabp=true
Preview:	{"system":"SN","account":"11d1def534ea1be0XX107f50f7X15eb83c7750X14a ","customerId":"c0fe5efa-fc25-4359-b11f-7b474e292782","displayType":"ADS","dataSource":"INVENTORY","adSense":{"drid":"as-drid-2927860770008733","channel":"08272","pubId":"dp-namemedia08_3ph"},"domain":{"rootDomain":"conversionlogic.net","expiresAt":"","status":{"internal":"ACTIVE"},"isAdult":false,"hasAuction":false},"lander":{"template":"ARROW_3","domainDisplayName":"conversionlogic.net","headerText":"","footerText":"","headerHtml":"","footerHtml":"","banner":{"show":false,"text":"conversionlogic.net may be for sale!","link":"https://godaddy.com/domain-parking/forsale/conversionlogic.net","type":"FOR_SALE"},"i18n":true,"showDomain":true},"experiment":{"experiment":"","start":"","end":"","enabled":false}}.

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (631)
Category:	downloaded
Size (bytes):	517649
Entropy (8bit):	5.713376874006511
Encrypted:	false
SSDEEP:	6144:m1K1Z7NMxjW6eJoWvAlUjWwuMSYCVvLk8DSWd1Ps8Jz38iZc:m6eWTAujfuPY0JGgkt
MD5:	E2E79D6B927169D9E0E57E3BAECC0993
SHA1:	1299473950B2999BA0B7F39BD5E4A60EAFD1819D
SHA-256:	231336ED913A5EBD4445B85486E053CAF2B81CAB91318241375F3F7A245B6C6B
SHA-512:	D6A2ED7B19E54D1447EE9BBC684AF7101B48086945A938A5F9B6AE74ACE30B9A98CA83D3183814DD3CC40F251AB6433DC7F8B425F313EA9557B83E1C2E035DFF
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././*.. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that contro

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (619)
Category:	downloaded
Size (bytes):	620
Entropy (8bit):	5.130995475588531
Encrypted:	false
SSDEEP:	12:qTE0L26zFtAiSTFzU1UgYTJ5HSQHWVWSPD3LmRNVe2KPD3LqhTbk:0E0LRzKTFjpn2WSeRNVpKSh/k
MD5:	C68FB1D41CAD49A209B60F93A9928C8D
SHA1:	91B5F0F66167938216ED50E828360A307BF3765C
SHA-256:	71F2A7D958A01EC4E88D37756DFF5D9A39BD3CB67AC95B96198AC4267AF56FF2
SHA-512:	8CA45FCE63AD1D221B52DD174C36E343E51446157E183F0A466E50CDF626732FB75266A75B5AF00523EB59700EC9EB5045B87CA88A20E1DBA71B397354E04D4B
Malicious:	false
Reputation:	low
URL:	http://ww1.conversionlogic.net/lander
Preview:	<!doctype html><html lang="en"><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="icon" href="data:,"/><script src="https://www.google.com/adsense/domains/caf.js?abp=1&gdabp=true"></script><script src="https://btloader.com/tag?o=5097926782615552&upapi=true" async></script><script>window.LANDER_SYSTEM="CP"</script><script defer="defer" src="https://img1.wsimg.com/parking-lander/static/js/main.9bfaa532.js"></script><link href="https://img1.wsimg.com/parking-lander/static/css/main.8a1d19af.css" rel="stylesheet"></head><body><div id="root"></div></body></html>.

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.0950611313667666
Encrypted:	false
SSDEEP:	3:CUMllRPQEsJ9pse:Gl3QEsJLse
MD5:	AD4B0F606E0F8465BC4C4C170B37E1A3
SHA1:	50B30FD5F87C85FE5CBA2635CB83316CA71250D7
SHA-256:	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
SHA-512:	EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........L..;

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (392), with no line terminators
Category:	downloaded
Size (bytes):	392
Entropy (8bit):	5.468353324680309
Encrypted:	false
SSDEEP:	12:xWiTyTC85ES5LTaPGB7HJTy8R5LTaPGB7n:wmKdeGBz4YeGB7n
MD5:	2AFB12F9025F5DA7B0E0D4997F0B8139
SHA1:	D86E7C02EC246DFCDE1AA27E77A54A448A159A7B
SHA-256:	5ED538A520DB81A1EF1922AA35E7944B9F095675F2DACC8DD623C6D8C0680D3F
SHA-512:	2BB98F73FECF46EEAD2AB42B3A63B51B0C79D58430A1579CE449599730C8012177592AD907C03ACD2C847280D9C4AC3348CBA2C78226119AEF5B354BAD29597D
Malicious:	false
Reputation:	low
URL:	https://partner.googleadservices.com/gampad/cookie.js?domain=ww1.conversionlogic.net&client=dp-namemedia08_3ph&product=SAS&callback=__sasCookie
Preview:	__sasCookie({"_cookies_":[{"_value_":"ID=292f87b94f974dcb:T=1714144636:RT=1714144636:S=ALNI_MYPnV7q2I8gsl9DLPh2Oojw6vtu1w","_expires_":1747840636,"_path_":"/","_domain_":"conversionlogic.net","_version_":1},{"_value_":"UID=00000a21fdab65e5:T=1714144636:RT=1714144636:S=ALNI_MZtXV5pwOTmMxmQKKFx0M6O3At3ww","_expires_":1747840636,"_path_":"/","_domain_":"conversionlogic.net","_version_":2}]});

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	32
Entropy (8bit):	4.476409765557392
Encrypted:	false
SSDEEP:	3:H0hCkuWthHeTn:UUkuqxeT
MD5:	A3144EE887752BC84252FAACD4DFFD83
SHA1:	172430F70BAEDA54BB9F533293E0E80A2DA5835D
SHA-256:	8B87CFF79D0F8142D02D4A5991C83A5D59A7733BCB0EBEDD0DE57E559C6EAEFB
SHA-512:	E366210709098991B8B21140DF48E50CD650E115A30A8A5EEC016B98B077C6DA3FEE972BA219409AD72E85BF575A033E1E9AAC7931B727E4BA15644AAC5349D3
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAnLkdyF0ExqxBIFDVNaR8USEAk8dqZYMe7mkRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgAKCQoHDVNaR8UaAA==

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.0950611313667666
Encrypted:	false
SSDEEP:	3:CUMllRPQEsJ9pse:Gl3QEsJLse
MD5:	AD4B0F606E0F8465BC4C4C170B37E1A3
SHA1:	50B30FD5F87C85FE5CBA2635CB83316CA71250D7
SHA-256:	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
SHA-512:	EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........L..;

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (56421)
Category:	downloaded
Size (bytes):	56422
Entropy (8bit):	5.407954708763915
Encrypted:	false
SSDEEP:	768:bemBuCcWe7PSRkZF05HHto2BPPyWqCB/p/m0XN7JGVGaNtXnnci87KEdbrR:zurpRUZtb3PYZci87KoF
MD5:	84F984C3D00FB7CBA2F9D6E89BE7E0B3
SHA1:	95B398A1FEC6420F9439130C32D4685B761B5894
SHA-256:	3B6EF9764FC602A186791807E6FCEC80B33E6EE0F5C943F95AAE4A3F8EAC3DB2
SHA-512:	81BA35B200A7CF435C819C9396C6EB71448465E0EB876D1FF73E26D8C905E5BCF39A4ACEA6DB9702D57F9BBEFA3571E4C334151F82919C359691AA444458E406
Malicious:	false
Reputation:	low
URL:	https://btloader.com/tag?o=5097926782615552&upapi=true
Preview:	!function(){"use strict";var e=function(){return e=Object.assign\|\|function(e){for(var t,n=1,s=arguments.length;n<s;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},e.apply(this,arguments)};function t(e,t,n,s){return new(n\|\|(n=Promise))((function(r,i){function o(e){try{c(s.next(e))}catch(e){i(e)}}function a(e){try{c(s.throw(e))}catch(e){i(e)}}function c(e){var t;e.done?r(e.value):(t=e.value,t instanceof n?t:new n((function(e){e(t)}))).then(o,a)}c((s=s.apply(e,t\|\|[])).next())}))}function n(e,t){var n,s,r,i,o={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]};return i={next:a(0),throw:a(1),return:a(2)},"function"==typeof Symbol&&(i[Symbol.iterator]=function(){return this}),i;function a(i){return function(a){return function(i){if(n)throw new TypeError("Generator is already executing.");for(;o;)try{if(n=1,s&&(r=2&i[0]?s.return:i[0]?s.throw\|\|((r=s.return)&&r.call(s),0):s.next)&&!(r=r.call(s,i[1])).done)return r;switch(s=

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56412), with no line terminators
Category:	downloaded
Size (bytes):	56412
Entropy (8bit):	5.907540404138125
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKYlebyBblxRx54PHSGdXXwW7MFWwXVuE2:4UcW6v+0BbchXwW49z2
MD5:	2C00B9F417B688224937053CD0C284A5
SHA1:	17B4C18EBC129055DD25F214C3F11E03E9DF2D82
SHA-256:	1E754B107428162C65A26D399B66DB3DAAEA09616BF8620D9DE4BC689CE48EED
SHA-512:	8DC644D4C8E6DA600C751975AC4A9E620E26179167A4021DDB1DA81B452ECF420E459DD1C23D1F2E177685B4E1006DBC5C8736024C447D0FF65F75838A785F57
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	114
Entropy (8bit):	4.802925647778009
Encrypted:	false
SSDEEP:	3:PouVIZx/XMn30EEBuvFfD0OkADYyT0NV9kBbZWM:hax/XW3/p5mmYyT0NVuB9d
MD5:	E89F75F918DBDCEE28604D4E09DD71D7
SHA1:	F9D9055E9878723A12063B47D4A1A5F58C3EB1E9
SHA-256:	6DC9C7FC93BB488BB0520A6C780A8D3C0FB5486A4711ACA49B4C53FAC7393023
SHA-512:	8DF0AB2E3679B64A6174DEFF4259AE5680F88E3AE307E0EA2DFFF88EC4BA14F3477C9FE3A5AA5DA3A8E857601170A5108ED75F6D6975958AC7A314E4A336AED0
Malicious:	false
Reputation:	low
URL:	http://ww1.conversionlogic.net/
Preview:	<!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2247)
Category:	downloaded
Size (bytes):	190511
Entropy (8bit):	5.670111491505275
Encrypted:	false
SSDEEP:	3072:DNaYbjZpFbEeCofuX38XqXGQQ3Y4nB5bWf/R:DNLHpkfXVQI4B5b8
MD5:	E298F4A065CBFB9316C73B8F8A4B36B7
SHA1:	C90AE4B17089F36B364CFB6490A7C38F14883A1B
SHA-256:	13CA42E76BA7955D4E3281F8A7B2E09D20F4778FDFA35C95F14BF3BB3B07A581
SHA-512:	8A39E7B433041C368A110BA152D889E93ECC3D9E52375B928B9DD19E4860E1229B6CC9CCF2E397902F1D5A76595FD4AE3D809A26B147BDDAFE7D20A8B66DFAD9
Malicious:	false
Reputation:	low
URL:	https://www.google.com/adsense/domains/caf.js?abp=1&gdabp=true
Preview:	if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"11500827891016057389",packages:"domains",module:"ads",version:"1",m:{cei:"17300002,17301437,17301439,17301442",ah:true,uatm:500,ecfc2:true,llrm:1000,lldl:"bS5zZWFycy5jb20=",abf:{"_disableAdRequestForNewConsentStrategy":true,"_enableNewConsentStrategy":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2csdWsuY29tLHVzLmNvbSx3ZWIuYXBw",cdl:false,cdh:""}};var m;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea="function"==typeof Object.defineProperties?Object.de

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 16 colors, 32x32, 16 colors
Category:	downloaded
Size (bytes):	1078
Entropy (8bit):	1.240940859118772
Encrypted:	false
SSDEEP:	3:etFEh9HYflvlNl/AXll1pe/WNN00000000000000000000000000000000000001:QNtY6+lKY6
MD5:	4123CE1E1732F202F60292941FF1487D
SHA1:	9F12B11BDE582DAE37CE8C160537D919C561C464
SHA-256:	D961B08E4321250926DE6F79087594975FE20AD1518DE8F91EB711AF5D1A6EF8
SHA-512:	11B24C2E622C408E4774FAE120B719A21A0B2ACFA53230126C35AD6CA57D33D4DE79CBE11D296CFBDE9613CAA03D66B721BD20CF4EE030CF75F5A1FD8A286DA9
Malicious:	false
Reputation:	low
URL:	https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250
Preview:	..............(...&... ..........N...(....... ...............................................................................................................................................................................................................................................................................................(... ...@.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65465)
Category:	downloaded
Size (bytes):	643782
Entropy (8bit):	5.623139316303616
Encrypted:	false
SSDEEP:	12288:w/11YqkQYnlQYnoYDUk4f0WTI4WY+MiqFhh0UEtp:w/11PkQYnlQYnog
MD5:	6A1EC4B3FAF7AB482A673F85F843A45F
SHA1:	973F4E21BCFAFE497C7B750C8873BA4CDB5E8354
SHA-256:	A08266597418789F86D7BC3BF181BB88265DD70B03A74327875F45BAF87CF62E
SHA-512:	31BEE7D67B3D5A48E69AB5D8DD81815EEBBD3B4CE9AA30EF206A9AAB73F060E4D47CC1746CC034E1F3E54A83C3F792B0938681B8A18860FF53E2632A95C6BF44
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/parking-lander/static/js/main.9bfaa532.js
Preview:	/! For license information please see main.9bfaa532.js.LICENSE.txt /.(()=>{var e={7142:(e,t,n)=>{"use strict";n.d(t,{N:()=>r,_:()=>o});const r="abp=1&gdabp=true",o="abp=2&gdabp=true"},9040:(e,t,n)=>{"use strict";function r(e){return!0===e\|\|"true"===e\|\|1===e\|\|"1"===e\|\|!1!==e&&"false"!==e&&0!==e&&"0"!==e&&null}n.d(t,{g:()=>r})},9631:(e,t,n)=>{"use strict";n.d(t,{A:()=>i,U:()=>a});var r=n(7142),o=n(947);function i(e){let t;try{t=JSON.stringify(e,((e,t)=>{if(null!==t&&"undefined"!==typeof t&&""!==t)return t}))}catch(n){o.Z.error(n)}return o.Z.debug("lander event: "+t),t}function a(e,t){const n=i(t);return e+="?"+r.N,fetch(e,{method:"POST",credentials:"omit",body:n,headers:{"Content-Type":"application/json"}}).then((e=>{e.ok\|\|o.Z.error("error publishing event - HTTP Status: "+e.status)})).catch((e=>{o.Z.error("error publishing event - "+e.toString())}))}},947:(e,t,n)=>{"use strict";n.d(t,{B:()=>o,Z:()=>r});class r{static logMessage(e,t){if(r.Severity[r.level]>=r.Severity[e]){let n="warn";

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0950611313667666
Encrypted:	false
SSDEEP:	3:CUMllRPQEsJ9pse:Gl3QEsJLse
MD5:	AD4B0F606E0F8465BC4C4C170B37E1A3
SHA1:	50B30FD5F87C85FE5CBA2635CB83316CA71250D7
SHA-256:	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
SHA-512:	EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
Malicious:	false
Reputation:	low
URL:	https://ad-delivery.net/px.gif?ch=1&e=0.27612668333241763
Preview:	GIF89a.............!.......,...........L..;

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	5.067114195077553
Encrypted:	false
SSDEEP:	24:Ye7/FvTjrL2+toGyGzfvTdm1DGCh9V8GxVbl53YGw:YeTFLfL2+EEfxwD/B8Mlip
MD5:	FAB4B3ABF84AB50177869FFECD1722CD
SHA1:	E0B3FAD545F29E323D115A42DB9EA9B09EFCA74F
SHA-256:	3E6FD114D2E01B5AF1236AEC7CB94077B428A2A2B43A0D1ADCA5706E1BF094F8
SHA-512:	C896D5A8700F5B03CF3384A9C1D5541D5EB51C8A88D3C1C108A71C3AFC3767B31C699ED41998CC35339D5C563FC152E688763BA5913FB26AB5C03F419D8EFED1
Malicious:	false
Reputation:	low
Preview:	{"system":"SN","account":"11d1def534ea1be0XX107f50f7X15eb83c7750X14a ","customerId":"c0fe5efa-fc25-4359-b11f-7b474e292782","displayType":"ADS","dataSource":"INVENTORY","adSense":{"drid":"as-drid-2927860770008733","channel":"08272","pubId":"dp-namemedia08_3ph"},"domain":{"rootDomain":"conversionlogic.net","expiresAt":"","status":{"internal":"ACTIVE"},"isAdult":false,"hasAuction":false},"lander":{"template":"ARROW_3","domainDisplayName":"conversionlogic.net","headerText":"","footerText":"","headerHtml":"","footerHtml":"","banner":{"show":false,"text":"conversionlogic.net may be for sale!","link":"https://godaddy.com/domain-parking/forsale/conversionlogic.net","type":"FOR_SALE"},"i18n":true,"showDomain":true},"experiment":{"experiment":"","start":"","end":"","enabled":false}}.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAk8dqZYMe7mkRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 16 colors, 32x32, 16 colors
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	1.240940859118772
Encrypted:	false
SSDEEP:	3:etFEh9HYflvlNl/AXll1pe/WNN00000000000000000000000000000000000001:QNtY6+lKY6
MD5:	4123CE1E1732F202F60292941FF1487D
SHA1:	9F12B11BDE582DAE37CE8C160537D919C561C464
SHA-256:	D961B08E4321250926DE6F79087594975FE20AD1518DE8F91EB711AF5D1A6EF8
SHA-512:	11B24C2E622C408E4774FAE120B719A21A0B2ACFA53230126C35AD6CA57D33D4DE79CBE11D296CFBDE9613CAA03D66B721BD20CF4EE030CF75F5A1FD8A286DA9
Malicious:	false
Reputation:	low
Preview:	..............(...&... ..........N...(....... ...............................................................................................................................................................................................................................................................................................(... ...@.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2736)
Category:	downloaded
Size (bytes):	2781
Entropy (8bit):	4.938953500722623
Encrypted:	false
SSDEEP:	24:rdBxw4Vq8dB2sd7BsrufaMy6dLyn1t5xfyOA/8XAE7ybzdy2B8dyVyC3eRY4Bir3:Jw8quKbMy5FeJtuR/BiiKyxKq2Cq5
MD5:	E2009D689266387017B6648142516BD9
SHA1:	15535120C37EAB27B129C344A9DAC737D45844BB
SHA-256:	0FE514C7010C6D8B9E44F011EEA7497F7E482A60E1498CE324F99729948D048D
SHA-512:	91D19CEF15807C03D9F15B7742F950444415BDE32AB22D4584DEA02D6DCB3E019FA8D55CDCF99693A200F495CA1ED51DE94A8F3B268BCDEC8280523FFB2C2413
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/parking-lander/static/css/main.8a1d19af.css
Preview:	.Banner_banner__G1ca3{margin-bottom:5%}.trustArc_parkingTrustArcBanner__Ijwo0 .trustarc-banner-wrapper{box-shadow:none;box-sizing:border-box;height:100%;margin:0;max-width:100%;padding-top:1rem}.trustArc_parkingTrustArcBanner__Ijwo0 .trustarc-banner-wrapper>*{margin:auto;max-width:40rem}.trustArc_parkingTrustArcBanner__Ijwo0 .trustarc-banner-background{background-color:#0000!important}.trustArc_parkingTrustArcBanner__Ijwo0 .trustarc-banner-container{background-color:#fff;border-left:1px solid #e0e0e0;border-radius:15px 15px 0 0;border-right:1px solid #e0e0e0;border-top:1px solid #e0e0e0;box-sizing:border-box;display:flex;flex-direction:column;padding:1rem}.trustArc_parkingTrustArcBanner__Ijwo0 .trustarc-banner-container .banner-details-container{margin:0}.trustArc_parkingTrustArcBanner__Ijwo0 .trustarc-banner-container .banner-details-container .description-group{display:flex;flex-direction:row;gap:1rem}@media screen and (max-width:640px){.trustArc_parkingTrustArcBanner__Ijwo0 .trustar

