Edit tour

Windows Analysis Report
http://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w=

Overview

General Information

Sample URL:	http://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w=
Analysis ID:	1432281
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7020 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w= MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1936,i,2990256087952315808,2795152919663852828,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 7140 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

chrome.exe (PID: 5484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2044,i,10422334157882643257,4372687792267405033,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49718 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.0.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w= HTTP/1.1Host: kra.ndml.inConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kra-web/MailClose.jsp HTTP/1.1Host: kra.ndml.inConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=E47F5636979E00115307E516EF26B360.tomcat4; NL01506f6b=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; NL01893a59=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4
Source: global traffic	HTTP traffic detected: GET /kra-web/themes/layout.css HTTP/1.1Host: kra.ndml.inConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://kra.ndml.in/kra-web/MailClose.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NL01506f6b=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; JSESSIONID=03696D8317CDA0BFF28F8899498895B9.tomcat4; NL01893a59=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4
Source: global traffic	HTTP traffic detected: GET /kra-web/javascripts/jquery.min.js HTTP/1.1Host: kra.ndml.inConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://kra.ndml.in/kra-web/MailClose.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NL01506f6b=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; JSESSIONID=03696D8317CDA0BFF28F8899498895B9.tomcat4; NL01893a59=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4
Source: global traffic	HTTP traffic detected: GET /kra-web/javascripts/jquery-ui.min.js HTTP/1.1Host: kra.ndml.inConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://kra.ndml.in/kra-web/MailClose.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NL01506f6b=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; JSESSIONID=03696D8317CDA0BFF28F8899498895B9.tomcat4; NL01893a59=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pc1WpNHhOrX8rdE&MD=babuuHWv HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pc1WpNHhOrX8rdE&MD=babuuHWv HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGPnDr7EGIjBmzD6XKne16sxc7aHb3W-_JuZBXg9GdeRJ5dqb22OPbS63K98czF4n9otYLEAd3dAyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-17; NID=513=jcu3EtVbSHR6kL3b5EFYZHRUW4QpUZ_Aq652jhGIof5j_95LJDYZC31Yb-nuCdOWf2c51F4xU5YF7YeAn5_tUHUCQXbaq_BqxMr81hhHgjOXdAfhL8FD8uNz_MGKuWTOQP41O7dPpNqOH6qa4C_2Md3eWsfOH8pYKiRHYsvSNs4
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGPrDr7EGIjA51nBO0ouJB96IkrPObbeH40esAxTUWJYDSH_tpPv7r8GIlnQ1bntE4rLxvVsQBtUyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A
Source: global traffic	HTTP traffic detected: GET /search?q=nyt+connections+hints+april+26&oq=&gs_lcrp=EgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=vWL3XR6bUxdvXanjzgKCgEt4BUdQ4faUZ9Hnj8aS-3-I55LEIZ4AYvRhGF-wJSM497bhMMi52MYWcmCCXHI_W3F1uUVELfHlotpkbgfWfTqXneZbsfP8lNgHpqjdt32JzCYWCogb8S4GDGOKi2_FqBdw1G6eHa_FuOQO_745xd_Cb-V36fiU5wtVD--4aQ1epOhrkAO5VwPc9DGOs7XJ95I31mVj0aQxbkIqaSvlgxg2hcXt0VcsvAkVfMDCxi0tb5XOXpjc8Yx6DdUdyvYmz4Qy0VF2FW0&cb=x31kv38olxs4 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=vWL3XR6bUxdvXanjzgKCgEt4BUdQ4faUZ9Hnj8aS-3-I55LEIZ4AYvRhGF-wJSM497bhMMi52MYWcmCCXHI_W3F1uUVELfHlotpkbgfWfTqXneZbsfP8lNgHpqjdt32JzCYWCogb8S4GDGOKi2_FqBdw1G6eHa_FuOQO_745xd_Cb-V36fiU5wtVD--4aQ1epOhrkAO5VwPc9DGOs7XJ95I31mVj0aQxbkIqaSvlgxg2hcXt0VcsvAkVfMDCxi0tb5XOXpjc8Yx6DdUdyvYmz4Qy0VF2FW0&cb=x31kv38olxs4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
Source: global traffic	HTTP traffic detected: GET /js/bg/lkTXq49YG5_ej1w7m4T9Nw_1Lx1Ocd1gteWQpsfV_Tk.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=vWL3XR6bUxdvXanjzgKCgEt4BUdQ4faUZ9Hnj8aS-3-I55LEIZ4AYvRhGF-wJSM497bhMMi52MYWcmCCXHI_W3F1uUVELfHlotpkbgfWfTqXneZbsfP8lNgHpqjdt32JzCYWCogb8S4GDGOKi2_FqBdw1G6eHa_FuOQO_745xd_Cb-V36fiU5wtVD--4aQ1epOhrkAO5VwPc9DGOs7XJ95I31mVj0aQxbkIqaSvlgxg2hcXt0VcsvAkVfMDCxi0tb5XOXpjc8Yx6DdUdyvYmz4Qy0VF2FW0&cb=x31kv38olxs4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
Source: global traffic	HTTP traffic detected: GET /kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w= HTTP/1.1Host: kra.ndml.inConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: kra.ndml.in
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_149.1.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_139.1.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_139.1.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_139.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_139.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_139.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_139.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_139.1.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_139.1.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_139.1.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_139.1.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_139.1.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_139.1.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: chromecache_145.1.dr, chromecache_139.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_139.1.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__.
Source: chromecache_145.1.dr, chromecache_140.1.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49718 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@43/34@10/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1936,i,2990256087952315808,2795152919663852828,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2044,i,10422334157882643257,4372687792267405033,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1936,i,2990256087952315808,2795152919663852828,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2044,i,10422334157882643257,4372687792267405033,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Rundll32	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w=	0%	Avira URL Cloud	safe
http://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w=	0%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://recaptcha.net	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://www.gstatic.c..?/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kra.ndml.in	59.163.48.94	true	false		high
www.google.com	142.250.217.228	true	false		high

Contacted URLs

Name	Malicious	Reputation
https://kra.ndml.in/kra-web/MailClose.jsp	false	high
https://kra.ndml.in/kra-web/themes/layout.css	false	high
http://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w=	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGPrDr7EGIjA51nBO0ouJB96IkrPObbeH40esAxTUWJYDSH_tpPv7r8GIlnQ1bntE4rLxvVsQBtUyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/favicon.ico	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/search?q=nyt+connections+hints+april+26&oq=&gs_lcrp=EgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/recaptcha/api.js	false	high
https://kra.ndml.in/kra-web/javascripts/jquery-ui.min.js	false	high
https://www.google.com/recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGPnDr7EGIjBmzD6XKne16sxc7aHb3W-_JuZBXg9GdeRJ5dqb22OPbS63K98czF4n9otYLEAd3dAyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://kra.ndml.in/kra-web/javascripts/jquery.min.js	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w=	false	high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m	false	high
https://www.google.com/js/bg/lkTXq49YG5_ej1w7m4T9Nw_1Lx1Ocd1gteWQpsfV_Tk.js	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_139.1.dr	false		high
https://support.google.com/recaptcha#6262736	chromecache_139.1.dr	false		high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_139.1.dr	false		high
http://jqueryui.com	chromecache_149.1.dr	false		high
https://recaptcha.net	chromecache_139.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.apache.org/licenses/