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 17:16:52.606358051 CEST	49674	443	192.168.2.6	173.222.162.64
Apr 26, 2024 17:16:52.609885931 CEST	49673	443	192.168.2.6	173.222.162.64
Apr 26, 2024 17:16:52.938047886 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 26, 2024 17:16:58.680799007 CEST	443	49705	173.222.162.64	192.168.2.6
Apr 26, 2024 17:16:58.680954933 CEST	49705	443	192.168.2.6	173.222.162.64
Apr 26, 2024 17:17:02.243985891 CEST	49674	443	192.168.2.6	173.222.162.64
Apr 26, 2024 17:17:02.337692022 CEST	49673	443	192.168.2.6	173.222.162.64
Apr 26, 2024 17:17:02.634531975 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 26, 2024 17:17:03.402045965 CEST	49719	80	192.168.2.6	63.141.242.46
Apr 26, 2024 17:17:03.408688068 CEST	49720	80	192.168.2.6	63.141.242.46
Apr 26, 2024 17:17:03.567608118 CEST	80	49719	63.141.242.46	192.168.2.6
Apr 26, 2024 17:17:03.567917109 CEST	49719	80	192.168.2.6	63.141.242.46
Apr 26, 2024 17:17:03.568072081 CEST	49719	80	192.168.2.6	63.141.242.46
Apr 26, 2024 17:17:03.568675995 CEST	49722	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:03.568720102 CEST	443	49722	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:03.568798065 CEST	49722	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:03.569664955 CEST	49722	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:03.569669962 CEST	443	49722	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:03.575176001 CEST	80	49720	63.141.242.46	192.168.2.6
Apr 26, 2024 17:17:03.575262070 CEST	49720	80	192.168.2.6	63.141.242.46
Apr 26, 2024 17:17:03.733642101 CEST	80	49719	63.141.242.46	192.168.2.6
Apr 26, 2024 17:17:03.738642931 CEST	80	49719	63.141.242.46	192.168.2.6
Apr 26, 2024 17:17:03.738660097 CEST	80	49719	63.141.242.46	192.168.2.6
Apr 26, 2024 17:17:03.738749027 CEST	49719	80	192.168.2.6	63.141.242.46
Apr 26, 2024 17:17:03.771924973 CEST	49719	80	192.168.2.6	63.141.242.46
Apr 26, 2024 17:17:03.981945992 CEST	49723	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:17:04.048413038 CEST	49724	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:17:04.057966948 CEST	443	49722	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:04.058084011 CEST	49722	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:04.066582918 CEST	49722	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:04.066605091 CEST	443	49722	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:04.066981077 CEST	443	49722	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:04.068717957 CEST	49722	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:04.068871021 CEST	49722	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:04.068876028 CEST	443	49722	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:04.069029093 CEST	49722	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:04.112135887 CEST	443	49722	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:04.131988049 CEST	80	49723	15.197.204.56	192.168.2.6
Apr 26, 2024 17:17:04.132075071 CEST	49723	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:17:04.154951096 CEST	49723	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:17:04.172370911 CEST	80	49724	15.197.204.56	192.168.2.6
Apr 26, 2024 17:17:04.172447920 CEST	49724	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:17:04.225586891 CEST	443	49722	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:04.225703955 CEST	443	49722	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:04.225754023 CEST	49722	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:04.226224899 CEST	49722	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:04.226248026 CEST	443	49722	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:04.278933048 CEST	80	49723	15.197.204.56	192.168.2.6
Apr 26, 2024 17:17:04.312345982 CEST	80	49723	15.197.204.56	192.168.2.6
Apr 26, 2024 17:17:04.341563940 CEST	49719	80	192.168.2.6	63.141.242.46
Apr 26, 2024 17:17:04.471282959 CEST	49723	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:17:04.507196903 CEST	80	49719	63.141.242.46	192.168.2.6
Apr 26, 2024 17:17:04.522641897 CEST	80	49723	15.197.204.56	192.168.2.6
Apr 26, 2024 17:17:04.522697926 CEST	49723	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:17:04.625109911 CEST	80	49723	15.197.204.56	192.168.2.6
Apr 26, 2024 17:17:04.625129938 CEST	80	49723	15.197.204.56	192.168.2.6
Apr 26, 2024 17:17:04.625176907 CEST	49723	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:17:04.698858023 CEST	49725	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:04.698913097 CEST	443	49725	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:04.698962927 CEST	49725	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:04.703984022 CEST	49725	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:04.704010963 CEST	443	49725	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:04.835616112 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:04.835668087 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:04.835746050 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:04.836889029 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:04.836908102 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:04.836965084 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:04.838037014 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:04.838057995 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:04.839032888 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:04.839054108 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:05.104218960 CEST	443	49725	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:05.104490995 CEST	49725	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:05.104507923 CEST	443	49725	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:05.106050968 CEST	443	49725	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:05.106110096 CEST	49725	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:05.109636068 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:05.109858036 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:05.109880924 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:05.110918999 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:05.110975027 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:06.265542984 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:06.340964079 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:08.192039013 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:08.192065954 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:08.193401098 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:08.193413973 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:08.193456888 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:08.338974953 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:08.742335081 CEST	80	49720	63.141.242.46	192.168.2.6
Apr 26, 2024 17:17:08.743181944 CEST	49720	80	192.168.2.6	63.141.242.46
Apr 26, 2024 17:17:09.730248928 CEST	49725	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:09.730607986 CEST	443	49725	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:09.730845928 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.731235981 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.732404947 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:09.732533932 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.747014046 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.747035027 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.750147104 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:09.750168085 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.842983007 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.843003988 CEST	49725	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:09.843015909 CEST	443	49725	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:09.892049074 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:09.899913073 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.899971962 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.900002956 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.900019884 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.900028944 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.900038004 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.900070906 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.900094032 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.900113106 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.900127888 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.900662899 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.900696993 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.900706053 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.900979996 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.901015997 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.901022911 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.901050091 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.901081085 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.901082039 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.901087999 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.901118040 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.902498007 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.902561903 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.902592897 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.902599096 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.902621031 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.902652979 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.902657032 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.903398037 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.903438091 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.903448105 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.903583050 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.903614044 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.903619051 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.903649092 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.903671980 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.903680086 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.903686047 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.903716087 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.903719902 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.904905081 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.904937983 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.904949903 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.904962063 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.904995918 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.905004025 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.905009985 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.905042887 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.905045986 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.905951977 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.905983925 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.905988932 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.905996084 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.906025887 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.906039953 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.907104015 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.907138109 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.907150030 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.907157898 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.907179117 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.907196999 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.907201052 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.907248974 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.907721043 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.907819033 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:09.907861948 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:09.952044010 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.952074051 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.952146053 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:09.952153921 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.952159882 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.952198029 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:09.952250004 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.952434063 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.952527046 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:09.952534914 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.964642048 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.964696884 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:09.964714050 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.977746964 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.977819920 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:09.977837086 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.991038084 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:09.991106987 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:09.991122961 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.033731937 CEST	49725	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:10.119112968 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.119132996 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.134784937 CEST	49727	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:10.134807110 CEST	443	49727	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:10.137006998 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.137084007 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.137094975 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.143316031 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.143445015 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.143460035 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.150604010 CEST	49720	80	192.168.2.6	63.141.242.46
Apr 26, 2024 17:17:10.156133890 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.156270981 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.156282902 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.169214010 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.169270039 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.169286966 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.182331085 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.182632923 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.182650089 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.195209026 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.195270061 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.195285082 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.208015919 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.208079100 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.208096981 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.223558903 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.223680973 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.223705053 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.233692884 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.233756065 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.233769894 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.244865894 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.244946003 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.244959116 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.256469011 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.256666899 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.256681919 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.261089087 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:17:10.261128902 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:17:10.261210918 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:17:10.262061119 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:17:10.262077093 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:17:10.268306971 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.268399954 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.268414974 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.280416012 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.280711889 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.280721903 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.292520046 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.292618036 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.292633057 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.316500902 CEST	80	49720	63.141.242.46	192.168.2.6
Apr 26, 2024 17:17:10.322838068 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.322920084 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.322933912 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.327337027 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.327466965 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.327488899 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.336802006 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.336962938 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.336982012 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.345136881 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.345475912 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.345490932 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.353804111 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.353892088 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.353908062 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.358464003 CEST	49731	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.358495951 CEST	443	49731	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.358772993 CEST	49731	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.361790895 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.361917019 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.361937046 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.364284039 CEST	49731	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.364299059 CEST	443	49731	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.370286942 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.370469093 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.370484114 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.378518105 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.378576994 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.378599882 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.386878014 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.386934042 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.386948109 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.395435095 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.395512104 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.395529032 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.407968998 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.408029079 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.408042908 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.416203976 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.416254997 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.416264057 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.416271925 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.416335106 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.424876928 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.433334112 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.433382988 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.433418036 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.433429003 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.433515072 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.442540884 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.450247049 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.450280905 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.450354099 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.450371027 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.450633049 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.460515976 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.472559929 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.472624063 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.472650051 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.472670078 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.472728968 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.484014034 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.488867044 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.488893986 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.488920927 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.488934994 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.488976002 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.492392063 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.497572899 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.497610092 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.497642994 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.497656107 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.497724056 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.504800081 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.508536100 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.508594990 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.508608103 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.515805006 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.515851021 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.515865088 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.522942066 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.522995949 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.523011923 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.527702093 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.527754068 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.527766943 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.532026052 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.532082081 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.532088995 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.536591053 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.536637068 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.536648989 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.540951014 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.541109085 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.541121006 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.545342922 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.545437098 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.545449018 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.549814939 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.549876928 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.549889088 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.554322004 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.554368973 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.554380894 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.558406115 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.558455944 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.558470964 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.562588930 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.562648058 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.562661886 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.568845987 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.568873882 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.568893909 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.568907976 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.569149017 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.572968960 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.579263926 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.579312086 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.579323053 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.589061975 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.589122057 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.589133978 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.595031977 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.595084906 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.595098972 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.597819090 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.597872019 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.597883940 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.600737095 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.600785971 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.600795984 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.603746891 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.603789091 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.603797913 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.604863882 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.604918957 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.604929924 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.605113983 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.605175972 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.605185032 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.609106064 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.609160900 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.609175920 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.612907887 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.612957001 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.612972975 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.618644953 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.618752003 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.618809938 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.618828058 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.618868113 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.622426987 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.625025034 CEST	443	49731	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.625096083 CEST	49731	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.626296997 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.626373053 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.626384020 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.628294945 CEST	49731	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.628299952 CEST	443	49731	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.628608942 CEST	443	49731	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.630034924 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.630161047 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.630172968 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.636475086 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.636567116 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.636573076 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.637437105 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.637518883 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.637525082 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.641119003 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.641175032 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.641185999 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.644804955 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.644874096 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.644886017 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.645026922 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.645071983 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.645077944 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.645229101 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.645282984 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.645750999 CEST	49728	443	192.168.2.6	192.178.50.36
Apr 26, 2024 17:17:10.645768881 CEST	443	49728	192.178.50.36	192.168.2.6
Apr 26, 2024 17:17:10.665927887 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:17:10.666215897 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:17:10.666234970 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:17:10.666908026 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:17:10.666929960 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:17:10.666994095 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:17:10.667002916 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:17:10.667042971 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:17:10.667628050 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:17:10.670599937 CEST	49731	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.716124058 CEST	443	49731	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.808722019 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:17:10.825612068 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:17:10.825957060 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:17:10.863415956 CEST	49732	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:10.863437891 CEST	443	49732	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:10.863502026 CEST	49732	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:10.863982916 CEST	49732	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:10.864000082 CEST	443	49732	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:10.876415014 CEST	443	49731	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.876683950 CEST	443	49731	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.877259016 CEST	49731	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.877882004 CEST	49731	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.877890110 CEST	443	49731	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.877914906 CEST	49731	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.877919912 CEST	443	49731	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.903270960 CEST	49733	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.903301001 CEST	443	49733	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.903412104 CEST	49733	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.903707027 CEST	49733	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:10.903718948 CEST	443	49733	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:10.945483923 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:17:10.945501089 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:17:10.998424053 CEST	49734	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:10.998460054 CEST	443	49734	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:10.998536110 CEST	49734	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:10.999353886 CEST	49735	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:10.999387026 CEST	443	49735	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:10.999435902 CEST	49735	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:10.999610901 CEST	49736	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:10.999644041 CEST	443	49736	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:10.999722958 CEST	49736	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:10.999855042 CEST	49737	443	192.168.2.6	130.211.23.194
Apr 26, 2024 17:17:10.999866009 CEST	443	49737	130.211.23.194	192.168.2.6
Apr 26, 2024 17:17:10.999916077 CEST	49737	443	192.168.2.6	130.211.23.194
Apr 26, 2024 17:17:11.000061035 CEST	49734	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:11.000071049 CEST	443	49734	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:11.000246048 CEST	49735	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.000258923 CEST	443	49735	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.000799894 CEST	49736	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.000848055 CEST	443	49736	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.000910997 CEST	49737	443	192.168.2.6	130.211.23.194
Apr 26, 2024 17:17:11.000920057 CEST	443	49737	130.211.23.194	192.168.2.6
Apr 26, 2024 17:17:11.122395039 CEST	443	49732	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:11.124933004 CEST	49732	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:11.124958038 CEST	443	49732	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:11.125320911 CEST	443	49732	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:11.131827116 CEST	49732	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:11.131934881 CEST	443	49732	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:11.132110119 CEST	49732	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:11.139127970 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:17:11.165918112 CEST	443	49733	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:11.166027069 CEST	49733	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:11.169069052 CEST	49733	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:11.169076920 CEST	443	49733	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:11.170054913 CEST	443	49733	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:11.173782110 CEST	49733	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:11.176146984 CEST	443	49732	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:11.220108986 CEST	443	49733	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:11.281866074 CEST	443	49735	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.282228947 CEST	49735	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.282247066 CEST	443	49735	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.282383919 CEST	443	49736	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.282783985 CEST	49736	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.282843113 CEST	443	49736	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.283791065 CEST	443	49735	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.283843040 CEST	49735	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.284394026 CEST	443	49736	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.284472942 CEST	49736	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.286329985 CEST	49735	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.286478043 CEST	443	49735	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.286744118 CEST	49735	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.286751032 CEST	443	49735	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.287060976 CEST	49736	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.287158966 CEST	443	49736	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.287231922 CEST	49736	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.332123041 CEST	443	49736	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.332230091 CEST	443	49734	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:11.333467960 CEST	49734	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:11.333477020 CEST	443	49734	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:11.334492922 CEST	443	49734	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:11.334558010 CEST	49734	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:11.336236000 CEST	49734	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:11.336294889 CEST	443	49734	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:11.336847067 CEST	49734	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:11.336853027 CEST	443	49734	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:11.343976021 CEST	49735	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.344146967 CEST	49736	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.344170094 CEST	443	49736	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.408659935 CEST	443	49737	130.211.23.194	192.168.2.6
Apr 26, 2024 17:17:11.409957886 CEST	49737	443	192.168.2.6	130.211.23.194
Apr 26, 2024 17:17:11.409966946 CEST	443	49737	130.211.23.194	192.168.2.6
Apr 26, 2024 17:17:11.410999060 CEST	443	49737	130.211.23.194	192.168.2.6
Apr 26, 2024 17:17:11.411065102 CEST	49737	443	192.168.2.6	130.211.23.194
Apr 26, 2024 17:17:11.412646055 CEST	49737	443	192.168.2.6	130.211.23.194
Apr 26, 2024 17:17:11.412728071 CEST	443	49737	130.211.23.194	192.168.2.6
Apr 26, 2024 17:17:11.412895918 CEST	49737	443	192.168.2.6	130.211.23.194
Apr 26, 2024 17:17:11.418955088 CEST	443	49733	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:11.419107914 CEST	443	49733	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:11.419209003 CEST	49733	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:11.420705080 CEST	49733	443	192.168.2.6	23.204.76.112
Apr 26, 2024 17:17:11.420722008 CEST	443	49733	23.204.76.112	192.168.2.6
Apr 26, 2024 17:17:11.433059931 CEST	443	49732	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:11.433125019 CEST	443	49732	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:11.433167934 CEST	49732	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:11.440256119 CEST	49732	443	192.168.2.6	172.67.41.60
Apr 26, 2024 17:17:11.440274954 CEST	443	49732	172.67.41.60	192.168.2.6
Apr 26, 2024 17:17:11.460122108 CEST	443	49737	130.211.23.194	192.168.2.6
Apr 26, 2024 17:17:11.533544064 CEST	49736	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.533618927 CEST	49737	443	192.168.2.6	130.211.23.194
Apr 26, 2024 17:17:11.533632994 CEST	443	49737	130.211.23.194	192.168.2.6
Apr 26, 2024 17:17:11.544734001 CEST	49734	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:11.573523045 CEST	443	49735	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.573618889 CEST	443	49735	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.573736906 CEST	49735	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.574246883 CEST	443	49736	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.574326038 CEST	443	49736	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.574449062 CEST	49736	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.641554117 CEST	49737	443	192.168.2.6	130.211.23.194
Apr 26, 2024 17:17:11.673479080 CEST	49736	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.673535109 CEST	443	49736	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.673926115 CEST	49735	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.673949003 CEST	443	49735	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.674520969 CEST	443	49734	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:11.675045013 CEST	443	49734	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:11.675137997 CEST	49734	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:11.684974909 CEST	49734	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:11.684999943 CEST	443	49734	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:11.805293083 CEST	49739	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:11.805324078 CEST	443	49739	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:11.805439949 CEST	49739	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:11.805974007 CEST	49739	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:11.805991888 CEST	443	49739	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:11.817651987 CEST	443	49737	130.211.23.194	192.168.2.6
Apr 26, 2024 17:17:11.817720890 CEST	443	49737	130.211.23.194	192.168.2.6
Apr 26, 2024 17:17:11.817837954 CEST	49737	443	192.168.2.6	130.211.23.194
Apr 26, 2024 17:17:11.818731070 CEST	49737	443	192.168.2.6	130.211.23.194
Apr 26, 2024 17:17:11.818749905 CEST	443	49737	130.211.23.194	192.168.2.6
Apr 26, 2024 17:17:11.869362116 CEST	49740	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.869391918 CEST	443	49740	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.869705915 CEST	49740	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.869977951 CEST	49741	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.869996071 CEST	443	49741	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.870094061 CEST	49741	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.870588064 CEST	49741	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.870599031 CEST	443	49741	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.871076107 CEST	49740	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:11.871088028 CEST	443	49740	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:11.877823114 CEST	49742	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:11.877835989 CEST	443	49742	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:11.877904892 CEST	49742	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:11.878469944 CEST	49742	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:11.878480911 CEST	443	49742	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:12.024049997 CEST	49743	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:12.024085999 CEST	443	49743	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:12.024173021 CEST	49743	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:12.024746895 CEST	49743	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:12.024760962 CEST	443	49743	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:12.131771088 CEST	443	49741	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.132035971 CEST	49741	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.132055044 CEST	443	49741	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.133164883 CEST	443	49741	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.133224010 CEST	49741	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.133582115 CEST	49741	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.133641005 CEST	443	49741	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.133749008 CEST	49741	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.133755922 CEST	443	49741	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.138015032 CEST	443	49740	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.138221025 CEST	49740	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.138233900 CEST	443	49740	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.143699884 CEST	443	49740	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.143768072 CEST	49740	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.144145966 CEST	49740	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.144228935 CEST	443	49740	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.144303083 CEST	49740	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.144313097 CEST	443	49740	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.211103916 CEST	443	49742	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:12.211410999 CEST	49742	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:12.211433887 CEST	443	49742	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:12.212907076 CEST	443	49742	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:12.212976933 CEST	49742	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:12.213437080 CEST	49742	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:12.213512897 CEST	443	49742	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:12.213545084 CEST	49742	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:12.229980946 CEST	49741	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.231863976 CEST	49740	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.256123066 CEST	443	49742	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:12.332096100 CEST	49742	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:12.332113981 CEST	443	49742	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:12.427057028 CEST	443	49741	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.427248955 CEST	443	49741	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.428036928 CEST	49741	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.428689003 CEST	49741	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.428704023 CEST	443	49741	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.433836937 CEST	443	49740	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.434035063 CEST	443	49740	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.434087038 CEST	49740	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.434556007 CEST	49740	443	192.168.2.6	104.26.3.70
Apr 26, 2024 17:17:12.434573889 CEST	443	49740	104.26.3.70	192.168.2.6
Apr 26, 2024 17:17:12.442924976 CEST	49742	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:12.468605995 CEST	443	49739	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:12.468888998 CEST	49739	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:12.468904972 CEST	443	49739	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:12.469924927 CEST	443	49739	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:12.469985962 CEST	49739	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:12.503782034 CEST	443	49743	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:12.503864050 CEST	49743	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:12.506205082 CEST	49743	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:12.506218910 CEST	443	49743	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:12.506726027 CEST	443	49743	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:12.508766890 CEST	49743	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:12.508936882 CEST	49743	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:12.508936882 CEST	49743	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:12.508944035 CEST	443	49743	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:12.556121111 CEST	443	49743	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:12.672255039 CEST	443	49743	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:12.672333956 CEST	443	49743	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:12.672398090 CEST	49743	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:12.672594070 CEST	49743	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:12.672607899 CEST	443	49743	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:13.051039934 CEST	443	49742	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:13.051217079 CEST	443	49742	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:13.051352024 CEST	49742	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:13.052406073 CEST	49742	443	192.168.2.6	142.251.35.230
Apr 26, 2024 17:17:13.052424908 CEST	443	49742	142.251.35.230	192.168.2.6
Apr 26, 2024 17:17:13.267772913 CEST	49739	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:13.267919064 CEST	443	49739	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:13.271754980 CEST	49739	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:13.271770000 CEST	443	49739	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:13.322041988 CEST	49739	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:13.489818096 CEST	443	49739	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:13.489907026 CEST	443	49739	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:13.489952087 CEST	49739	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:13.500406981 CEST	49739	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:13.500418901 CEST	443	49739	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:13.550425053 CEST	49746	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:13.550466061 CEST	443	49746	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:13.550529003 CEST	49746	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:13.551497936 CEST	49746	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:13.551507950 CEST	443	49746	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:13.983665943 CEST	443	49746	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:14.033569098 CEST	49746	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:15.083156109 CEST	443	49725	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:15.083229065 CEST	443	49725	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:15.083281040 CEST	49725	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:15.244765997 CEST	49746	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:15.244786024 CEST	443	49746	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:15.245301962 CEST	443	49746	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:15.246520996 CEST	49746	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:15.246588945 CEST	443	49746	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:15.248502016 CEST	49746	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:15.292119026 CEST	443	49746	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:15.476403952 CEST	443	49746	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:15.476480961 CEST	443	49746	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:15.476516008 CEST	49746	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:15.479176998 CEST	49746	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:15.479191065 CEST	443	49746	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:15.741998911 CEST	49725	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:15.742023945 CEST	443	49725	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:15.894465923 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:15.894489050 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:15.894546986 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:15.896027088 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:15.896040916 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:16.053427935 CEST	49755	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:16.053437948 CEST	443	49755	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:16.053693056 CEST	49755	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:16.053709984 CEST	49755	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:16.053714037 CEST	443	49755	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:16.166810989 CEST	49705	443	192.168.2.6	173.222.162.64
Apr 26, 2024 17:17:16.289621115 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:16.289932966 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:16.289943933 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:16.291491985 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:16.291532993 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:16.291553974 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:16.291563034 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:16.291599035 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:16.291618109 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:16.292669058 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:16.292877913 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:16.292959929 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:16.293036938 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:16.293045044 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:16.424901962 CEST	443	49705	173.222.162.64	192.168.2.6
Apr 26, 2024 17:17:16.467211008 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:16.492238045 CEST	443	49755	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:16.492496967 CEST	49755	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:16.492510080 CEST	443	49755	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:16.493577003 CEST	443	49755	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:16.493654966 CEST	49755	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:16.493990898 CEST	49755	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:16.494046926 CEST	443	49755	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:16.494205952 CEST	49755	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:16.494211912 CEST	443	49755	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:16.549335957 CEST	443	49705	173.222.162.64	192.168.2.6
Apr 26, 2024 17:17:16.549356937 CEST	443	49705	173.222.162.64	192.168.2.6
Apr 26, 2024 17:17:16.549381018 CEST	443	49705	173.222.162.64	192.168.2.6
Apr 26, 2024 17:17:16.549392939 CEST	443	49705	173.222.162.64	192.168.2.6
Apr 26, 2024 17:17:16.549431086 CEST	49705	443	192.168.2.6	173.222.162.64
Apr 26, 2024 17:17:16.549480915 CEST	49705	443	192.168.2.6	173.222.162.64
Apr 26, 2024 17:17:16.654728889 CEST	49755	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:16.933399916 CEST	443	49755	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:16.933583021 CEST	443	49755	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:16.933641911 CEST	49755	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:16.944669008 CEST	49755	443	192.168.2.6	52.13.101.202
Apr 26, 2024 17:17:16.944689989 CEST	443	49755	52.13.101.202	192.168.2.6
Apr 26, 2024 17:17:17.039294004 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:17.039365053 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:17.040930033 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:17.047385931 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:17.051163912 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:17.176467896 CEST	49750	443	192.168.2.6	142.250.217.174
Apr 26, 2024 17:17:17.176472902 CEST	443	49750	142.250.217.174	192.168.2.6
Apr 26, 2024 17:17:17.310492039 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:17.310523987 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:17.310576916 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:17.310839891 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:17.310852051 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:17.671538115 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:17.675992966 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:17.676004887 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:17.676901102 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:17.677025080 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:17.681914091 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:17.682086945 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:17.682228088 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:17.682261944 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:17.765036106 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:17.765045881 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:17.874272108 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:18.554368019 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:18.554493904 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:18.554564953 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:18.554580927 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:18.554666996 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:18.554744005 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:18.554745913 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:18.554773092 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:18.554830074 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:18.558304071 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:18.558429956 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:18.558567047 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:18.952797890 CEST	443	49705	173.222.162.64	192.168.2.6
Apr 26, 2024 17:17:18.952897072 CEST	49705	443	192.168.2.6	173.222.162.64
Apr 26, 2024 17:17:21.069941998 CEST	49758	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:21.069953918 CEST	443	49758	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:21.688752890 CEST	49759	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:21.688800097 CEST	443	49759	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:21.688858032 CEST	49759	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:21.689162016 CEST	49759	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:21.689171076 CEST	443	49759	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:22.087869883 CEST	443	49759	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:22.088448048 CEST	49759	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:22.088466883 CEST	443	49759	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:22.090415001 CEST	443	49759	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:22.090944052 CEST	49759	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:22.091188908 CEST	443	49759	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:22.091198921 CEST	49759	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:22.091351986 CEST	443	49759	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:22.147085905 CEST	49759	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:22.480779886 CEST	443	49759	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:22.481250048 CEST	443	49759	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:22.481314898 CEST	49759	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:22.482315063 CEST	49759	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:22.482331038 CEST	443	49759	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:26.192159891 CEST	49761	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:26.192183971 CEST	443	49761	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:26.192253113 CEST	49761	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:26.192858934 CEST	49761	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:26.192886114 CEST	443	49761	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:26.493594885 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:26.493632078 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:26.493696928 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:26.493895054 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:26.493905067 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:26.646116972 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:26.646157026 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:26.646223068 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:26.646467924 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:26.646481037 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:26.678463936 CEST	443	49761	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:26.678539038 CEST	49761	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:26.684094906 CEST	49761	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:26.684122086 CEST	443	49761	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:26.684465885 CEST	443	49761	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:26.686350107 CEST	49761	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:26.686417103 CEST	49761	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:26.686429024 CEST	443	49761	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:26.686541080 CEST	49761	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:26.728135109 CEST	443	49761	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:26.844185114 CEST	443	49761	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:26.844367027 CEST	443	49761	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:26.844430923 CEST	49761	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:26.844563007 CEST	49761	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:26.844602108 CEST	443	49761	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:26.896266937 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:26.896543026 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:26.896554947 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:26.896878004 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:26.897197008 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:26.897258043 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:26.897368908 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:26.897406101 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.148957014 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:27.149038076 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:27.175426960 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:27.175447941 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:27.176515102 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:27.177232027 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:27.177315950 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:27.177400112 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:27.297379017 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.297420025 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.297442913 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.297481060 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.297497034 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.297504902 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.297517061 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.297544003 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.297635078 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.310467958 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.323200941 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.323230982 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.323452950 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.323467970 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.327248096 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.334608078 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.345989943 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.346060038 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.346070051 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.487127066 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.487446070 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.489553928 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.489583969 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.489777088 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.489793062 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.489984989 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.502546072 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.515489101 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.515665054 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.515676022 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.516266108 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:27.516320944 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:27.516357899 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:27.516447067 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:27.516447067 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:27.516473055 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:27.516544104 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:27.516866922 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:27.516866922 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:27.516997099 CEST	49763	443	192.168.2.6	40.126.29.7
Apr 26, 2024 17:17:27.517009020 CEST	443	49763	40.126.29.7	192.168.2.6
Apr 26, 2024 17:17:27.528436899 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.528465986 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.528589964 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.528608084 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.528678894 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.541341066 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.554313898 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.554343939 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.554409027 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.554415941 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.554562092 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.566303015 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.587080002 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.587122917 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.587595940 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.587616920 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.587943077 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.592606068 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.602510929 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.602546930 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.602655888 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.602669001 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.602828979 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.614487886 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.614639044 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.614749908 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.614759922 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.632376909 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.632488966 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.632496119 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.632544994 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:27.632868052 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.632868052 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.936695099 CEST	49762	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:27.936723948 CEST	443	49762	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.432503939 CEST	49769	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.432535887 CEST	443	49769	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.432775974 CEST	49769	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.432868958 CEST	49769	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.432879925 CEST	443	49769	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.447819948 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.447853088 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.448215961 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.448353052 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.448371887 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.759586096 CEST	443	49769	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.759865999 CEST	49769	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.759880066 CEST	443	49769	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.760215044 CEST	443	49769	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.760499954 CEST	49769	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.760559082 CEST	443	49769	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.760807991 CEST	49769	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.778067112 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.778295040 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.778306961 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.778764009 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.779082060 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.779174089 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.779185057 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:28.808116913 CEST	443	49769	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.820163012 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:28.827285051 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.093100071 CEST	443	49769	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.093436956 CEST	443	49769	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.093483925 CEST	49769	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.093909979 CEST	49769	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.093930006 CEST	443	49769	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.097592115 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.097650051 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.097686052 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.097734928 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.097749949 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.097783089 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.097811937 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.097817898 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.097879887 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.108321905 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.119076967 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.119121075 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.119154930 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.119163036 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.119204044 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.130110025 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.141052961 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.141118050 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.141125917 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.186398983 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.252171040 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.257592916 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.257652044 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.257668972 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.257716894 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.257838964 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.257988930 CEST	49770	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.258013010 CEST	443	49770	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.348839045 CEST	49773	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.348891973 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.348984003 CEST	49773	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.349225998 CEST	49773	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.349246979 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.676992893 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.678383112 CEST	49773	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.678402901 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.678740025 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.686306953 CEST	49773	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.686393023 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:29.687717915 CEST	49773	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:29.687748909 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:30.012046099 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:30.012094975 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:30.012134075 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:30.012156010 CEST	49773	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:30.012181044 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:30.012211084 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:30.012221098 CEST	49773	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:30.012227058 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:30.012270927 CEST	49773	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:30.018158913 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:30.026221991 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:30.026273012 CEST	49773	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:30.026535988 CEST	49773	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:17:30.026551008 CEST	443	49773	142.250.217.228	192.168.2.6
Apr 26, 2024 17:17:49.183686972 CEST	49724	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:17:49.307733059 CEST	80	49724	15.197.204.56	192.168.2.6
Apr 26, 2024 17:17:49.628262997 CEST	49723	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:17:49.752163887 CEST	80	49723	15.197.204.56	192.168.2.6
Apr 26, 2024 17:17:50.253882885 CEST	49774	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:50.253923893 CEST	443	49774	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:50.254077911 CEST	49774	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:50.254647970 CEST	49774	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:50.254658937 CEST	443	49774	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:50.750727892 CEST	443	49774	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:50.750833988 CEST	49774	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:50.779040098 CEST	49774	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:50.779072046 CEST	443	49774	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:50.780880928 CEST	443	49774	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:50.782660007 CEST	49774	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:50.782713890 CEST	49774	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:50.782721043 CEST	443	49774	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:50.782828093 CEST	49774	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:50.824117899 CEST	443	49774	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:50.940000057 CEST	443	49774	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:50.940468073 CEST	49774	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:50.940494061 CEST	443	49774	52.159.126.152	192.168.2.6
Apr 26, 2024 17:17:50.940567017 CEST	49774	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:17:55.949522972 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:17:55.949542999 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:18:04.226346970 CEST	80	49724	15.197.204.56	192.168.2.6
Apr 26, 2024 17:18:04.226406097 CEST	49724	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:18:04.619853973 CEST	49724	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:18:04.620508909 CEST	49777	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:18:04.620577097 CEST	443	49777	142.250.217.228	192.168.2.6
Apr 26, 2024 17:18:04.620654106 CEST	49777	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:18:04.621201038 CEST	49777	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:18:04.621236086 CEST	443	49777	142.250.217.228	192.168.2.6
Apr 26, 2024 17:18:04.751389980 CEST	80	49724	15.197.204.56	192.168.2.6
Apr 26, 2024 17:18:04.947470903 CEST	443	49777	142.250.217.228	192.168.2.6
Apr 26, 2024 17:18:04.948554993 CEST	49777	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:18:04.948616982 CEST	443	49777	142.250.217.228	192.168.2.6
Apr 26, 2024 17:18:04.948940992 CEST	443	49777	142.250.217.228	192.168.2.6
Apr 26, 2024 17:18:04.949387074 CEST	49777	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:18:04.949451923 CEST	443	49777	142.250.217.228	192.168.2.6
Apr 26, 2024 17:18:04.996714115 CEST	49777	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:18:10.907542944 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:18:10.907635927 CEST	443	49730	172.217.165.206	192.168.2.6
Apr 26, 2024 17:18:10.907727957 CEST	49730	443	192.168.2.6	172.217.165.206
Apr 26, 2024 17:18:14.940391064 CEST	443	49777	142.250.217.228	192.168.2.6
Apr 26, 2024 17:18:14.940464973 CEST	443	49777	142.250.217.228	192.168.2.6
Apr 26, 2024 17:18:14.940521002 CEST	49777	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:18:16.902074099 CEST	49777	443	192.168.2.6	142.250.217.228
Apr 26, 2024 17:18:16.902144909 CEST	443	49777	142.250.217.228	192.168.2.6
Apr 26, 2024 17:18:18.332428932 CEST	49778	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:18:18.332469940 CEST	443	49778	52.159.126.152	192.168.2.6
Apr 26, 2024 17:18:18.332561016 CEST	49778	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:18:18.333354950 CEST	49778	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:18:18.333367109 CEST	443	49778	52.159.126.152	192.168.2.6
Apr 26, 2024 17:18:18.812613964 CEST	443	49778	52.159.126.152	192.168.2.6
Apr 26, 2024 17:18:18.812717915 CEST	49778	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:18:18.815079927 CEST	49778	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:18:18.815090895 CEST	443	49778	52.159.126.152	192.168.2.6
Apr 26, 2024 17:18:18.815414906 CEST	443	49778	52.159.126.152	192.168.2.6
Apr 26, 2024 17:18:18.817715883 CEST	49778	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:18:18.817715883 CEST	49778	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:18:18.817733049 CEST	443	49778	52.159.126.152	192.168.2.6
Apr 26, 2024 17:18:18.817847967 CEST	49778	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:18:18.860111952 CEST	443	49778	52.159.126.152	192.168.2.6
Apr 26, 2024 17:18:18.974179029 CEST	443	49778	52.159.126.152	192.168.2.6
Apr 26, 2024 17:18:18.974294901 CEST	443	49778	52.159.126.152	192.168.2.6
Apr 26, 2024 17:18:18.974481106 CEST	49778	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:18:18.974597931 CEST	49778	443	192.168.2.6	52.159.126.152
Apr 26, 2024 17:18:18.974621058 CEST	443	49778	52.159.126.152	192.168.2.6
Apr 26, 2024 17:18:19.625530958 CEST	80	49723	15.197.204.56	192.168.2.6
Apr 26, 2024 17:18:19.625639915 CEST	49723	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:18:20.902064085 CEST	49723	80	192.168.2.6	15.197.204.56
Apr 26, 2024 17:18:21.029036999 CEST	80	49723	15.197.204.56	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 17:17:00.411781073 CEST	53	56168	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:00.422238111 CEST	53	59783	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:02.969010115 CEST	53	54895	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:03.017932892 CEST	59982	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:03.018122911 CEST	65521	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:03.187720060 CEST	53	59982	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:03.188256025 CEST	53	65521	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:03.793045998 CEST	51395	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:03.793245077 CEST	54507	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:03.980695009 CEST	53	54507	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:03.981256962 CEST	53	51395	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:04.568430901 CEST	65350	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:04.569374084 CEST	51897	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:04.694077969 CEST	53	65350	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:04.694432020 CEST	53	51897	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:04.695481062 CEST	58358	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:04.696234941 CEST	59023	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:04.699938059 CEST	49778	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:04.700483084 CEST	63952	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:04.701471090 CEST	52317	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:04.702198029 CEST	55883	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:04.820334911 CEST	53	58358	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:04.822146893 CEST	53	59023	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:04.825978994 CEST	53	49778	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:04.827209949 CEST	53	63952	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:10.133672953 CEST	59485	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:10.134320974 CEST	58171	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:10.259282112 CEST	53	58171	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:10.259311914 CEST	53	59485	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:10.855561972 CEST	52388	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:10.855886936 CEST	54272	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:10.856688976 CEST	62830	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:10.857037067 CEST	62125	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:10.857945919 CEST	55907	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:10.858331919 CEST	53177	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:10.981668949 CEST	53	54272	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:10.981985092 CEST	53	62830	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:10.981997013 CEST	53	52388	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:10.982954025 CEST	53	62125	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:10.983360052 CEST	53	55907	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:10.983588934 CEST	53	53177	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:11.661531925 CEST	57907	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:11.662210941 CEST	62655	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:11.742388010 CEST	50178	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:11.742585897 CEST	54078	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:11.751106977 CEST	57395	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:11.751564026 CEST	63922	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:11.789186954 CEST	53	62655	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:11.803988934 CEST	53	57907	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:11.867563009 CEST	53	50178	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:11.868705034 CEST	53	54078	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:11.876914024 CEST	53	57395	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:11.877119064 CEST	53	63922	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:13.631186962 CEST	62697	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:13.631506920 CEST	63284	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:15.761560917 CEST	63030	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:15.761699915 CEST	56170	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:15.889807940 CEST	53	63030	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:15.890569925 CEST	53	56170	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:15.925806999 CEST	49753	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:15.926106930 CEST	50227	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:16.051336050 CEST	53	49753	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:16.052525043 CEST	53	50227	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:17.182950020 CEST	56793	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:17.183274031 CEST	64532	53	192.168.2.6	1.1.1.1
Apr 26, 2024 17:17:17.307658911 CEST	53	56793	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:17.308753014 CEST	53	64532	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:22.613713026 CEST	53	50943	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:26.726005077 CEST	53	54151	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:26.833347082 CEST	53	52022	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:28.174981117 CEST	53	64123	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:28.571584940 CEST	53	61069	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:29.197810888 CEST	53	55999	1.1.1.1	192.168.2.6
Apr 26, 2024 17:17:49.871510029 CEST	53	51513	1.1.1.1	192.168.2.6
Apr 26, 2024 17:18:00.269393921 CEST	53	51496	1.1.1.1	192.168.2.6
Apr 26, 2024 17:18:14.546041965 CEST	53	61083	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 17:17:03.017932892 CEST	192.168.2.6	1.1.1.1	0x502a	Standard query (0)	c.conversionlogic.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:03.018122911 CEST	192.168.2.6	1.1.1.1	0xb66a	Standard query (0)	c.conversionlogic.net	65	IN (0x0001)	false
Apr 26, 2024 17:17:03.793045998 CEST	192.168.2.6	1.1.1.1	0x347f	Standard query (0)	ww1.conversionlogic.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:03.793245077 CEST	192.168.2.6	1.1.1.1	0xd2b8	Standard query (0)	ww1.conversionlogic.net	65	IN (0x0001)	false
Apr 26, 2024 17:17:04.568430901 CEST	192.168.2.6	1.1.1.1	0x304	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:04.569374084 CEST	192.168.2.6	1.1.1.1	0xd97e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 17:17:04.695481062 CEST	192.168.2.6	1.1.1.1	0xfdeb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:04.696234941 CEST	192.168.2.6	1.1.1.1	0xdf00	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 17:17:04.699938059 CEST	192.168.2.6	1.1.1.1	0xa931	Standard query (0)	btloader.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:04.700483084 CEST	192.168.2.6	1.1.1.1	0x26d1	Standard query (0)	btloader.com	65	IN (0x0001)	false
Apr 26, 2024 17:17:04.701471090 CEST	192.168.2.6	1.1.1.1	0xa66e	Standard query (0)	img1.wsimg.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:04.702198029 CEST	192.168.2.6	1.1.1.1	0x97d0	Standard query (0)	img1.wsimg.com	65	IN (0x0001)	false
Apr 26, 2024 17:17:10.133672953 CEST	192.168.2.6	1.1.1.1	0xe387	Standard query (0)	www.adsensecustomsearchads.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:10.134320974 CEST	192.168.2.6	1.1.1.1	0xbb2a	Standard query (0)	www.adsensecustomsearchads.com	65	IN (0x0001)	false
Apr 26, 2024 17:17:10.855561972 CEST	192.168.2.6	1.1.1.1	0x7c5e	Standard query (0)	api.btloader.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:10.855886936 CEST	192.168.2.6	1.1.1.1	0x23a7	Standard query (0)	api.btloader.com	65	IN (0x0001)	false
Apr 26, 2024 17:17:10.856688976 CEST	192.168.2.6	1.1.1.1	0x2876	Standard query (0)	ad-delivery.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:10.857037067 CEST	192.168.2.6	1.1.1.1	0xa5a5	Standard query (0)	ad-delivery.net	65	IN (0x0001)	false
Apr 26, 2024 17:17:10.857945919 CEST	192.168.2.6	1.1.1.1	0x9067	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:10.858331919 CEST	192.168.2.6	1.1.1.1	0x44d0	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 17:17:11.661531925 CEST	192.168.2.6	1.1.1.1	0xc666	Standard query (0)	api.aws.parking.godaddy.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:11.662210941 CEST	192.168.2.6	1.1.1.1	0xde79	Standard query (0)	api.aws.parking.godaddy.com	65	IN (0x0001)	false
Apr 26, 2024 17:17:11.742388010 CEST	192.168.2.6	1.1.1.1	0xfa05	Standard query (0)	ad-delivery.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:11.742585897 CEST	192.168.2.6	1.1.1.1	0xad55	Standard query (0)	ad-delivery.net	65	IN (0x0001)	false
Apr 26, 2024 17:17:11.751106977 CEST	192.168.2.6	1.1.1.1	0x3155	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:11.751564026 CEST	192.168.2.6	1.1.1.1	0xe213	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Apr 26, 2024 17:17:13.631186962 CEST	192.168.2.6	1.1.1.1	0x517d	Standard query (0)	img1.wsimg.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:13.631506920 CEST	192.168.2.6	1.1.1.1	0xe3fb	Standard query (0)	img1.wsimg.com	65	IN (0x0001)	false
Apr 26, 2024 17:17:15.761560917 CEST	192.168.2.6	1.1.1.1	0xbde8	Standard query (0)	www.adsensecustomsearchads.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:15.761699915 CEST	192.168.2.6	1.1.1.1	0x9453	Standard query (0)	www.adsensecustomsearchads.com	65	IN (0x0001)	false
Apr 26, 2024 17:17:15.925806999 CEST	192.168.2.6	1.1.1.1	0xdf00	Standard query (0)	api.aws.parking.godaddy.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:15.926106930 CEST	192.168.2.6	1.1.1.1	0xcbdc	Standard query (0)	api.aws.parking.godaddy.com	65	IN (0x0001)	false
Apr 26, 2024 17:17:17.182950020 CEST	192.168.2.6	1.1.1.1	0x4f4c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:17.183274031 CEST	192.168.2.6	1.1.1.1	0xd9ea	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 17:17:03.187720060 CEST	1.1.1.1	192.168.2.6	0x502a	No error (0)	c.conversionlogic.net		63.141.242.46	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:03.980695009 CEST	1.1.1.1	192.168.2.6	0xd2b8	No error (0)	ww1.conversionlogic.net	www10.smartname.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:03.981256962 CEST	1.1.1.1	192.168.2.6	0x347f	No error (0)	ww1.conversionlogic.net	www10.smartname.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:03.981256962 CEST	1.1.1.1	192.168.2.6	0x347f	No error (0)	www10.smartname.com		15.197.204.56	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:03.981256962 CEST	1.1.1.1	192.168.2.6	0x347f	No error (0)	www10.smartname.com		3.33.243.145	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:04.694077969 CEST	1.1.1.1	192.168.2.6	0x304	No error (0)	www.google.com		142.250.217.228	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:04.694432020 CEST	1.1.1.1	192.168.2.6	0xd97e	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 17:17:04.820334911 CEST	1.1.1.1	192.168.2.6	0xfdeb	No error (0)	www.google.com		192.178.50.36	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:04.822146893 CEST	1.1.1.1	192.168.2.6	0xdf00	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 17:17:04.825978994 CEST	1.1.1.1	192.168.2.6	0xa931	No error (0)	btloader.com		172.67.41.60	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:04.825978994 CEST	1.1.1.1	192.168.2.6	0xa931	No error (0)	btloader.com		104.22.74.216	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:04.825978994 CEST	1.1.1.1	192.168.2.6	0xa931	No error (0)	btloader.com		104.22.75.216	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:04.827209949 CEST	1.1.1.1	192.168.2.6	0x26d1	No error (0)	btloader.com			65	IN (0x0001)	false
Apr 26, 2024 17:17:04.828458071 CEST	1.1.1.1	192.168.2.6	0xa66e	No error (0)	img1.wsimg.com	global-wildcard.wsimg.com.sni-only.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:04.830693960 CEST	1.1.1.1	192.168.2.6	0x97d0	No error (0)	img1.wsimg.com	global-wildcard.wsimg.com.sni-only.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:10.259282112 CEST	1.1.1.1	192.168.2.6	0xbb2a	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:10.259311914 CEST	1.1.1.1	192.168.2.6	0xe387	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:10.259311914 CEST	1.1.1.1	192.168.2.6	0xe387	No error (0)	www3.l.google.com		172.217.165.206	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:10.981985092 CEST	1.1.1.1	192.168.2.6	0x2876	No error (0)	ad-delivery.net		104.26.3.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:10.981985092 CEST	1.1.1.1	192.168.2.6	0x2876	No error (0)	ad-delivery.net		104.26.2.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:10.981985092 CEST	1.1.1.1	192.168.2.6	0x2876	No error (0)	ad-delivery.net		172.67.69.19	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:10.981997013 CEST	1.1.1.1	192.168.2.6	0x7c5e	No error (0)	api.btloader.com		130.211.23.194	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:10.982954025 CEST	1.1.1.1	192.168.2.6	0xa5a5	No error (0)	ad-delivery.net			65	IN (0x0001)	false
Apr 26, 2024 17:17:10.983360052 CEST	1.1.1.1	192.168.2.6	0x9067	No error (0)	ad.doubleclick.net		142.251.35.230	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:10.983588934 CEST	1.1.1.1	192.168.2.6	0x44d0	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 17:17:11.789186954 CEST	1.1.1.1	192.168.2.6	0xde79	No error (0)	api.aws.parking.godaddy.com	gddomainparking.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:11.803988934 CEST	1.1.1.1	192.168.2.6	0xc666	No error (0)	api.aws.parking.godaddy.com	gddomainparking.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:11.803988934 CEST	1.1.1.1	192.168.2.6	0xc666	No error (0)	gddomainparking.com		52.13.101.202	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:11.803988934 CEST	1.1.1.1	192.168.2.6	0xc666	No error (0)	gddomainparking.com		35.167.118.102	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:11.867563009 CEST	1.1.1.1	192.168.2.6	0xfa05	No error (0)	ad-delivery.net		104.26.3.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:11.867563009 CEST	1.1.1.1	192.168.2.6	0xfa05	No error (0)	ad-delivery.net		104.26.2.70	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:11.867563009 CEST	1.1.1.1	192.168.2.6	0xfa05	No error (0)	ad-delivery.net		172.67.69.19	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:11.868705034 CEST	1.1.1.1	192.168.2.6	0xad55	No error (0)	ad-delivery.net			65	IN (0x0001)	false
Apr 26, 2024 17:17:11.876914024 CEST	1.1.1.1	192.168.2.6	0x3155	No error (0)	ad.doubleclick.net		142.251.35.230	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:11.877119064 CEST	1.1.1.1	192.168.2.6	0xe213	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Apr 26, 2024 17:17:13.747530937 CEST	1.1.1.1	192.168.2.6	0xdfd	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:13.747530937 CEST	1.1.1.1	192.168.2.6	0xdfd	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:13.757426023 CEST	1.1.1.1	192.168.2.6	0xe3fb	No error (0)	img1.wsimg.com	global-wildcard.wsimg.com.sni-only.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:13.759037018 CEST	1.1.1.1	192.168.2.6	0x517d	No error (0)	img1.wsimg.com	global-wildcard.wsimg.com.sni-only.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:15.889807940 CEST	1.1.1.1	192.168.2.6	0xbde8	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:15.889807940 CEST	1.1.1.1	192.168.2.6	0xbde8	No error (0)	www3.l.google.com		142.250.217.174	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:15.890569925 CEST	1.1.1.1	192.168.2.6	0x9453	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:16.051336050 CEST	1.1.1.1	192.168.2.6	0xdf00	No error (0)	api.aws.parking.godaddy.com	gddomainparking.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:16.051336050 CEST	1.1.1.1	192.168.2.6	0xdf00	No error (0)	gddomainparking.com		52.13.101.202	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:16.051336050 CEST	1.1.1.1	192.168.2.6	0xdf00	No error (0)	gddomainparking.com		35.167.118.102	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:16.052525043 CEST	1.1.1.1	192.168.2.6	0xcbdc	No error (0)	api.aws.parking.godaddy.com	gddomainparking.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 17:17:16.204539061 CEST	1.1.1.1	192.168.2.6	0xffa	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:16.204539061 CEST	1.1.1.1	192.168.2.6	0xffa	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:17.307658911 CEST	1.1.1.1	192.168.2.6	0x4f4c	No error (0)	www.google.com		142.250.217.228	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:17:17.308753014 CEST	1.1.1.1	192.168.2.6	0xd9ea	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

ww1.conversionlogic.net

btloader.com

www.google.com

ad-delivery.net

ad.doubleclick.net

api.btloader.com

api.aws.parking.godaddy.com

www.adsensecustomsearchads.com

fs.microsoft.com

https:

c.conversionlogic.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49719	63.141.242.46	80	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 17:17:03.568072081 CEST	436	OUT	GET / HTTP/1.1 Host: c.conversionlogic.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 26, 2024 17:17:03.738642931 CEST	378	IN	HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Fri, 26 Apr 2024 15:17:03 GMT location: http://ww1.conversionlogic.net server: nginx set-cookie: sid=095efd66-03e0-11ef-be3b-9eb7475dca1b; path=/; domain=.conversionlogic.net; expires=Wed, 14 May 2092 18:31:10 GMT; max-age=2147483647; HttpOnly Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: Redirecting

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49723	15.197.204.56	80	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 17:17:04.154951096 CEST	488	OUT	GET / HTTP/1.1 Host: ww1.conversionlogic.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: sid=095efd66-03e0-11ef-be3b-9eb7475dca1b
Apr 26, 2024 17:17:04.312345982 CEST	259	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 26 Apr 2024 15:17:04 GMT Content-Type: text/html Content-Length: 114 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>
Apr 26, 2024 17:17:04.471282959 CEST	536	OUT	GET /lander HTTP/1.1 Host: ww1.conversionlogic.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: sid=095efd66-03e0-11ef-be3b-9eb7475dca1b
Apr 26, 2024 17:17:04.522641897 CEST	259	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 26 Apr 2024 15:17:04 GMT Content-Type: text/html Content-Length: 114 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>
Apr 26, 2024 17:17:04.625109911 CEST	1238	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 26 Apr 2024 15:17:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private, max-age=86400 Set-Cookie: expiry_partner=; Path=/; Max-Age=86400 Set-Cookie: caf_ipaddr=102.129.152.220; Path=/; Max-Age=86400 Set-Cookie: country=US; Path=/; Max-Age=86400 Set-Cookie: city=Miami; Path=/; Max-Age=86400 Set-Cookie: lander_type=parking; Path=/; Max-Age=86400 X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_PYsDcJD+xvtqVYrb6R4ZSGvqxvflENKHdKTOe0EBlAJ76WPiG0bWLMQGcQSPsSWdcYwV6r+kwr79Lp3hWMpB9A X-Content-Type-Options: nosniff Data Raw: 32 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 2f 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 64 73 65 6e 73 65 2f 64 6f 6d 61 69 6e 73 2f 63 61 66 2e 6a 73 3f 61 62 70 3d 31 26 67 64 61 62 70 3d 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 62 74 6c 6f 61 64 65 72 2e 63 6f 6d 2f 74 61 67 3f 6f 3d 35 30 39 37 39 32 36 37 38 32 36 31 35 35 35 32 26 75 70 61 70 69 3d 74 72 75 65 22 20 61 73 79 6e 63 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 4c 41 4e 44 45 52 5f 53 59 53 54 45 4d 3d 22 43 50 22 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 70 61 72 6b 69 6e 67 2d 6c 61 6e 64 65 72 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 39 62 66 61 61 35 33 32 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 70 61 72 0d 0a Data Ascii: 200<!doctype html><html lang="en"><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="icon" href="data:,"/><script src="https://www.google.com/adsense/domains/caf.js?abp=1&gdabp=true"></script><script src="https://btloader.com/tag?o=5097926782615552&upapi=true" async></script><script>window.LANDER_SYSTEM="CP"</script><script defer="defer" src="https://img1.wsimg.com/parking-lander/static/js/main.9bfaa532.js"></script><link href="https://img1.wsimg.com/par
Apr 26, 2024 17:17:04.625129938 CEST	119	IN	Data Raw: 36 63 0d 0a 6b 69 6e 67 2d 6c 61 6e 64 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 6d 61 69 6e 2e 38 61 31 64 31 39 61 66 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 69 Data Ascii: 6cking-lander/static/css/main.8a1d19af.css" rel="stylesheet"></head><body><div id="root"></div></body></html>0
Apr 26, 2024 17:17:49.628262997 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49724	15.197.204.56	80	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 17:17:49.183686972 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 26, 2024 17:17:16.549381018 CEST	173.222.162.64	443	192.168.2.6	49705	CN=r.bing.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Oct 18 22:32:40 CEST 2023 Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
Apr 26, 2024 17:17:16.549381018 CEST	173.222.162.64	443	192.168.2.6	49705	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		28a2c9bd18a11de089ef85a160da29e4

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49722	52.159.126.152	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4b 4c 72 51 34 45 74 49 62 6b 36 75 6a 31 4a 38 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 39 35 34 63 38 63 36 39 65 37 66 34 63 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: KLrQ4EtIbk6uj1J8.1Context: 74954c8c69e7f4cc
2024-04-26 15:17:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-26 15:17:04 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 4b 4c 72 51 34 45 74 49 62 6b 36 75 6a 31 4a 38 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 39 35 34 63 38 63 36 39 65 37 66 34 63 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 32 69 76 61 4e 53 52 2b 39 41 44 35 65 6b 72 56 4c 56 41 73 44 74 4a 6a 54 61 30 61 46 49 4b 5a 2b 62 79 58 50 79 53 31 6b 75 6c 6b 6e 56 4a 31 45 4c 33 31 4c 64 6d 58 4f 44 77 46 47 2f 79 36 2f 74 6b 6b 30 33 42 41 68 48 71 73 36 4b 36 57 6e 45 77 6a 66 33 71 66 37 48 4f 31 2b 77 62 7a 61 45 41 55 78 71 4b 4b 57 64 76 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: KLrQ4EtIbk6uj1J8.2Context: 74954c8c69e7f4cc<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS2ivaNSR+9AD5ekrVLVAsDtJjTa0aFIKZ+byXPyS1kulknVJ1EL31LdmXODwFG/y6/tkk03BAhHqs6K6WnEwjf3qf7HO1+wbzaEAUxqKKWdvK
2024-04-26 15:17:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4b 4c 72 51 34 45 74 49 62 6b 36 75 6a 31 4a 38 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 39 35 34 63 38 63 36 39 65 37 66 34 63 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: KLrQ4EtIbk6uj1J8.3Context: 74954c8c69e7f4cc<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-26 15:17:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-26 15:17:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 31 49 79 33 45 4c 6b 50 6b 47 6e 68 45 55 72 6f 45 50 36 72 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: b1Iy3ELkPkGnhEUroEP6rQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49727	172.67.41.60	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:09 UTC	551	OUT	GET /tag?o=5097926782615552&upapi=true HTTP/1.1 Host: btloader.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:09 UTC	446	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 15:17:09 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300 Etag: W/"014d33760e5cfabf5989efdc7561c931" Last-Modified: Fri, 26 Apr 2024 15:00:40 GMT Vary: Origin Via: 1.1 google CF-Cache-Status: HIT Age: 856 Server: cloudflare CF-RAY: 87a789c04892da01-MIA
2024-04-26 15:17:09 UTC	923	IN	Data Raw: 37 64 65 33 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 73 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 73 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 26 26 28 65 5b 72 5d 3d 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 65 7d 2c 65 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 74 28 65 Data Ascii: 7de3!function(){"use strict";var e=function(){return e=Object.assign\|\|function(e){for(var t,n=1,s=arguments.length;n<s;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},e.apply(this,arguments)};function t(e
2024-04-26 15:17:09 UTC	1369	IN	Data Raw: 77 7c 7c 28 28 72 3d 73 2e 72 65 74 75 72 6e 29 26 26 72 2e 63 61 6c 6c 28 73 29 2c 30 29 3a 73 2e 6e 65 78 74 29 26 26 21 28 72 3d 72 2e 63 61 6c 6c 28 73 2c 69 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 72 3b 73 77 69 74 63 68 28 73 3d 30 2c 72 26 26 28 69 3d 5b 32 26 69 5b 30 5d 2c 72 2e 76 61 6c 75 65 5d 29 2c 69 5b 30 5d 29 7b 63 61 73 65 20 30 3a 63 61 73 65 20 31 3a 72 3d 69 3b 62 72 65 61 6b 3b 63 61 73 65 20 34 3a 72 65 74 75 72 6e 20 6f 2e 6c 61 62 65 6c 2b 2b 2c 7b 76 61 6c 75 65 3a 69 5b 31 5d 2c 64 6f 6e 65 3a 21 31 7d 3b 63 61 73 65 20 35 3a 6f 2e 6c 61 62 65 6c 2b 2b 2c 73 3d 69 5b 31 5d 2c 69 3d 5b 30 5d 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 20 37 3a 69 3d 6f 2e 6f 70 73 2e 70 6f 70 28 29 2c 6f 2e 74 72 79 73 2e 70 6f 70 28 Data Ascii: w\|\|((r=s.return)&&r.call(s),0):s.next)&&!(r=r.call(s,i[1])).done)return r;switch(s=0,r&&(i=[2&i[0],r.value]),i[0]){case 0:case 1:r=i;break;case 4:return o.label++,{value:i[1],done:!1};case 5:o.label++,s=i[1],i=[0];continue;case 7:i=o.ops.pop(),o.trys.pop(
2024-04-26 15:17:09 UTC	1369	IN	Data Raw: 6f 69 64 20 30 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 69 2c 61 2c 63 3b 72 65 74 75 72 6e 20 6e 28 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 73 77 69 74 63 68 28 6e 2e 6c 61 62 65 6c 29 7b 63 61 73 65 20 30 3a 72 65 74 75 72 6e 20 6e 2e 74 72 79 73 2e 70 75 73 68 28 5b 30 2c 33 2c 2c 34 5d 29 2c 77 69 6e 64 6f 77 2e 5f 5f 62 74 3d 77 69 6e 64 6f 77 2e 5f 5f 62 74 7c 7c 7b 7d 2c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 5f 5f 62 74 2e 63 75 73 74 6f 6d 44 65 74 65 63 74 41 64 42 6c 6f 63 6b 3f 5b 33 2c 32 5d 3a 5b 34 2c 77 69 6e 64 6f 77 2e 5f 5f 62 74 2e 63 75 73 74 6f 6d 44 65 74 65 63 74 41 64 42 6c 6f 63 6b 28 29 5d 3b 63 61 73 65 20 31 3a 72 65 74 75 72 6e 5b 32 2c 6e 2e 73 65 6e Data Ascii: oid 0,(function(){var e,t,i,a,c;return n(this,(function(n){switch(n.label){case 0:return n.trys.push([0,3,,4]),window.__bt=window.__bt\|\|{},"function"!=typeof window.__bt.customDetectAdBlock?[3,2]:[4,window.__bt.customDetectAdBlock()];case 1:return[2,n.sen
2024-04-26 15:17:09 UTC	1369	IN	Data Raw: 29 7d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 28 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 7c 7c 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 29 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 7d 76 61 72 20 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 77 69 6e 64 6f 77 3b 74 72 79 7b 69 66 28 74 6f 70 2e 64 6f 63 75 6d 65 6e 74 29 72 65 74 75 72 6e 20 74 6f 70 7d 63 61 74 63 68 28 65 29 7b 7d 74 72 79 7b 66 6f 72 28 3b 65 2e 70 61 72 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 3b 29 65 3d 65 2e 70 61 72 65 6e 74 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 20 65 7d 28 29 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 22 22 21 3d 3d 64 Data Ascii: )}))}function l(e){(window.document.body\|\|window.document.documentElement).removeChild(e)}var u=function(){var e=window;try{if(top.document)return top}catch(e){}try{for(;e.parent.document;)e=e.parent}catch(e){}return e}();var d=function(){try{return""!==d
2024-04-26 15:17:09 UTC	1369	IN	Data Raw: 6e 61 6d 65 22 3a 22 22 2c 20 22 76 69 65 77 22 3a 22 22 2c 20 22 73 69 6e 67 6c 65 5f 63 6c 69 63 6b 5f 65 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 20 22 70 61 67 65 5f 76 69 65 77 73 5f 74 6f 5f 72 65 6e 64 65 72 22 3a 22 30 22 2c 20 22 70 72 65 6d 69 75 6d 5f 62 79 70 61 73 73 5f 6d 6f 64 65 5f 65 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 20 22 68 61 72 64 5f 6d 65 73 73 61 67 65 5f 77 61 6c 6c 5f 6d 6f 64 65 5f 65 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 20 22 61 6c 6c 6f 77 5f 72 65 6e 64 65 72 5f 74 6f 5f 61 61 5f 75 73 65 72 73 22 3a 66 61 6c 73 65 2c 20 22 6c 61 6e 64 69 6e 67 5f 74 65 78 74 5f 65 6e 22 3a 22 22 2c 20 22 63 74 61 5f 62 75 74 74 6f 6e 5f 63 6f 6c 6f 72 22 3a 22 22 2c 20 22 66 6f 6e 74 5f 74 79 70 65 22 3a 22 22 2c 20 22 72 65 6e Data Ascii: name":"", "view":"", "single_click_enabled":false, "page_views_to_render":"0", "premium_bypass_mode_enabled":false, "hard_message_wall_mode_enabled":false, "allow_render_to_aa_users":false, "landing_text_en":"", "cta_button_color":"", "font_type":"", "ren
2024-04-26 15:17:09 UTC	1369	IN	Data Raw: 32 22 2c 22 77 69 64 67 65 74 22 3a 66 61 6c 73 65 2c 22 61 22 3a 66 61 6c 73 65 7d 2c 22 6e 79 65 64 61 2e 63 6f 6d 22 3a 7b 22 63 65 22 3a 66 61 6c 73 65 2c 22 6d 65 22 3a 66 61 6c 73 65 2c 22 77 22 3a 22 35 31 31 34 36 32 39 34 34 31 34 35 34 30 38 30 22 2c 22 77 69 64 67 65 74 22 3a 66 61 6c 73 65 2c 22 61 22 3a 66 61 6c 73 65 7d 2c 22 6f 73 63 6e 2e 63 6f 6d 22 3a 7b 22 63 65 22 3a 66 61 6c 73 65 2c 22 6d 65 22 3a 66 61 6c 73 65 2c 22 77 22 3a 22 35 31 38 31 34 38 35 35 37 33 34 37 32 32 35 36 22 2c 22 77 69 64 67 65 74 22 3a 66 61 6c 73 65 2c 22 61 22 3a 66 61 6c 73 65 7d 2c 22 70 68 6f 74 6f 63 68 72 6f 6e 69 63 6c 65 73 2e 63 6f 6d 22 3a 7b 22 63 65 22 3a 66 61 6c 73 65 2c 22 6d 65 22 3a 66 61 6c 73 65 2c 22 77 22 3a 22 35 30 37 35 30 33 31 34 35 Data Ascii: 2","widget":false,"a":false},"nyeda.com":{"ce":false,"me":false,"w":"5114629441454080","widget":false,"a":false},"oscn.com":{"ce":false,"me":false,"w":"5181485573472256","widget":false,"a":false},"photochronicles.com":{"ce":false,"me":false,"w":"507503145
2024-04-26 15:17:09 UTC	1369	IN	Data Raw: 77 65 62 73 69 74 65 49 44 3a 76 6f 69 64 20 30 2c 63 6f 6e 74 65 6e 74 45 6e 61 62 6c 65 64 3a 21 31 2c 6d 6f 62 69 6c 65 43 6f 6e 74 65 6e 74 45 6e 61 62 6c 65 64 3a 21 31 2c 77 69 64 67 65 74 3a 21 31 7d 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 3d 65 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 5b 5c 5d 5d 2f 67 2c 22 5c 5c 24 26 22 29 3b 76 61 72 20 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5b 3f 26 5d 22 2b 65 2b 22 28 3d 28 5b 5e 26 23 5d 2a 29 7c 26 7c 23 7c 24 29 22 29 2e 65 78 65 63 28 74 29 3b 72 65 74 75 72 6e 20 6e 3f 6e 5b 32 5d 3f 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6e 5b 32 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 22 20 22 29 29 3a 22 22 3a 6e 75 6c 6c 7d 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b Data Ascii: websiteID:void 0,contentEnabled:!1,mobileContentEnabled:!1,widget:!1},h=function(e,t){e=e.replace(/[\[\]]/g,"\\$&");var n=new RegExp("[?&]"+e+"(=([^&#]*)\|&\|#\|$)").exec(t);return n?n[2]?decodeURIComponent(n[2].replace(/\+/g," ")):"":null},g=function(){try{
2024-04-26 15:17:09 UTC	1369	IN	Data Raw: 73 3a 4f 2e 77 65 62 73 69 74 65 5f 69 64 2c 74 2e 63 6f 6e 74 65 6e 74 45 6e 61 62 6c 65 64 3d 6e 75 6c 6c 21 3d 3d 28 72 3d 4f 2e 63 65 29 26 26 76 6f 69 64 20 30 21 3d 3d 72 3f 72 3a 4f 2e 63 6f 6e 74 65 6e 74 5f 65 6e 61 62 6c 65 64 2c 74 2e 6d 6f 62 69 6c 65 43 6f 6e 74 65 6e 74 45 6e 61 62 6c 65 64 3d 6e 75 6c 6c 21 3d 3d 28 69 3d 4f 2e 6d 65 29 26 26 76 6f 69 64 20 30 21 3d 3d 69 3f 69 3a 4f 2e 6d 6f 62 69 6c 65 5f 63 6f 6e 74 65 6e 74 5f 65 6e 61 62 6c 65 64 2c 74 2e 77 69 64 67 65 74 3d 6e 75 6c 6c 21 3d 3d 28 6f 3d 4f 2e 77 69 64 67 65 74 29 26 26 76 6f 69 64 20 30 21 3d 3d 6f 26 26 6f 2c 6d 3d 21 30 3b 65 6c 73 65 20 66 6f 72 28 41 20 69 6e 20 43 29 28 67 2e 69 6e 64 65 78 4f 66 28 41 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3e 2d 31 7c 7c Data Ascii: s:O.website_id,t.contentEnabled=null!==(r=O.ce)&&void 0!==r?r:O.content_enabled,t.mobileContentEnabled=null!==(i=O.me)&&void 0!==i?i:O.mobile_content_enabled,t.widget=null!==(o=O.widget)&&void 0!==o&&o,m=!0;else for(A in C)(g.indexOf(A.toLowerCase())>-1\|\|
2024-04-26 15:17:09 UTC	1369	IN	Data Raw: 6e 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2e 5f 5f 62 74 5f 74 61 67 5f 64 3d 7b 6f 72 67 49 44 3a 77 2c 64 6f 6d 61 69 6e 3a 79 2c 73 69 74 65 49 6e 66 6f 3a 65 2e 73 69 74 65 49 6e 66 6f 2c 61 70 69 44 6f 6d 61 69 6e 3a 5f 2c 76 65 72 73 69 6f 6e 3a 53 2c 77 65 62 73 69 74 65 73 44 61 74 61 3a 43 7d 7d 29 29 3b 63 6c 61 73 73 20 4e 20 65 78 74 65 6e 64 73 20 45 72 72 6f 72 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 73 75 70 65 72 28 65 29 2c 74 68 69 73 2e 6e 61 6d 65 3d 22 44 65 63 6f 64 69 6e 67 45 72 72 6f 72 22 7d 7d 63 6c 61 73 73 20 55 20 65 78 74 65 6e 64 73 20 45 72 72 6f 72 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 73 75 70 65 72 28 65 29 2c 74 68 69 73 2e 6e 61 6d 65 3d 22 45 6e 63 6f 64 69 6e 67 45 72 72 6f 72 Data Ascii: n((function(e){window.__bt_tag_d={orgID:w,domain:y,siteInfo:e.siteInfo,apiDomain:_,version:S,websitesData:C}}));class N extends Error{constructor(e){super(e),this.name="DecodingError"}}class U extends Error{constructor(e){super(e),this.name="EncodingError
2024-04-26 15:17:09 UTC	1369	IN	Data Raw: 3b 74 2b 3d 74 68 69 73 2e 42 41 53 49 53 29 6e 2b 3d 74 68 69 73 2e 44 49 43 54 5b 70 61 72 73 65 49 6e 74 28 65 2e 73 75 62 73 74 72 28 74 2c 74 68 69 73 2e 42 41 53 49 53 29 2c 32 29 5d 3b 72 65 74 75 72 6e 20 6e 7d 73 74 61 74 69 63 20 64 65 63 6f 64 65 28 65 29 7b 69 66 28 21 2f 5e 5b 41 2d 5a 61 2d 7a 30 2d 39 5c 2d 5f 5d 2b 24 2f 2e 74 65 73 74 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 4e 28 22 49 6e 76 61 6c 69 64 6c 79 20 65 6e 63 6f 64 65 64 20 42 61 73 65 36 34 55 52 4c 20 73 74 72 69 6e 67 22 29 3b 6c 65 74 20 74 3d 22 22 3b 66 6f 72 28 6c 65 74 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 63 6f 6e 73 74 20 73 3d 74 68 69 73 2e 52 45 56 45 52 53 45 5f 44 49 43 54 2e 67 65 74 28 65 5b 6e 5d 29 2e 74 6f 53 74 72 69 6e 67 28 32 Data Ascii: ;t+=this.BASIS)n+=this.DICT[parseInt(e.substr(t,this.BASIS),2)];return n}static decode(e){if(!/^[A-Za-z0-9\-_]+$/.test(e))throw new N("Invalidly encoded Base64URL string");let t="";for(let n=0;n<e.length;n++){const s=this.REVERSE_DICT.get(e[n]).toString(2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49728	192.178.50.36	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:09 UTC	636	OUT	GET /adsense/domains/caf.js?abp=1&gdabp=true HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:09 UTC	853	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui" Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} Content-Length: 190511 Date: Fri, 26 Apr 2024 15:17:09 GMT Expires: Fri, 26 Apr 2024 15:17:09 GMT Cache-Control: private, max-age=3600 ETag: "4985559589233400475" X-Content-Type-Options: nosniff Link: <https://www.adsensecustomsearchads.com>; rel="preconnect" Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 15:17:09 UTC	402	IN	Data Raw: 69 66 28 21 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 29 7b 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 3d 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 41 6c 74 4c 6f 61 64 65 72 3d 33 3b 76 61 72 20 73 66 66 65 44 61 74 61 5f 3d 7b 73 65 72 76 69 63 65 5f 68 6f 73 74 3a 22 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 68 61 73 68 3a 22 31 31 35 30 30 38 32 37 38 39 31 30 31 36 30 35 37 33 38 39 22 2c 70 61 63 6b 61 67 65 73 3a 22 64 6f 6d 61 69 6e 73 22 2c 6d 6f 64 75 6c 65 3a 22 61 64 73 22 2c 76 65 72 73 69 6f 6e 3a 22 31 22 2c 6d 3a 7b 63 65 69 3a 22 31 37 33 30 30 30 30 32 2c 31 37 33 30 31 34 33 37 2c 31 37 33 Data Ascii: if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"11500827891016057389",packages:"domains",module:"ads",version:"1",m:{cei:"17300002,17301437,173
2024-04-26 15:17:09 UTC	1255	IN	Data Raw: 53 74 72 61 74 65 67 79 22 3a 74 72 75 65 2c 22 5f 66 69 78 43 74 63 4c 69 6e 6b 73 4f 6e 49 6f 73 22 3a 74 72 75 65 2c 22 5f 67 6f 6f 67 45 6e 61 62 6c 65 51 75 70 22 3a 74 72 75 65 2c 22 5f 73 77 69 74 63 68 47 77 73 52 65 71 75 65 73 74 54 6f 55 73 65 41 64 73 65 6e 73 65 44 6f 6d 61 69 6e 22 3a 74 72 75 65 2c 22 5f 75 73 65 53 65 72 76 65 72 50 72 6f 76 69 64 65 64 44 6f 6d 61 69 6e 22 3a 74 72 75 65 2c 22 5f 77 61 69 74 4f 6e 43 6f 6e 73 65 6e 74 46 6f 72 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 45 6e 68 61 6e 63 65 64 54 61 72 67 65 74 69 6e 67 52 73 6f 6e 63 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 4e 6f 6e 62 6c 6f 63 6b 69 6e 67 53 61 73 43 6f 6f 6b 69 65 22 3a 74 72 75 65 7d 2c 6d 64 70 3a 31 38 Data Ascii: Strategy":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:18
2024-04-26 15:17:09 UTC	1255	IN	Data Raw: 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 79 6d 62 6f 6c 20 69 73 20 6e 6f 74 20 61 20 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 63 28 64 2b 28 66 7c 7c 22 22 29 2b 22 5f 22 2b 65 2b 2b 2c 66 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 66 2c 67 29 7b 74 68 69 73 2e 62 65 3d 66 3b 65 61 28 74 68 69 73 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 67 7d 29 7d 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 62 65 7d 3b 76 61 72 20 64 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 31 45 39 Data Ascii: new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g){this.be=f;ea(this,"description",{configurable:!0,writable:!0,value:g})}if(a)return a;c.prototype.toString=function(){return this.be};var d="jscomp_symbol_"+(1E9
2024-04-26 15:17:09 UTC	1255	IN	Data Raw: 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 29 6e 61 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 6f 61 3b 61 3a 7b 76 61 72 20 70 61 3d 7b 61 3a 21 30 7d 2c 71 61 3d 7b 7d 3b 74 72 79 7b 71 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 70 61 3b 6f 61 3d 71 61 2e 61 3b 62 72 65 61 6b 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 6f 61 3d 21 31 7d 6e 61 3d 6f 61 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 3b 69 66 28 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 21 3d 3d 62 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 61 2b 22 20 69 73 20 6e 6f 74 20 65 78 74 65 6e 73 69 62 6c 65 22 29 3b 72 65 74 75 72 6e 20 61 7d 3a 6e 75 Data Ascii: on"==typeof Object.setPrototypeOf)na=Object.setPrototypeOf;else{var oa;a:{var pa={a:!0},qa={};try{qa.__proto__=pa;oa=qa.a;break a}catch(a){}oa=!1}na=oa?function(a,b){a.__proto__=b;if(a.__proto__!==b)throw new TypeError(a+" is not extensible");return a}:nu
2024-04-26 15:17:09 UTC	1255	IN	Data Raw: 73 2e 43 2e 66 61 29 72 65 74 75 72 6e 20 78 61 28 74 68 69 73 2c 74 68 69 73 2e 43 2e 66 61 5b 22 74 68 72 6f 77 22 5d 2c 61 2c 74 68 69 73 2e 43 2e 53 61 29 3b 74 68 69 73 2e 43 2e 58 61 28 61 29 3b 72 65 74 75 72 6e 20 79 61 28 74 68 69 73 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 78 61 28 61 2c 62 2c 63 2c 64 29 7b 74 72 79 7b 76 61 72 20 65 3d 62 2e 63 61 6c 6c 28 61 2e 43 2e 66 61 2c 63 29 3b 69 66 28 21 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 4f 62 6a 65 63 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 74 65 72 61 74 6f 72 20 72 65 73 75 6c 74 20 22 2b 65 2b 22 20 69 73 20 6e 6f 74 20 61 6e 20 6f 62 6a 65 63 74 22 29 3b 69 66 28 21 65 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 61 2e 43 2e 4e 61 3d 21 31 2c 65 3b 76 61 72 20 66 Data Ascii: s.C.fa)return xa(this,this.C.fa["throw"],a,this.C.Sa);this.C.Xa(a);return ya(this)};function xa(a,b,c,d){try{var e=b.call(a.C.fa,c);if(!(e instanceof Object))throw new TypeError("Iterator result "+e+" is not an object");if(!e.done)return a.C.Na=!1,e;var f
2024-04-26 15:17:09 UTC	1255	IN	Data Raw: 69 6f 6e 20 64 28 67 29 7b 72 65 74 75 72 6e 20 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 3f 67 3a 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 68 29 7b 68 28 67 29 7d 29 7d 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 64 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 2e 62 61 29 7b 74 68 69 73 2e 62 61 3d 5b 5d 3b 76 61 72 20 68 3d 74 68 69 73 3b 74 68 69 73 2e 6e 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 68 2e 56 65 28 29 7d 29 7d 74 68 69 73 2e 62 61 2e 70 75 73 68 28 67 29 7d 3b 76 61 72 20 65 3d 68 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 65 28 67 2c 30 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 56 65 3d 66 Data Ascii: ion d(g){return g instanceof b?g:new b(function(h){h(g)})}if(a)return a;c.prototype.md=function(g){if(null==this.ba){this.ba=[];var h=this;this.nd(function(){h.Ve()})}this.ba.push(g)};var e=ha.setTimeout;c.prototype.nd=function(g){e(g,0)};c.prototype.Ve=f
2024-04-26 15:17:09 UTC	1255	IN	Data Raw: 74 68 69 73 2e 57 65 28 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 54 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 67 3d 74 68 69 73 3b 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 67 2e 43 66 28 29 29 7b 76 61 72 20 68 3d 68 61 2e 63 6f 6e 73 6f 6c 65 3b 0a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 68 26 26 68 2e 65 72 72 6f 72 28 67 2e 57 61 29 7d 7d 2c 31 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 43 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 42 64 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 67 3d 68 61 2e 43 75 73 74 6f 6d 45 76 65 6e 74 2c 68 3d 68 61 2e 45 76 65 6e 74 2c 6b 3d 68 61 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 Data Ascii: this.We()};b.prototype.Tf=function(){var g=this;e(function(){if(g.Cf()){var h=ha.console;"undefined"!==typeof h&&h.error(g.Wa)}},1)};b.prototype.Cf=function(){if(this.Bd)return!1;var g=ha.CustomEvent,h=ha.Event,k=ha.dispatchEvent;if("undefined"===typeof
2024-04-26 15:17:09 UTC	1255	IN	Data Raw: 74 68 69 73 2e 42 61 2e 70 75 73 68 28 6b 29 3b 74 68 69 73 2e 42 64 3d 21 30 7d 3b 62 2e 72 65 73 6f 6c 76 65 3d 64 3b 62 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 6b 28 67 29 7d 29 7d 3b 62 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6c 3d 77 28 67 29 2c 6e 3d 6c 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6c 2e 6e 65 78 74 28 29 29 64 28 6e 2e 76 61 6c 75 65 29 2e 6a 62 28 68 2c 6b 29 7d 29 7d 3b 62 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 77 28 67 29 2c 6b 3d 68 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e Data Ascii: this.Ba.push(k);this.Bd=!0};b.resolve=d;b.reject=function(g){return new b(function(h,k){k(g)})};b.race=function(g){return new b(function(h,k){for(var l=w(g),n=l.next();!n.done;n=l.next())d(n.value).jb(h,k)})};b.all=function(g){var h=w(g),k=h.next();return
2024-04-26 15:17:09 UTC	1255	IN	Data Raw: 6e 28 62 2c 63 29 7b 61 3a 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 64 3d 53 74 72 69 6e 67 28 64 29 29 3b 66 6f 72 28 76 61 72 20 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 30 3b 66 3c 65 3b 66 2b 2b 29 7b 76 61 72 20 67 3d 64 5b 66 5d 3b 69 66 28 62 2e 63 61 6c 6c 28 63 2c 67 2c 66 2c 64 29 29 7b 62 3d 67 3b 62 72 65 61 6b 20 61 7d 7d 62 3d 76 6f 69 64 20 30 7d 72 65 74 75 72 6e 20 62 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 46 61 28 61 2c 62 29 7b 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 61 2b 3d 22 22 29 3b 76 61 72 20 63 3d 30 2c 64 3d 21 31 2c 65 3d 7b 6e 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 64 26 26 63 3c 61 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 66 Data Ascii: n(b,c){a:{var d=this;d instanceof String&&(d=String(d));for(var e=d.length,f=0;f<e;f++){var g=d[f];if(b.call(c,g,f,d)){b=g;break a}}b=void 0}return b}});function Fa(a,b){a instanceof String&&(a+="");var c=0,d=!1,e={next:function(){if(!d&&c<a.length){var f
2024-04-26 15:17:09 UTC	1255	IN	Data Raw: 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d 63 7d 7d 29 3b 0a 71 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 63 6c 75 64 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 64 3d 53 74 72 69 6e 67 28 64 29 29 3b 76 61 72 20 65 3d 64 2e 6c 65 6e 67 74 68 3b 63 3d 63 7c 7c 30 3b 66 6f 72 28 30 3e 63 26 26 28 63 3d 4d 61 74 68 2e 6d 61 78 28 63 2b 65 2c 30 29 29 3b 63 3c 65 3b 63 2b 2b 29 7b 76 61 72 20 66 3d 64 5b 63 5d 3b 69 66 28 66 3d 3d 3d 62 7c 7c 4f 62 6a 65 63 74 2e 69 73 28 66 2c 62 29 29 72 65 74 75 72 6e 21 Data Ascii: b===c?0!==b\|\|1/b===1/c:b!==b&&c!==c}});q("Array.prototype.includes",function(a){return a?a:function(b,c){var d=this;d instanceof String&&(d=String(d));var e=d.length;c=c\|\|0;for(0>c&&(c=Math.max(c+e,0));c<e;c++){var f=d[c];if(f===b\|\|Object.is(f,b))return!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49731	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:10 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 15:17:10 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=56795 Date: Fri, 26 Apr 2024 15:17:10 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49732	172.67.41.60	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:11 UTC	654	OUT	GET /tag?o=5097926782615552&upapi=true HTTP/1.1 Host: btloader.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: W/"014d33760e5cfabf5989efdc7561c931" If-Modified-Since: Fri, 26 Apr 2024 15:00:40 GMT
2024-04-26 15:17:11 UTC	388	IN	HTTP/1.1 304 Not Modified Date: Fri, 26 Apr 2024 15:17:11 GMT Connection: close Cache-Control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300 Etag: "014d33760e5cfabf5989efdc7561c931" Last-Modified: Fri, 26 Apr 2024 15:00:40 GMT Vary: Origin Via: 1.1 google CF-Cache-Status: HIT Age: 858 Server: cloudflare CF-RAY: 87a789c9f9d98dba-MIA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49733	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:11 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 15:17:11 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=56788 Date: Fri, 26 Apr 2024 15:17:11 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 15:17:11 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49735	104.26.3.70	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:11 UTC	592	OUT	GET /px.gif?ch=2 HTTP/1.1 Host: ad-delivery.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:11 UTC	1228	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 15:17:11 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-GUploader-UploadID: ABPtcPquNxIzT0bddUbKvY_7tjmb_IhT9wBfoEIX03xEumF0xyfTzba34nRgngD9qkW1pdD0GA17p9HKjw x-goog-generation: 1620242732037093 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 43 x-goog-hash: crc32c=cpEfJQ== x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace Expires: Sat, 27 Apr 2024 15:17:11 GMT Cache-Control: public, max-age=86400 Age: 418 Last-Modified: Wed, 05 May 2021 19:25:32 GMT ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3" CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=89nKaPDIBsuwMfR5FZQgSwXnURyOWXPH1X2Mpv8jcLFFPT3dVLa%2FVp1qUzDU219EWHfp5J2%2FQqvKvw%2FLd8GXbIfCGbe1Epj3JRTBBZgGWJXCAy%2B90nOpf4uNFxSVlw2C1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a789cad8038dd9-MIA
2024-04-26 15:17:11 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49736	104.26.3.70	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:11 UTC	614	OUT	GET /px.gif?ch=1&e=0.27612668333241763 HTTP/1.1 Host: ad-delivery.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:11 UTC	1138	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 15:17:11 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-GUploader-UploadID: ABPtcPqb6gNhI4uzY9osvFhuKeHGxBROgC1s1bPDsKLpUSG0-_fotkeRvrH0SrMJszn70yVOnRM x-goog-generation: 1620242732037093 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 43 x-goog-hash: crc32c=cpEfJQ== x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Expires: Sat, 27 Apr 2024 15:17:11 GMT Cache-Control: public, max-age=86400 Last-Modified: Wed, 05 May 2021 19:25:32 GMT ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3" Age: 2053576 CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cFLwLp%2B6UiaUepGGauuYtaly2VZjEuCexQjanbh%2B73GSJ1bf5o8VrqU2uuOea8Ckyu3bLYIsmVg3qdc0mI0TwMVVXTZIQeRhAk3DRj2i6csnEG%2BTAMBKLG%2BIKvENuQ2fIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a789caefaedae9-MIA
2024-04-26 15:17:11 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49734	142.251.35.230	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:11 UTC	723	OUT	GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:11 UTC	746	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-doubleclick-media" Report-To: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} Content-Length: 1078 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 26 Apr 2024 01:35:31 GMT Expires: Sat, 27 Apr 2024 01:35:31 GMT Cache-Control: public, max-age=86400 Age: 49300 Last-Modified: Tue, 08 May 2012 13:08:06 GMT Content-Type: image/x-icon Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 15:17:11 UTC	509	IN	Data Raw: 00 00 01 00 02 00 10 10 10 00 00 00 00 00 28 01 00 00 26 00 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 4e 01 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii: (& N(
2024-04-26 15:17:11 UTC	569	IN	Data Raw: 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49737	130.211.23.194	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:11 UTC	578	OUT	GET /mw/state?bt_env=prod HTTP/1.1 Host: api.btloader.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: http://ww1.conversionlogic.net Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:11 UTC	203	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Vary: Origin Date: Fri, 26 Apr 2024 15:17:11 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49741	104.26.3.70	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:12 UTC	372	OUT	GET /px.gif?ch=1&e=0.27612668333241763 HTTP/1.1 Host: ad-delivery.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:12 UTC	1226	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 15:17:12 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-GUploader-UploadID: ABPtcPquNxIzT0bddUbKvY_7tjmb_IhT9wBfoEIX03xEumF0xyfTzba34nRgngD9qkW1pdD0GA17p9HKjw x-goog-generation: 1620242732037093 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 43 x-goog-hash: crc32c=cpEfJQ== x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace Expires: Sat, 27 Apr 2024 15:17:12 GMT Cache-Control: public, max-age=86400 Age: 116 Last-Modified: Wed, 05 May 2021 19:25:32 GMT ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3" CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XOG12oDJrpQSe8NjEY4D%2FCXSqnpx8Eds49T7wr91%2BxXiHr9eVvmaq8OVvtFkZClfzf2Ii6tdwioKR8tpCO9IkbLYu9xZKUM1R1qqxzUrnf%2Be6qbOUVdAGI4XpSeHv7yvZA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a789d03bf374b2-MIA
2024-04-26 15:17:12 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49740	104.26.3.70	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:12 UTC	350	OUT	GET /px.gif?ch=2 HTTP/1.1 Host: ad-delivery.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:12 UTC	1226	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 15:17:12 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-GUploader-UploadID: ABPtcPquNxIzT0bddUbKvY_7tjmb_IhT9wBfoEIX03xEumF0xyfTzba34nRgngD9qkW1pdD0GA17p9HKjw x-goog-generation: 1620242732037093 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 43 x-goog-hash: crc32c=cpEfJQ== x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace Expires: Sat, 27 Apr 2024 15:17:12 GMT Cache-Control: public, max-age=86400 Age: 113 Last-Modified: Wed, 05 May 2021 19:25:32 GMT ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3" CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HKcjeY6g2%2B6H7maH1uYrQ8qOeN8G05g1bS6xZTPAN62kMI6hoMjdHlHArNF6cyNB86Qm2zY2HdXoP23N%2Fc7qS%2BbK8FQHnUFsZOrP3NfGOkobo5KK6xHVFGWBxvJQwC0d6w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a789d04e109071-MIA
2024-04-26 15:17:12 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49742	142.251.35.230	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:12 UTC	481	OUT	GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:13 UTC	746	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-doubleclick-media" Report-To: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} Content-Length: 1078 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 26 Apr 2024 01:35:31 GMT Expires: Sat, 27 Apr 2024 01:35:31 GMT Cache-Control: public, max-age=86400 Age: 49301 Last-Modified: Tue, 08 May 2012 13:08:06 GMT Content-Type: image/x-icon Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 15:17:13 UTC	509	IN	Data Raw: 00 00 01 00 02 00 10 10 10 00 00 00 00 00 28 01 00 00 26 00 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 4e 01 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii: (& N(
2024-04-26 15:17:13 UTC	569	IN	Data Raw: 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49743	52.159.126.152	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 52 75 77 71 57 7a 69 57 4f 30 4b 57 6f 51 79 63 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 61 33 37 64 62 37 33 61 32 61 63 65 32 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: RuwqWziWO0KWoQyc.1Context: f3a37db73a2ace25
2024-04-26 15:17:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-26 15:17:12 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 52 75 77 71 57 7a 69 57 4f 30 4b 57 6f 51 79 63 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 61 33 37 64 62 37 33 61 32 61 63 65 32 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 32 69 76 61 4e 53 52 2b 39 41 44 35 65 6b 72 56 4c 56 41 73 44 74 4a 6a 54 61 30 61 46 49 4b 5a 2b 62 79 58 50 79 53 31 6b 75 6c 6b 6e 56 4a 31 45 4c 33 31 4c 64 6d 58 4f 44 77 46 47 2f 79 36 2f 74 6b 6b 30 33 42 41 68 48 71 73 36 4b 36 57 6e 45 77 6a 66 33 71 66 37 48 4f 31 2b 77 62 7a 61 45 41 55 78 71 4b 4b 57 64 76 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: RuwqWziWO0KWoQyc.2Context: f3a37db73a2ace25<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS2ivaNSR+9AD5ekrVLVAsDtJjTa0aFIKZ+byXPyS1kulknVJ1EL31LdmXODwFG/y6/tkk03BAhHqs6K6WnEwjf3qf7HO1+wbzaEAUxqKKWdvK
2024-04-26 15:17:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 52 75 77 71 57 7a 69 57 4f 30 4b 57 6f 51 79 63 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 61 33 37 64 62 37 33 61 32 61 63 65 32 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: RuwqWziWO0KWoQyc.3Context: f3a37db73a2ace25<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-26 15:17:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-26 15:17:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 73 4e 33 62 63 43 7a 49 30 53 43 45 6b 49 37 6b 34 4e 61 77 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: IsN3bcCzI0SCEkI7k4NawQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49739	52.13.101.202	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:13 UTC	603	OUT	OPTIONS /v1/domains/domain?domain=ww1.conversionlogic.net&portfolioId=&abp=1&gdabp=true HTTP/1.1 Host: api.aws.parking.godaddy.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-request-id Origin: http://ww1.conversionlogic.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:13 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 15:17:13 GMT Content-Length: 0 Connection: close Set-Cookie: AWSALB=Ve5EdNxqJrJtg/GHdlCldkPxQCTevsRtsCIClhIGHCCFqD1uaQBbxqJddINVlce/X/xr0tUdhu5OtV1MniUUG0jhT0RLms8Gx6fEyGHiZZdofkqEjCurm82rkX2N; Expires=Fri, 03 May 2024 15:17:13 GMT; Path=/ Set-Cookie: AWSALBCORS=Ve5EdNxqJrJtg/GHdlCldkPxQCTevsRtsCIClhIGHCCFqD1uaQBbxqJddINVlce/X/xr0tUdhu5OtV1MniUUG0jhT0RLms8Gx6fEyGHiZZdofkqEjCurm82rkX2N; Expires=Fri, 03 May 2024 15:17:13 GMT; Path=/; SameSite=None; Secure access-control-allow-credentials: true access-control-allow-headers: X-Request-Id access-control-allow-methods: GET, HEAD, OPTIONS access-control-allow-origin: http://ww1.conversionlogic.net access-control-max-age: 600 x-request-id: lCF0Lqa6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49746	52.13.101.202	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:15 UTC	699	OUT	GET /v1/domains/domain?domain=ww1.conversionlogic.net&portfolioId=&abp=1&gdabp=true HTTP/1.1 Host: api.aws.parking.godaddy.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Request-Id: a2143552-81d9-4113-9194-6d4d143d8bd3 sec-ch-ua-platform: "Windows" Accept: / Origin: http://ww1.conversionlogic.net Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:15 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 15:17:15 GMT Content-Type: application/json Content-Length: 785 Connection: close Set-Cookie: AWSALB=X1r6myY4JvBCT1VF8zTpmJ4eYm4kEQqkG8+eYzTbBGEYCH8LGZ9FXq9tWTrAyQIDIQIO04AIqZefG8JUyTTh0h+dmZY0TYQH8OmG2SeY96LW5eiADIEGKMhS3uC3; Expires=Fri, 03 May 2024 15:17:15 GMT; Path=/ Set-Cookie: AWSALBCORS=X1r6myY4JvBCT1VF8zTpmJ4eYm4kEQqkG8+eYzTbBGEYCH8LGZ9FXq9tWTrAyQIDIQIO04AIqZefG8JUyTTh0h+dmZY0TYQH8OmG2SeY96LW5eiADIEGKMhS3uC3; Expires=Fri, 03 May 2024 15:17:15 GMT; Path=/; SameSite=None; Secure access-control-allow-credentials: true access-control-allow-origin: http://ww1.conversionlogic.net access-control-max-age: 600 cache-control: Private,max-age=86400 x-request-id: a2143552-81d9-4113-9194-6d4d143d8bd3
2024-04-26 15:17:15 UTC	785	IN	Data Raw: 7b 22 73 79 73 74 65 6d 22 3a 22 53 4e 22 2c 22 61 63 63 6f 75 6e 74 22 3a 22 31 31 64 31 64 65 66 35 33 34 65 61 31 62 65 30 58 58 31 30 37 66 35 30 66 37 58 31 35 65 62 38 33 63 37 37 35 30 58 31 34 61 20 20 22 2c 22 63 75 73 74 6f 6d 65 72 49 64 22 3a 22 63 30 66 65 35 65 66 61 2d 66 63 32 35 2d 34 33 35 39 2d 62 31 31 66 2d 37 62 34 37 34 65 32 39 32 37 38 32 22 2c 22 64 69 73 70 6c 61 79 54 79 70 65 22 3a 22 41 44 53 22 2c 22 64 61 74 61 53 6f 75 72 63 65 22 3a 22 49 4e 56 45 4e 54 4f 52 59 22 2c 22 61 64 53 65 6e 73 65 22 3a 7b 22 64 72 69 64 22 3a 22 61 73 2d 64 72 69 64 2d 32 39 32 37 38 36 30 37 37 30 30 30 38 37 33 33 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 30 38 32 37 32 22 2c 22 70 75 62 49 64 22 3a 22 64 70 2d 6e 61 6d 65 6d 65 64 69 61 30 38 Data Ascii: {"system":"SN","account":"11d1def534ea1be0XX107f50f7X15eb83c7750X14a ","customerId":"c0fe5efa-fc25-4359-b11f-7b474e292782","displayType":"ADS","dataSource":"INVENTORY","adSense":{"drid":"as-drid-2927860770008733","channel":"08272","pubId":"dp-namemedia08

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49750	142.250.217.174	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:16 UTC	1345	OUT	GET /afs/ads?adsafe=low&adtest=off&psid=7621175430&pcsa=false&channel=08272&domain_name=conversionlogic.net&client=dp-namemedia08_3ph&r=m&rpbu=http%3A%2F%2Fww1.conversionlogic.net%2Flander&type=3&uiopt=true&swp=as-drid-2927860770008733&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442&client_gdprApplies=0&format=r3&nocache=4081714144635264&num=0&output=afd_ads&v=3&bsl=8&pac=2&u_his=1&u_tz=120&dt=1714144635266&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=907&frm=0&uio=-&cont=relatedLinks&drt=0&jsid=caf&nfp=1&jsv=627058929&rurl=http%3A%2F%2Fww1.conversionlogic.net%2Flander&referer=http%3A%2F%2Fww1.conversionlogic.net%2F HTTP/1.1 Host: www.adsensecustomsearchads.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:17 UTC	1803	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7621175430%26pcsa%3Dfalse%26channel%3D08272%26domain_name%3Dconversionlogic.net%26client%3Ddp-namemedia08_3ph%26r%3Dm%26rpbu%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2927860770008733%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%26client_gdprApplies%3D0%26format%3Dr3%26nocache%3D4081714144635264%26num%3D0%26output%3Dafd_ads%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1714144635266%26u_w%3D1280%26u_h%3D1024%26biw%3D1280%26bih%3D907%26psw%3D1280%26psh%3D907%26frm%3D0%26uio%3D-%26cont%3DrelatedLinks%26drt%3D0%26jsid%3Dcaf%26nfp%3D1%26jsv%3D627058929%26rurl%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26referer%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252F&q=EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI_IqvsQYQwrrzuQMSBGaBmNw Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-yPPr9Eo7qKYVSdQWGGph8A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Date: Fri, 26 Apr 2024 15:17:16 GMT Server: gws Content-Length: 1256 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 15:17:17 UTC	1256	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 64 73 65 6e 73 65 63 75 73 74 6f 6d 73 65 61 72 63 68 61 64 73 2e 63 6f 6d 2f 61 66 73 2f Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49755	52.13.101.202	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:16 UTC	429	OUT	GET /v1/domains/domain?domain=ww1.conversionlogic.net&portfolioId=&abp=1&gdabp=true HTTP/1.1 Host: api.aws.parking.godaddy.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:16 UTC	601	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 15:17:16 GMT Content-Type: application/json Content-Length: 785 Connection: close Set-Cookie: AWSALB=B9x6SEgD2FiiP9AghMFyjLs/IeqreFfabjijy9Upw/IhG1htEikKlOpKUt/+331XBQXav1Gwvdy4h2BVxNqVV1nJQf0I6zJN+RhACxPluLTD0GKecUIAjXKYn6a9; Expires=Fri, 03 May 2024 15:17:16 GMT; Path=/ Set-Cookie: AWSALBCORS=B9x6SEgD2FiiP9AghMFyjLs/IeqreFfabjijy9Upw/IhG1htEikKlOpKUt/+331XBQXav1Gwvdy4h2BVxNqVV1nJQf0I6zJN+RhACxPluLTD0GKecUIAjXKYn6a9; Expires=Fri, 03 May 2024 15:17:16 GMT; Path=/; SameSite=None; Secure cache-control: Private,max-age=86400 x-request-id: mShgN22e
2024-04-26 15:17:16 UTC	785	IN	Data Raw: 7b 22 73 79 73 74 65 6d 22 3a 22 53 4e 22 2c 22 61 63 63 6f 75 6e 74 22 3a 22 31 31 64 31 64 65 66 35 33 34 65 61 31 62 65 30 58 58 31 30 37 66 35 30 66 37 58 31 35 65 62 38 33 63 37 37 35 30 58 31 34 61 20 20 22 2c 22 63 75 73 74 6f 6d 65 72 49 64 22 3a 22 63 30 66 65 35 65 66 61 2d 66 63 32 35 2d 34 33 35 39 2d 62 31 31 66 2d 37 62 34 37 34 65 32 39 32 37 38 32 22 2c 22 64 69 73 70 6c 61 79 54 79 70 65 22 3a 22 41 44 53 22 2c 22 64 61 74 61 53 6f 75 72 63 65 22 3a 22 49 4e 56 45 4e 54 4f 52 59 22 2c 22 61 64 53 65 6e 73 65 22 3a 7b 22 64 72 69 64 22 3a 22 61 73 2d 64 72 69 64 2d 32 39 32 37 38 36 30 37 37 30 30 30 38 37 33 33 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 30 38 32 37 32 22 2c 22 70 75 62 49 64 22 3a 22 64 70 2d 6e 61 6d 65 6d 65 64 69 61 30 38 Data Ascii: {"system":"SN","account":"11d1def534ea1be0XX107f50f7X15eb83c7750X14a ","customerId":"c0fe5efa-fc25-4359-b11f-7b474e292782","displayType":"ADS","dataSource":"INVENTORY","adSense":{"drid":"as-drid-2927860770008733","channel":"08272","pubId":"dp-namemedia08

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49758	142.250.217.228	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:17 UTC	1715	OUT	GET /sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7621175430%26pcsa%3Dfalse%26channel%3D08272%26domain_name%3Dconversionlogic.net%26client%3Ddp-namemedia08_3ph%26r%3Dm%26rpbu%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2927860770008733%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%26client_gdprApplies%3D0%26format%3Dr3%26nocache%3D4081714144635264%26num%3D0%26output%3Dafd_ads%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1714144635266%26u_w%3D1280%26u_h%3D1024%26biw%3D1280%26bih%3D907%26psw%3D1280%26psh%3D907%26frm%3D0%26uio%3D-%26cont%3DrelatedLinks%26drt%3D0%26jsid%3Dcaf%26nfp%3D1%26jsv%3D627058929%26rurl%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26referer%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252F&q=EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: http://ww1.conversionlogic.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:18 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 15:17:18 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 5523 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 15:17:18 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 64 73 65 6e 73 65 63 75 73 74 6f 6d 73 65 61 72 63 68 61 64 73 2e 63 6f 6d 2f 61 66 73 2f 61 64 73 3f 61 64 73 61 66 65 3d 6c 6f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.adsensecustomsearchads.com/afs/ads?adsafe=lo
2024-04-26 15:17:18 UTC	1255	IN	Data Raw: 70 3b 6a 73 69 64 3d 63 61 66 26 61 6d 70 3b 6e 66 70 3d 31 26 61 6d 70 3b 6a 73 76 3d 36 32 37 30 35 38 39 32 39 26 61 6d 70 3b 72 75 72 6c 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 31 2e 63 6f 6e 76 65 72 73 69 6f 6e 6c 6f 67 69 63 2e 6e 65 74 25 32 46 6c 61 6e 64 65 72 26 61 6d 70 3b 72 65 66 65 72 65 72 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 31 2e 63 6f 6e 76 65 72 73 69 6f 6e 6c 6f 67 69 63 2e 6e 65 74 25 32 46 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 70 61 64 64 69 6e 67 3a 32 30 70 78 Data Ascii: p;jsid=caf&nfp=1&jsv=627058929&rurl=http%3A%2F%2Fww1.conversionlogic.net%2Flander&referer=http%3A%2F%2Fww1.conversionlogic.net%2F</title></head><body style="font-family: arial, sans-serif; background-color: #fff; color: #000; padding:20px
2024-04-26 15:17:18 UTC	1255	IN	Data Raw: 64 56 79 45 4b 5f 4e 43 77 50 41 33 33 6a 56 39 69 76 6e 52 5f 4c 39 6f 46 62 6d 67 48 39 77 44 64 6b 4f 76 77 6f 42 56 30 4e 75 53 55 5a 73 43 4d 4c 4b 61 77 7a 55 6e 77 22 3e 3c 2f 64 69 76 3e 0a 0a 3c 69 6e 70 75 74 20 74 79 70 65 3d 27 68 69 64 64 65 6e 27 20 6e 61 6d 65 3d 27 71 27 20 76 61 6c 75 65 3d 27 45 67 52 6d 67 5a 6a 63 47 50 79 4b 72 37 45 47 49 6a 43 53 4b 5f 76 55 63 71 2d 50 31 4e 4d 72 6f 6d 52 42 49 57 33 31 5f 62 76 73 75 4c 62 54 70 4f 73 73 77 6d 4e 68 52 5a 4b 74 4a 6a 6c 4b 2d 6b 74 78 31 50 55 7a 5f 69 34 72 6d 50 58 68 6d 33 77 79 41 58 4a 4b 47 56 4e 50 55 6c 4a 5a 58 30 46 43 56 56 4e 4a 56 6b 56 66 54 6b 56 55 58 30 31 46 55 31 4e 42 52 30 56 61 41 55 4d 27 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e Data Ascii: dVyEK_NCwPA33jV9ivnR_L9oFbmgH9wDdkOvwoBV0NuSUZsCMLKawzUnw"></div><input type='hidden' name='q' value='EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM'><input type="hidden" n
2024-04-26 15:17:18 UTC	1255	IN	Data Raw: 3c 62 72 3e 0a 54 68 69 73 20 6e 65 74 77 6f 72 6b 20 69 73 20 62 6c 6f 63 6b 65 64 20 64 75 65 20 74 6f 20 75 6e 61 64 64 72 65 73 73 65 64 20 61 62 75 73 65 20 63 6f 6d 70 6c 61 69 6e 74 73 20 61 62 6f 75 74 20 6d 61 6c 69 63 69 6f 75 73 20 62 65 68 61 76 69 6f 72 2e 20 54 68 69 73 20 70 61 67 65 20 63 68 65 63 6b 73 20 74 6f 20 73 65 65 20 69 66 20 69 74 27 73 20 72 65 61 6c 6c 79 20 61 20 68 75 6d 61 6e 20 73 65 6e 64 69 6e 67 20 74 68 65 20 72 65 71 75 65 73 74 73 20 61 6e 64 20 6e 6f 74 20 61 20 72 6f 62 6f 74 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 74 68 69 73 20 6e 65 74 77 6f 72 6b 2e 20 3c 62 72 3e 3c 62 72 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 66 6f 44 69 76 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 20 62 61 63 6b 67 72 Data Ascii: <br>This network is blocked due to unaddressed abuse complaints about malicious behavior. This page checks to see if it's really a human sending the requests and not a robot coming from this network. <br><br><div id="infoDiv" style="display:none; backgr
2024-04-26 15:17:18 UTC	859	IN	Data Raw: 73 74 6f 6d 73 65 61 72 63 68 61 64 73 2e 63 6f 6d 2f 61 66 73 2f 61 64 73 3f 61 64 73 61 66 65 3d 6c 6f 77 26 61 6d 70 3b 61 64 74 65 73 74 3d 6f 66 66 26 61 6d 70 3b 70 73 69 64 3d 37 36 32 31 31 37 35 34 33 30 26 61 6d 70 3b 70 63 73 61 3d 66 61 6c 73 65 26 61 6d 70 3b 63 68 61 6e 6e 65 6c 3d 30 38 32 37 32 26 61 6d 70 3b 64 6f 6d 61 69 6e 5f 6e 61 6d 65 3d 63 6f 6e 76 65 72 73 69 6f 6e 6c 6f 67 69 63 2e 6e 65 74 26 61 6d 70 3b 63 6c 69 65 6e 74 3d 64 70 2d 6e 61 6d 65 6d 65 64 69 61 30 38 5f 33 70 68 26 61 6d 70 3b 72 3d 6d 26 61 6d 70 3b 72 70 62 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 31 2e 63 6f 6e 76 65 72 73 69 6f 6e 6c 6f 67 69 63 2e 6e 65 74 25 32 46 6c 61 6e 64 65 72 26 61 6d 70 3b 74 79 70 65 3d 33 26 61 6d 70 3b 75 69 6f 70 74 3d Data Ascii: stomsearchads.com/afs/ads?adsafe=low&adtest=off&psid=7621175430&pcsa=false&channel=08272&domain_name=conversionlogic.net&client=dp-namemedia08_3ph&r=m&rpbu=http%3A%2F%2Fww1.conversionlogic.net%2Flander&type=3&uiopt=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49759	142.250.217.228	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:22 UTC	1638	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7621175430%26pcsa%3Dfalse%26channel%3D08272%26domain_name%3Dconversionlogic.net%26client%3Ddp-namemedia08_3ph%26r%3Dm%26rpbu%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2927860770008733%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%26client_gdprApplies%3D0%26format%3Dr3%26nocache%3D4081714144635264%26num%3D0%26output%3Dafd_ads%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1714144635266%26u_w%3D1280%26u_h%3D1024%26biw%3D1280%26bih%3D907%26psw%3D1280%26psh%3D907%26frm%3D0%26uio%3D-%26cont%3DrelatedLinks%26drt%3D0%26jsid%3Dcaf%26nfp%3D1%26jsv%3D627058929%26rurl%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26referer%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252F&q=EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:22 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Fri, 26 Apr 2024 15:17:22 GMT Date: Fri, 26 Apr 2024 15:17:22 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 15:17:22 UTC	727	IN	Data Raw: 34 63 36 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 4c6/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-04-26 15:17:22 UTC	502	IN	Data Raw: 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 3b 70 6f 2e 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 30 6c 4a 6b 4f 56 48 44 79 33 49 74 59 6c 43 62 55 Data Ascii: cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-0lJkOVHDy3ItYlCbU
2024-04-26 15:17:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49761	52.159.126.152	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:26 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 51 6e 70 6d 47 58 53 73 52 55 6d 57 4b 6d 32 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 66 63 62 34 30 31 32 34 66 66 39 39 36 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: QnpmGXSsRUmWKm2A.1Context: 37fcb40124ff9960
2024-04-26 15:17:26 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-26 15:17:26 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 51 6e 70 6d 47 58 53 73 52 55 6d 57 4b 6d 32 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 66 63 62 34 30 31 32 34 66 66 39 39 36 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 32 69 76 61 4e 53 52 2b 39 41 44 35 65 6b 72 56 4c 56 41 73 44 74 4a 6a 54 61 30 61 46 49 4b 5a 2b 62 79 58 50 79 53 31 6b 75 6c 6b 6e 56 4a 31 45 4c 33 31 4c 64 6d 58 4f 44 77 46 47 2f 79 36 2f 74 6b 6b 30 33 42 41 68 48 71 73 36 4b 36 57 6e 45 77 6a 66 33 71 66 37 48 4f 31 2b 77 62 7a 61 45 41 55 78 71 4b 4b 57 64 76 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: QnpmGXSsRUmWKm2A.2Context: 37fcb40124ff9960<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS2ivaNSR+9AD5ekrVLVAsDtJjTa0aFIKZ+byXPyS1kulknVJ1EL31LdmXODwFG/y6/tkk03BAhHqs6K6WnEwjf3qf7HO1+wbzaEAUxqKKWdvK
2024-04-26 15:17:26 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 51 6e 70 6d 47 58 53 73 52 55 6d 57 4b 6d 32 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 66 63 62 34 30 31 32 34 66 66 39 39 36 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: QnpmGXSsRUmWKm2A.3Context: 37fcb40124ff9960<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-26 15:17:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-26 15:17:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 2f 6a 6c 73 4c 4a 55 44 55 75 34 41 2f 65 75 61 37 64 74 61 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: k/jlsLJUDUu4A/eua7dtag.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49762	142.250.217.228	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:26 UTC	2245	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=ou76cc1SFuQyT9YeBPJC8JqqhMnzIft4uTanx-4-9sbqWE4NrVoMd-dFwdVYPVy9o3yHUAf1R87w9OYaEq5iMxhuMJfKl7Y4rbqoIwa393lC9jfkZ1_8zl4VBhX3MAVG92zSN7Fu_2Phxhmh1k-qITmQC5muNW6T1bmxaTlkcze6rrmHMzWEOtVvguGRbiWT8fq4lQmtHBi_uoOzTJc24CG4ZcAKxjOnbOG15IdVyEK_NCwPA33jV9ivnR_L9oFbmgH9wDdkOvwoBV0NuSUZsCMLKawzUnw&cb=hoty0np8z5p9 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7621175430%26pcsa%3Dfalse%26channel%3D08272%26domain_name%3Dconversionlogic.net%26client%3Ddp-namemedia08_3ph%26r%3Dm%26rpbu%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2927860770008733%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%26client_gdprApplies%3D0%26format%3Dr3%26nocache%3D4081714144635264%26num%3D0%26output%3Dafd_ads%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1714144635266%26u_w%3D1280%26u_h%3D1024%26biw%3D1280%26bih%3D907%26psw%3D1280%26psh%3D907%26frm%3D0%26uio%3D-%26cont%3DrelatedLinks%26drt%3D0%26jsid%3Dcaf%26nfp%3D1%26jsv%3D627058929%26rurl%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26referer%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252F&q=EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:27 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Apr 2024 15:17:27 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-DBdE1O2LrqJimJtDeoPjcw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 15:17:27 UTC	364	IN	Data Raw: 32 61 64 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2ad7<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-04-26 15:17:27 UTC	1255	IN	Data Raw: 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 Data Ascii: 18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//font
2024-04-26 15:17:27 UTC	1255	IN	Data Raw: 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 Data Ascii: 0AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00
2024-04-26 15:17:27 UTC	1255	IN	Data Raw: 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 Data Ascii: +04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-26 15:17:27 UTC	1255	IN	Data Raw: 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 Data Ascii: e { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0
2024-04-26 15:17:27 UTC	1255	IN	Data Raw: 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a Data Ascii: ic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2024-04-26 15:17:27 UTC	1255	IN	Data Raw: 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 44 42 64 45 31 4f 32 4c 72 71 4a 69 6d 4a 74 44 65 6f 50 6a 63 77 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d Data Ascii: </style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css"><script nonce="DBdE1O2LrqJimJtDeoPjcw" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com
2024-04-26 15:17:27 UTC	1255	IN	Data Raw: 4c 55 53 6e 6b 44 4c 50 64 6d 4f 50 69 66 6f 50 59 72 7a 58 72 4a 76 4f 73 2d 4f 69 6a 74 32 54 6b 5f 6d 41 36 47 62 77 34 31 50 4c 56 72 61 70 52 32 5a 2d 51 72 6e 62 67 79 5f 75 77 34 62 74 6b 32 35 6f 57 50 75 58 62 57 59 5f 42 61 42 65 6b 4f 42 76 4c 32 37 76 4c 64 46 59 36 4f 5a 67 42 69 78 44 33 4f 68 72 67 53 38 49 36 62 51 42 6e 66 49 35 4e 62 36 4c 5f 59 59 4d 55 4a 30 64 6d 6e 38 5f 31 30 6d 47 77 4a 55 45 48 5f 57 51 65 34 62 6d 50 65 36 6a 64 61 48 66 4e 41 69 54 32 6d 4a 33 45 64 52 58 4e 59 6b 70 4c 4e 7a 48 66 68 49 71 6b 2d 69 61 62 6d 69 56 54 63 70 35 5a 6a 75 36 6f 64 4e 61 6a 43 54 36 68 54 32 70 64 4e 5a 77 59 76 6c 45 33 41 6e 61 37 67 57 2d 76 78 63 33 62 44 30 30 54 6c 51 38 6b 76 4e 65 78 48 65 33 35 52 4a 79 69 6d 49 75 30 71 6e Data Ascii: LUSnkDLPdmOPifoPYrzXrJvOs-Oijt2Tk_mA6Gbw41PLVrapR2Z-Qrnbgy_uw4btk25oWPuXbWY_BaBekOBvL27vLdFY6OZgBixD3OhrgS8I6bQBnfI5Nb6L_YYMUJ0dmn8_10mGwJUEH_WQe4bmPe6jdaHfNAiT2mJ3EdRXNYkpLNzHfhIqk-iabmiVTcp5Zju6odNajCT6hT2pdNZwYvlE3Ana7gW-vxc3bD00TlQ8kvNexHe35RJyimIu0qn
2024-04-26 15:17:27 UTC	1255	IN	Data Raw: 4e 73 66 75 64 35 42 6a 65 4c 71 43 4c 5f 43 5f 43 67 52 79 6c 79 6f 30 46 63 30 61 45 78 62 51 4b 33 74 50 75 4a 33 4c 4c 4d 44 6c 72 54 78 72 4c 6b 71 48 4e 31 79 62 4a 42 39 66 64 31 36 68 41 79 55 58 79 31 65 5a 6c 32 78 62 6e 36 54 68 75 2d 6e 6a 42 56 46 38 72 4d 61 56 31 46 5f 79 4c 37 61 4b 49 6a 39 32 2d 62 50 48 47 6f 4c 32 69 67 77 4f 70 6f 54 54 50 68 50 71 74 4e 79 5f 6d 50 36 78 46 51 6c 37 5a 4a 6f 63 44 71 70 49 58 68 34 73 32 66 73 67 69 42 56 67 38 32 2d 69 5f 69 71 39 59 65 4d 49 77 39 4f 53 73 6c 73 41 30 38 4b 6f 61 41 34 77 69 46 56 78 78 53 79 43 6d 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 44 42 64 45 31 4f 32 4c 72 71 4a 69 6d 4a 74 44 65 6f 50 6a 63 Data Ascii: Nsfud5BjeLqCL_C_CgRylyo0Fc0aExbQK3tPuJ3LLMDlrTxrLkqHN1ybJB9fd16hAyUXy1eZl2xbn6Thu-njBVF8rMaV1F_yL7aKIj92-bPHGoL2igwOpoTTPhPqtNy_mP6xFQl7ZJocDqpIXh4s2fsgiBVg82-i_iq9YeMIw9OSslsA08KoaA4wiFVxxSyCm"><script type="text/javascript" nonce="DBdE1O2LrqJimJtDeoPjc
2024-04-26 15:17:27 UTC	571	IN	Data Raw: 55 6a 42 4a 62 56 4d 76 56 6e 46 68 5a 6a 46 6c 52 33 4a 31 53 44 4a 58 63 30 68 74 63 30 56 70 57 6d 74 36 56 47 4e 43 57 54 4e 52 55 44 52 72 63 45 35 72 5a 6b 4a 4e 63 54 4d 32 55 44 46 59 53 6b 51 32 52 6e 4a 43 54 46 68 4a 4e 31 56 4d 59 6b 67 7a 4d 7a 46 76 53 57 35 71 54 30 52 76 64 6d 70 76 51 6d 64 45 64 56 4a 72 62 32 63 76 4d 47 31 43 55 56 42 58 52 6c 4e 68 57 6b 52 57 51 6d 56 78 4e 32 78 4b 4d 58 64 69 4f 57 6f 34 52 31 45 30 4d 33 70 4e 61 6d 56 7a 62 45 78 6f 63 32 64 45 4e 32 46 76 64 54 6b 77 4e 44 56 4c 53 44 64 32 61 45 4a 79 4e 6e 68 55 4e 33 46 70 59 7a 42 6b 51 57 74 6a 56 57 38 32 4d 47 35 76 62 31 6f 79 4d 45 4a 68 57 47 56 4f 5a 45 5a 44 65 47 51 34 4d 58 56 4d 55 57 64 6e 5a 45 51 72 57 48 4a 54 65 48 64 79 4d 30 64 5a 54 6c 63 Data Ascii: UjBJbVMvVnFhZjFlR3J1SDJXc0htc0VpWmt6VGNCWTNRUDRrcE5rZkJNcTM2UDFYSkQ2RnJCTFhJN1VMYkgzMzFvSW5qT0RvdmpvQmdEdVJrb2cvMG1CUVBXRlNhWkRWQmVxN2xKMXdiOWo4R1E0M3pNamVzbExoc2dEN2FvdTkwNDVLSDd2aEJyNnhUN3FpYzBkQWtjVW82MG5vb1oyMEJhWGVOZEZDeGQ4MXVMUWdnZEQrWHJTeHdyM0dZTlc

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49763	40.126.29.7	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:27 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4788 Host: login.live.com
2024-04-26 15:17:27 UTC	4788	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-26 15:17:27 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Apr 2024 15:16:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: ca2f73c7-7796-4008-888a-089daf97481b PPServer: PPV: 30 H: SN1PEPF0002FA75 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Apr 2024 15:17:27 GMT Connection: close Content-Length: 11177
2024-04-26 15:17:27 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49769	142.250.217.228	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:28 UTC	1114	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=ou76cc1SFuQyT9YeBPJC8JqqhMnzIft4uTanx-4-9sbqWE4NrVoMd-dFwdVYPVy9o3yHUAf1R87w9OYaEq5iMxhuMJfKl7Y4rbqoIwa393lC9jfkZ1_8zl4VBhX3MAVG92zSN7Fu_2Phxhmh1k-qITmQC5muNW6T1bmxaTlkcze6rrmHMzWEOtVvguGRbiWT8fq4lQmtHBi_uoOzTJc24CG4ZcAKxjOnbOG15IdVyEK_NCwPA33jV9ivnR_L9oFbmgH9wDdkOvwoBV0NuSUZsCMLKawzUnw&cb=hoty0np8z5p9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:29 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Fri, 26 Apr 2024 15:17:29 GMT Date: Fri, 26 Apr 2024 15:17:29 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 15:17:29 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js');
2024-04-26 15:17:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49770	142.250.217.228	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:28 UTC	1102	OUT	GET /js/bg/lkTXq49YG5_ej1w7m4T9Nw_1Lx1Ocd1gteWQpsfV_Tk.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=ou76cc1SFuQyT9YeBPJC8JqqhMnzIft4uTanx-4-9sbqWE4NrVoMd-dFwdVYPVy9o3yHUAf1R87w9OYaEq5iMxhuMJfKl7Y4rbqoIwa393lC9jfkZ1_8zl4VBhX3MAVG92zSN7Fu_2Phxhmh1k-qITmQC5muNW6T1bmxaTlkcze6rrmHMzWEOtVvguGRbiWT8fq4lQmtHBi_uoOzTJc24CG4ZcAKxjOnbOG15IdVyEK_NCwPA33jV9ivnR_L9oFbmgH9wDdkOvwoBV0NuSUZsCMLKawzUnw&cb=hoty0np8z5p9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:29 UTC	811	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18268 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 25 Apr 2024 17:40:07 GMT Expires: Fri, 25 Apr 2025 17:40:07 GMT Cache-Control: public, max-age=31536000 Age: 77842 Last-Modified: Tue, 16 Apr 2024 13:30:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 15:17:29 UTC	444	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 66 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 69 66 28 21 28 4e 3d 28 52 3d 65 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 6e 75 6c 6c 29 2c 52 29 7c 7c 21 52 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 4e 3b 74 72 79 7b 4e 3d 52 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 70 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 70 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 70 7d Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var f=function(R,N){if(!(N=(R=e.trustedTypes,null),R)\|\|!R.createPolicy)return N;try{N=R.createPolicy("bg",{createHTML:p,createScript:p,createScriptURL:p}
2024-04-26 15:17:29 UTC	1255	IN	Data Raw: 65 61 74 65 53 63 72 69 70 74 28 50 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 50 29 7b 72 65 74 75 72 6e 22 22 2b 50 7d 7d 28 65 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 5b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 27 2c 0a 27 27 2c 0a 27 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 52 65 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 72 65 74 75 72 6e 20 52 5b 4e 5d 3c 3c 32 34 7c 52 5b 28 4e 7c 30 29 2b 31 5d 3c 3c 31 36 7c 52 5b 28 4e 7c 30 29 2b 32 5d 3c 3c 38 7c 52 5b 28 4e 7c 30 29 2b 33 5d 7d 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 29 7b 69 66 28 34 33 38 3d Data Ascii: eateScript(P)}:function(P){return""+P}}(e)(Array(7824Math.random()\|0).join("\n")+['(function(){/','',' SPDX-License-Identifier: Apache-2.0','*/','var Re=function(R,N){return R[N]<<24\|R[(N\|0)+1]<<16\|R[(N\|0)+2]<<8\|R[(N\|0)+3]},d=function(R,N,p){if(438=
2024-04-26 15:17:29 UTC	1255	IN	Data Raw: 67 5b 77 5d 2c 52 29 3b 72 65 74 75 72 6e 20 4e 7d 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 66 6f 72 28 4e 3d 5b 5d 3b 52 2d 2d 3b 29 4e 2e 70 75 73 68 28 32 35 35 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 3b 72 65 74 75 72 6e 20 4e 7d 2c 5a 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 28 4e 3d 4e 2e 58 5b 52 5d 2c 4e 29 29 74 68 72 6f 77 5b 4d 2c 33 30 2c 52 5d 3b 69 66 28 4e 2e 76 61 6c 75 65 29 72 65 74 75 72 6e 20 4e 2e 63 72 65 61 74 65 28 29 3b 72 65 74 75 72 6e 28 4e 2e 63 72 65 61 74 65 28 33 2a 52 2a 52 2b 32 31 2a 52 2b 2d 33 34 29 2c 4e 29 2e 70 72 6f 74 6f 74 79 70 65 7d 2c 50 52 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 2c 65 2c 77 2c 54 2c 6b 2c 50 29 7b 72 65 74 75 72 6e 20 50 3d 28 Data Ascii: g[w],R);return N},c=function(R,N){for(N=[];R--;)N.push(255Math.random()\|0);return N},Z=function(R,N){if(void 0===(N=N.X[R],N))throw[M,30,R];if(N.value)return N.create();return(N.create(3RR+21R+-34),N).prototype},PR=function(R,N,p,e,w,T,k,P){return P=(
2024-04-26 15:17:29 UTC	1255	IN	Data Raw: 2e 67 69 3d 66 2c 32 5d 5d 2c 66 29 3c 3c 33 29 2d 34 3b 74 72 79 7b 54 2e 63 4f 3d 74 41 28 52 65 28 54 2c 28 66 7c 30 29 2b 34 29 2c 52 65 28 54 2c 66 29 2c 79 29 7d 63 61 74 63 68 28 61 29 7b 74 68 72 6f 77 20 61 3b 7d 7d 54 2e 70 75 73 68 28 54 2e 63 4f 5b 50 26 37 5d 5e 6b 29 7d 2c 77 3d 5a 28 35 39 2c 4e 29 29 3a 52 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 54 2e 70 75 73 68 28 6b 29 7d 2c 65 26 26 52 28 65 26 32 35 35 29 2c 4e 3d 70 2e 6c 65 6e 67 74 68 2c 65 3d 30 3b 65 3c 4e 3b 65 2b 2b 29 52 28 70 5b 65 5d 29 7d 2c 45 2c 56 30 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 28 70 3d 74 79 70 65 6f 66 20 52 2c 70 29 29 69 66 28 52 29 7b 69 66 28 52 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 72 65 Data Ascii: .gi=f,2]],f)<<3)-4;try{T.cO=tA(Re(T,(f\|0)+4),Re(T,f),y)}catch(a){throw a;}}T.push(T.cO[P&7]^k)},w=Z(59,N)):R=function(k){T.push(k)},e&&R(e&255),N=p.length,e=0;e<N;e++)R(p[e])},E,V0=function(R,N,p){if("object"==(p=typeof R,p))if(R){if(R instanceof Array)re
2024-04-26 15:17:29 UTC	1255	IN	Data Raw: 37 2c 28 4b 28 33 33 36 2c 52 2c 28 4b 28 34 38 35 2c 28 4b 28 28 64 28 35 35 2c 52 2c 28 4b 28 28 64 28 28 64 28 35 30 33 2c 52 2c 28 4b 28 31 32 37 2c 28 64 28 32 39 38 2c 52 2c 63 28 28 4b 28 34 31 38 2c 52 2c 28 4b 28 33 37 2c 52 2c 28 64 28 28 64 28 33 30 31 2c 52 2c 28 64 28 31 36 37 2c 28 4b 28 28 64 28 35 39 2c 52 2c 5b 30 2c 28 4b 28 31 37 31 2c 52 2c 28 4b 28 32 35 2c 28 4b 28 31 31 37 2c 28 4b 28 31 35 33 2c 52 2c 28 64 28 31 36 33 2c 52 2c 28 64 28 33 33 31 2c 28 64 28 34 33 38 2c 52 2c 28 52 2e 61 79 3d 28 4e 3d 28 28 52 2e 57 4f 3d 32 35 2c 52 29 2e 53 3d 28 52 2e 50 3d 5b 5d 2c 28 52 2e 54 3d 28 52 2e 6a 3d 66 61 6c 73 65 2c 52 29 2c 52 29 2e 4c 43 3d 30 2c 52 2e 5a 3d 28 28 28 28 52 2e 73 3d 30 2c 52 2e 59 3d 76 6f 69 64 20 30 2c 52 2e 42 Data Ascii: 7,(K(336,R,(K(485,(K((d(55,R,(K((d((d(503,R,(K(127,(d(298,R,c((K(418,R,(K(37,R,(d((d(301,R,(d(167,(K((d(59,R,[0,(K(171,R,(K(25,(K(117,(K(153,R,(d(163,R,(d(331,(d(438,R,(R.ay=(N=((R.WO=25,R).S=(R.P=[],(R.T=(R.j=false,R),R).LC=0,R.Z=((((R.s=0,R.Y=void 0,R.B
2024-04-26 15:17:29 UTC	1255	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 29 7b 64 28 28 66 3d 28 61 3d 56 28 28 79 3d 56 28 50 29 2c 50 29 29 2c 56 29 28 50 29 2c 66 29 2c 50 2c 5a 28 79 2c 50 29 7c 7c 5a 28 61 2c 50 29 29 7d 29 2c 39 34 31 29 29 2c 34 34 29 2c 52 2c 72 29 2c 31 37 29 2c 52 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 29 7b 21 58 28 66 2c 74 72 75 65 2c 66 61 6c 73 65 2c 50 29 26 26 28 66 3d 54 32 28 50 29 2c 61 3d 66 2e 73 52 2c 79 3d 66 2e 6e 43 2c 50 2e 54 3d 3d 50 7c 7c 61 3d 3d 50 2e 5a 55 26 26 79 3d 3d 50 29 26 26 28 64 28 66 2e 7a 73 2c 50 2c 61 2e 61 70 70 6c 79 28 79 2c 66 2e 67 29 29 2c 50 2e 41 3d 50 2e 4e 28 29 29 7d 29 2c 30 29 29 2c 35 30 38 29 2c 52 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 2c 74 2c 47 2c 53 2c 43 2c 62 2c 42 2c 59 Data Ascii: function(P,f,y,a){d((f=(a=V((y=V(P),P)),V)(P),f),P,Z(y,P)\|\|Z(a,P))}),941)),44),R,r),17),R,function(P,f,y,a){!X(f,true,false,P)&&(f=T2(P),a=f.sR,y=f.nC,P.T==P\|\|a==P.ZU&&y==P)&&(d(f.zs,P,a.apply(y,f.g)),P.A=P.N())}),0)),508),R,function(P,f,y,a,t,G,S,C,b,B,Y
2024-04-26 15:17:29 UTC	1255	IN	Data Raw: 29 2c 50 29 29 2c 56 29 28 50 29 2c 5a 28 66 2c 50 29 29 2c 74 29 2c 50 29 2c 5a 28 53 2c 50 29 29 2c 79 3d 5a 28 79 2c 50 29 2c 53 29 29 29 7b 66 6f 72 28 61 20 69 6e 20 47 3d 5b 5d 2c 53 29 47 2e 70 75 73 68 28 61 29 3b 53 3d 47 7d 69 66 28 50 2e 54 3d 3d 50 29 66 6f 72 28 66 3d 30 3c 66 3f 66 3a 31 2c 50 3d 53 2e 6c 65 6e 67 74 68 2c 61 3d 30 3b 61 3c 50 3b 61 2b 3d 66 29 74 28 53 2e 73 6c 69 63 65 28 61 2c 28 61 7c 30 29 2b 28 66 7c 30 29 29 2c 79 29 7d 7d 29 2c 52 29 2e 48 4f 3d 30 2c 52 29 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 29 7b 28 61 3d 56 28 28 79 3d 28 66 3d 56 28 50 29 2c 56 28 50 29 29 2c 50 29 29 2c 50 2e 54 3d 3d 50 29 26 26 28 79 3d 5a 28 79 2c 50 29 2c 61 3d 5a 28 61 2c 50 29 2c 5a 28 66 2c 50 29 5b 79 5d 3d 61 2c 32 34 37 Data Ascii: ),P)),V)(P),Z(f,P)),t),P),Z(S,P)),y=Z(y,P),S))){for(a in G=[],S)G.push(a);S=G}if(P.T==P)for(f=0<f?f:1,P=S.length,a=0;a<P;a+=f)t(S.slice(a,(a\|0)+(f\|0)),y)}}),R).HO=0,R),function(P,f,y,a){(a=V((y=(f=V(P),V(P)),P)),P.T==P)&&(y=Z(y,P),a=Z(a,P),Z(f,P)[y]=a,247
2024-04-26 15:17:29 UTC	1255	IN	Data Raw: 6e 5b 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4e 7d 2c 28 52 28 66 75 6e 63 74 69 6f 6e 28 70 29 7b 70 28 4e 29 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 5d 7d 2c 72 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 49 65 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 2c 65 29 7b 72 65 74 75 72 6e 20 5a 28 28 64 28 34 33 38 2c 52 2c 28 46 79 28 4e 2c 28 28 65 3d 5a 28 34 33 38 2c 52 29 2c 52 2e 50 29 26 26 65 3c 52 2e 73 3f 28 64 28 34 33 38 2c 52 2c 52 2e 73 29 2c 5a 65 28 52 2c 70 29 29 3a 64 28 34 33 38 2c 52 2c 70 29 2c 52 29 29 2c 65 29 29 2c 32 36 31 29 2c 52 29 7d 2c 4e 5f 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 29 7b 72 65 74 75 72 6e 28 70 3d 6c 5b 4e 2e 57 5d 28 4e 2e 4f 52 29 2c 70 5b 4e 2e 57 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 Data Ascii: n[function(){return N},(R(function(p){p(N)}),function(){})]},r=this\|\|self,Ie=function(R,N,p,e){return Z((d(438,R,(Fy(N,((e=Z(438,R),R.P)&&e<R.s?(d(438,R,R.s),Ze(R,p)):d(438,R,p),R)),e)),261),R)},N_=function(R,N,p){return(p=l[N.W](N.OR),p[N.W]=function(){r
2024-04-26 15:17:29 UTC	1255	IN	Data Raw: 4e 5d 7c 30 29 2d 28 52 5b 28 28 4e 7c 30 29 2b 31 29 25 33 5d 7c 30 29 2d 28 65 7c 30 29 5e 28 31 3d 3d 4e 3f 65 3c 3c 70 3a 65 3e 3e 3e 70 29 7d 63 61 74 63 68 28 77 29 7b 74 68 72 6f 77 20 77 3b 7d 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 2c 65 2c 77 2c 54 29 7b 69 66 28 21 70 2e 72 69 26 26 28 54 3d 76 6f 69 64 20 30 2c 4e 26 26 4e 5b 30 5d 3d 3d 3d 4d 26 26 28 54 3d 4e 5b 32 5d 2c 52 3d 4e 5b 31 5d 2c 4e 3d 76 6f 69 64 20 30 29 2c 65 3d 5a 28 31 37 32 2c 70 29 2c 30 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 28 77 3d 5a 28 33 33 31 2c 70 29 3e 3e 33 2c 65 2e 70 75 73 68 28 52 2c 77 3e 3e 38 26 32 35 35 2c 77 26 32 35 35 29 2c 76 6f 69 64 20 30 21 3d 54 26 26 65 2e 70 75 73 68 28 54 26 32 35 35 29 29 2c 52 3d 22 22 2c 4e 26 26 28 4e 2e 6d 65 73 Data Ascii: N]\|0)-(R[((N\|0)+1)%3]\|0)-(e\|0)^(1==N?e<<p:e>>>p)}catch(w){throw w;}},n=function(R,N,p,e,w,T){if(!p.ri&&(T=void 0,N&&N[0]===M&&(T=N[2],R=N[1],N=void 0),e=Z(172,p),0==e.length&&(w=Z(331,p)>>3,e.push(R,w>>8&255,w&255),void 0!=T&&e.push(T&255)),R="",N&&(N.mes
2024-04-26 15:17:29 UTC	1255	IN	Data Raw: 2e 41 3d 54 3b 69 66 28 21 6b 7c 7c 54 2d 65 2e 43 3c 65 2e 42 4f 2d 28 70 3f 32 35 35 3a 4e 3f 35 3a 32 29 29 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 72 65 74 75 72 6e 20 65 2e 5a 3d 28 64 28 34 33 38 2c 28 70 3d 5a 28 28 65 2e 74 54 3d 52 2c 4e 29 3f 33 33 31 3a 34 33 38 2c 65 29 2c 65 29 2c 65 2e 73 29 2c 65 2e 56 2e 70 75 73 68 28 5b 69 47 2c 70 2c 4e 3f 52 2b 31 3a 52 2c 65 2e 44 2c 65 2e 6a 2c 65 2e 76 2c 65 2e 69 5d 29 2c 44 65 29 2c 74 72 75 65 7d 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 4e 2e 42 3d 28 28 4e 2e 42 3f 4e 2e 42 2b 22 7e 22 3a 22 45 3a 22 29 2b 52 2e 6d 65 73 73 61 67 65 2b 22 3a 22 2b 52 2e 73 74 61 63 6b 29 2e 73 6c 69 63 65 28 30 2c 32 30 34 38 29 7d 2c 44 65 3d 72 2e 72 65 71 75 65 73 74 49 64 6c 65 43 61 6c 6c 62 61 63 Data Ascii: .A=T;if(!k\|\|T-e.C<e.BO-(p?255:N?5:2))return false;return e.Z=(d(438,(p=Z((e.tT=R,N)?331:438,e),e),e.s),e.V.push([iG,p,N?R+1:R,e.D,e.j,e.v,e.i]),De),true},H=function(R,N){N.B=((N.B?N.B+"~":"E:")+R.message+":"+R.stack).slice(0,2048)},De=r.requestIdleCallbac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49773	142.250.217.228	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:29 UTC	1882	OUT	GET /recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7621175430%26pcsa%3Dfalse%26channel%3D08272%26domain_name%3Dconversionlogic.net%26client%3Ddp-namemedia08_3ph%26r%3Dm%26rpbu%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2927860770008733%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%26client_gdprApplies%3D0%26format%3Dr3%26nocache%3D4081714144635264%26num%3D0%26output%3Dafd_ads%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1714144635266%26u_w%3D1280%26u_h%3D1024%26biw%3D1280%26bih%3D907%26psw%3D1280%26psh%3D907%26frm%3D0%26uio%3D-%26cont%3DrelatedLinks%26drt%3D0%26jsid%3Dcaf%26nfp%3D1%26jsv%3D627058929%26rurl%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26referer%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252F&q=EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:17:30 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Apr 2024 15:17:29 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-kdkkoaWSprag75aKhh4NqQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 15:17:30 UTC	364	IN	Data Raw: 31 64 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 Data Ascii: 1d14<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face
2024-04-26 15:17:30 UTC	1255	IN	Data Raw: 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e Data Ascii: v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fon
2024-04-26 15:17:30 UTC	1255	IN	Data Raw: 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 Data Ascii: 20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E0
2024-04-26 15:17:30 UTC	1255	IN	Data Raw: 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b Data Ascii: U+04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-26 15:17:30 UTC	1255	IN	Data Raw: 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b Data Ascii: ce { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+
2024-04-26 15:17:30 UTC	1255	IN	Data Raw: 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 Data Ascii: tic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight
2024-04-26 15:17:30 UTC	813	IN	Data Raw: 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 6b 64 6b 6b 6f 61 57 53 70 72 61 67 37 35 61 4b 68 68 34 4e 71 51 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f Data Ascii: }</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css"><script nonce="kdkkoaWSprag75aKhh4NqQ" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.co
2024-04-26 15:17:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49774	52.159.126.152	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:17:50 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 34 4e 33 4d 67 49 58 6b 39 45 69 42 47 78 62 61 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 38 66 39 63 34 33 30 30 37 65 31 63 37 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 4N3MgIXk9EiBGxba.1Context: d18f9c43007e1c7a
2024-04-26 15:17:50 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-26 15:17:50 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 34 4e 33 4d 67 49 58 6b 39 45 69 42 47 78 62 61 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 38 66 39 63 34 33 30 30 37 65 31 63 37 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 32 69 76 61 4e 53 52 2b 39 41 44 35 65 6b 72 56 4c 56 41 73 44 74 4a 6a 54 61 30 61 46 49 4b 5a 2b 62 79 58 50 79 53 31 6b 75 6c 6b 6e 56 4a 31 45 4c 33 31 4c 64 6d 58 4f 44 77 46 47 2f 79 36 2f 74 6b 6b 30 33 42 41 68 48 71 73 36 4b 36 57 6e 45 77 6a 66 33 71 66 37 48 4f 31 2b 77 62 7a 61 45 41 55 78 71 4b 4b 57 64 76 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: 4N3MgIXk9EiBGxba.2Context: d18f9c43007e1c7a<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS2ivaNSR+9AD5ekrVLVAsDtJjTa0aFIKZ+byXPyS1kulknVJ1EL31LdmXODwFG/y6/tkk03BAhHqs6K6WnEwjf3qf7HO1+wbzaEAUxqKKWdvK
2024-04-26 15:17:50 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 34 4e 33 4d 67 49 58 6b 39 45 69 42 47 78 62 61 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 38 66 39 63 34 33 30 30 37 65 31 63 37 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 4N3MgIXk9EiBGxba.3Context: d18f9c43007e1c7a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-26 15:17:50 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-26 15:17:50 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 72 52 56 33 51 39 30 79 45 36 54 4a 77 4f 33 2f 6b 78 74 4b 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: frRV3Q90yE6TJwO3/kxtKQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49778	52.159.126.152	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:18:18 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 70 4b 45 4b 44 62 6f 62 68 55 2b 66 74 7a 36 46 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 63 33 64 38 64 34 37 30 66 36 66 39 32 30 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: pKEKDbobhU+ftz6F.1Context: ac3d8d470f6f920a
2024-04-26 15:18:18 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-26 15:18:18 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 70 4b 45 4b 44 62 6f 62 68 55 2b 66 74 7a 36 46 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 63 33 64 38 64 34 37 30 66 36 66 39 32 30 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 32 69 76 61 4e 53 52 2b 39 41 44 35 65 6b 72 56 4c 56 41 73 44 74 4a 6a 54 61 30 61 46 49 4b 5a 2b 62 79 58 50 79 53 31 6b 75 6c 6b 6e 56 4a 31 45 4c 33 31 4c 64 6d 58 4f 44 77 46 47 2f 79 36 2f 74 6b 6b 30 33 42 41 68 48 71 73 36 4b 36 57 6e 45 77 6a 66 33 71 66 37 48 4f 31 2b 77 62 7a 61 45 41 55 78 71 4b 4b 57 64 76 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: pKEKDbobhU+ftz6F.2Context: ac3d8d470f6f920a<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS2ivaNSR+9AD5ekrVLVAsDtJjTa0aFIKZ+byXPyS1kulknVJ1EL31LdmXODwFG/y6/tkk03BAhHqs6K6WnEwjf3qf7HO1+wbzaEAUxqKKWdvK
2024-04-26 15:18:18 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 70 4b 45 4b 44 62 6f 62 68 55 2b 66 74 7a 36 46 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 63 33 64 38 64 34 37 30 66 36 66 39 32 30 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: pKEKDbobhU+ftz6F.3Context: ac3d8d470f6f920a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-26 15:18:18 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-26 15:18:18 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6f 49 4a 6a 72 61 76 52 57 30 61 75 58 67 68 4e 78 6b 4c 6c 46 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: oIJjravRW0auXghNxkLlFw.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 6276, Parent PID: 5792

General

Target ID:	0
Start time:	17:16:53
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3532, Parent PID: 6276

General

Target ID:	2
Start time:	17:16:59
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2184,i,4750710094024023776,5290538666169249574,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 4392, Parent PID: 5792

General

Target ID:	3
Start time:	17:17:01
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://c.conversionlogic.net"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7621175430%26pcsa%3Dfalse%26channel%3D08272%26domain_name%3Dconversionlogic.net%26client%3Ddp-namemedia08_3ph%26r%3Dm%26rpbu%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2927860770008733%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%26client_gdprApplies%3D0%26format%3Dr3%26nocache%3D4081714144635264%26num%3D0%26output%3Dafd_ads%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1714144635266%26u_w%3D1280%26u_h%3D1024%26biw%3D1280%26bih%3D907%26psw%3D1280%26psh%3D907%26frm%3D0%26uio%3D-%26cont%3DrelatedLinks%26drt%3D0%26jsid%3Dcaf%26nfp%3D1%26jsv%3D627058929%26rurl%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26referer%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252F&q=EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZ...	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7621175430%26pcsa%3Dfalse%26channel%3D08272%26domain_name%3Dconversionlogic.net%26client%3Ddp-namemedia08_3ph%26r%3Dm%26rpbu%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2927860770008733%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%26client_gdprApplies%3D0%26format%3Dr3%26nocache%3D4081714144635264%26num%3D0%26output%3Dafd_ads%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1714144635266%26u_w%3D1280%26u_h%3D1024%26biw%3D1280%26bih%3D907%26psw%3D1280%26psh%3D907%26frm%3D0%26uio%3D-%26cont%3DrelatedLinks%26drt%3D0%26jsid%3Dcaf%26nfp%3D1%26jsv%3D627058929%26rurl%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26referer%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252F&q=EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZ...	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=ou76cc1SFuQyT9YeBPJC8JqqhMnzIft4uTanx-4-9sbqWE4NrVoMd-dFwdVYPVy9o3yHUAf1R87w9OYaEq5iMxhuMJfKl7Y4rbqoIwa393lC9jfkZ1_8zl4VBhX3MAVG92zSN7Fu_2Phxhmh1k-qITmQC5muNW6T1bmxaTlkcze6rrmHMzWEOtVvguGRbiWT8fq4lQmtHBi_uoOzTJc24CG4ZcAKxjOnbOG15IdVyEK_NCwPA33jV9ivnR_L9oFbmgH9wDdkOvwoBV0NuSUZsCMLKawzUnw&cb=hoty0np8z5p9	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon

Source: global traffic	HTTP traffic detected: GET /tag?o=5097926782615552&upapi=true HTTP/1.1Host: btloader.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ww1.conversionlogic.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?abp=1&gdabp=true HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ww1.conversionlogic.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tag?o=5097926782615552&upapi=true HTTP/1.1Host: btloader.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ww1.conversionlogic.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"014d33760e5cfabf5989efdc7561c931"If-Modified-Since: Fri, 26 Apr 2024 15:00:40 GMT
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=2 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ww1.conversionlogic.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.27612668333241763 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ww1.conversionlogic.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ww1.conversionlogic.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mw/state?bt_env=prod HTTP/1.1Host: api.btloader.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: http://ww1.conversionlogic.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: http://ww1.conversionlogic.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.27612668333241763 HTTP/1.1Host: ad-delivery.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=2 HTTP/1.1Host: ad-delivery.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/domains/domain?domain=ww1.conversionlogic.net&portfolioId=&abp=1&gdabp=true HTTP/1.1Host: api.aws.parking.godaddy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Request-Id: a2143552-81d9-4113-9194-6d4d143d8bd3sec-ch-ua-platform: "Windows"Accept: /Origin: http://ww1.conversionlogic.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: http://ww1.conversionlogic.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/ads?adsafe=low&adtest=off&psid=7621175430&pcsa=false&channel=08272&domain_name=conversionlogic.net&client=dp-namemedia08_3ph&r=m&rpbu=http%3A%2F%2Fww1.conversionlogic.net%2Flander&type=3&uiopt=true&swp=as-drid-2927860770008733&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442&client_gdprApplies=0&format=r3&nocache=4081714144635264&num=0&output=afd_ads&v=3&bsl=8&pac=2&u_his=1&u_tz=120&dt=1714144635266&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=907&frm=0&uio=-&cont=relatedLinks&drt=0&jsid=caf&nfp=1&jsv=627058929&rurl=http%3A%2F%2Fww1.conversionlogic.net%2Flander&referer=http%3A%2F%2Fww1.conversionlogic.net%2F HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: http://ww1.conversionlogic.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/domains/domain?domain=ww1.conversionlogic.net&portfolioId=&abp=1&gdabp=true HTTP/1.1Host: api.aws.parking.godaddy.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7621175430%26pcsa%3Dfalse%26channel%3D08272%26domain_name%3Dconversionlogic.net%26client%3Ddp-namemedia08_3ph%26r%3Dm%26rpbu%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2927860770008733%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%26client_gdprApplies%3D0%26format%3Dr3%26nocache%3D4081714144635264%26num%3D0%26output%3Dafd_ads%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1714144635266%26u_w%3D1280%26u_h%3D1024%26biw%3D1280%26bih%3D907%26psw%3D1280%26psh%3D907%26frm%3D0%26uio%3D-%26cont%3DrelatedLinks%26drt%3D0%26jsid%3Dcaf%26nfp%3D1%26jsv%3D627058929%26rurl%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26referer%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252F&q=EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: http://ww1.conversionlogic.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7621175430%26pcsa%3Dfalse%26channel%3D08272%26domain_name%3Dconversionlogic.net%26client%3Ddp-namemedia08_3ph%26r%3Dm%26rpbu%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2927860770008733%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%26client_gdprApplies%3D0%26format%3Dr3%26nocache%3D4081714144635264%26num%3D0%26output%3Dafd_ads%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1714144635266%26u_w%3D1280%26u_h%3D1024%26biw%3D1280%26bih%3D907%26psw%3D1280%26psh%3D907%26frm%3D0%26uio%3D-%26cont%3DrelatedLinks%26drt%3D0%26jsid%3Dcaf%26nfp%3D1%26jsv%3D627058929%26rurl%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26referer%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252F&q=EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=ou76cc1SFuQyT9YeBPJC8JqqhMnzIft4uTanx-4-9sbqWE4NrVoMd-dFwdVYPVy9o3yHUAf1R87w9OYaEq5iMxhuMJfKl7Y4rbqoIwa393lC9jfkZ1_8zl4VBhX3MAVG92zSN7Fu_2Phxhmh1k-qITmQC5muNW6T1bmxaTlkcze6rrmHMzWEOtVvguGRbiWT8fq4lQmtHBi_uoOzTJc24CG4ZcAKxjOnbOG15IdVyEK_NCwPA33jV9ivnR_L9oFbmgH9wDdkOvwoBV0NuSUZsCMLKawzUnw&cb=hoty0np8z5p9 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7621175430%26pcsa%3Dfalse%26channel%3D08272%26domain_name%3Dconversionlogic.net%26client%3Ddp-namemedia08_3ph%26r%3Dm%26rpbu%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2927860770008733%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%26client_gdprApplies%3D0%26format%3Dr3%26nocache%3D4081714144635264%26num%3D0%26output%3Dafd_ads%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1714144635266%26u_w%3D1280%26u_h%3D1024%26biw%3D1280%26bih%3D907%26psw%3D1280%26psh%3D907%26frm%3D0%26uio%3D-%26cont%3DrelatedLinks%26drt%3D0%26jsid%3Dcaf%26nfp%3D1%26jsv%3D627058929%26rurl%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26referer%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252F&q=EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=ou76cc1SFuQyT9YeBPJC8JqqhMnzIft4uTanx-4-9sbqWE4NrVoMd-dFwdVYPVy9o3yHUAf1R87w9OYaEq5iMxhuMJfKl7Y4rbqoIwa393lC9jfkZ1_8zl4VBhX3MAVG92zSN7Fu_2Phxhmh1k-qITmQC5muNW6T1bmxaTlkcze6rrmHMzWEOtVvguGRbiWT8fq4lQmtHBi_uoOzTJc24CG4ZcAKxjOnbOG15IdVyEK_NCwPA33jV9ivnR_L9oFbmgH9wDdkOvwoBV0NuSUZsCMLKawzUnw&cb=hoty0np8z5p9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/lkTXq49YG5_ej1w7m4T9Nw_1Lx1Ocd1gteWQpsfV_Tk.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=ou76cc1SFuQyT9YeBPJC8JqqhMnzIft4uTanx-4-9sbqWE4NrVoMd-dFwdVYPVy9o3yHUAf1R87w9OYaEq5iMxhuMJfKl7Y4rbqoIwa393lC9jfkZ1_8zl4VBhX3MAVG92zSN7Fu_2Phxhmh1k-qITmQC5muNW6T1bmxaTlkcze6rrmHMzWEOtVvguGRbiWT8fq4lQmtHBi_uoOzTJc24CG4ZcAKxjOnbOG15IdVyEK_NCwPA33jV9ivnR_L9oFbmgH9wDdkOvwoBV0NuSUZsCMLKawzUnw&cb=hoty0np8z5p9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7621175430%26pcsa%3Dfalse%26channel%3D08272%26domain_name%3Dconversionlogic.net%26client%3Ddp-namemedia08_3ph%26r%3Dm%26rpbu%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2927860770008733%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%26client_gdprApplies%3D0%26format%3Dr3%26nocache%3D4081714144635264%26num%3D0%26output%3Dafd_ads%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1714144635266%26u_w%3D1280%26u_h%3D1024%26biw%3D1280%26bih%3D907%26psw%3D1280%26psh%3D907%26frm%3D0%26uio%3D-%26cont%3DrelatedLinks%26drt%3D0%26jsid%3Dcaf%26nfp%3D1%26jsv%3D627058929%26rurl%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252Flander%26referer%3Dhttp%253A%252F%252Fww1.conversionlogic.net%252F&q=EgRmgZjcGPyKr7EGIjCSK_vUcq-P1NMromRBIW31_bvsuLbTpOsswmNhRZKtJjlK-ktx1PUz_i4rmPXhm3wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: c.conversionlogic.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ww1.conversionlogic.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: sid=095efd66-03e0-11ef-be3b-9eb7475dca1b
Source: global traffic	HTTP traffic detected: GET /lander HTTP/1.1Host: ww1.conversionlogic.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://ww1.conversionlogic.net/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: sid=095efd66-03e0-11ef-be3b-9eb7475dca1b

Source: global traffic	DNS traffic detected: DNS query: c.conversionlogic.net
Source: global traffic	DNS traffic detected: DNS query: ww1.conversionlogic.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: btloader.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: www.adsensecustomsearchads.com
Source: global traffic	DNS traffic detected: DNS query: api.btloader.com
Source: global traffic	DNS traffic detected: DNS query: ad-delivery.net
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: api.aws.parking.godaddy.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://c.conversionlogic.net

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
http://c.conversionlogic.net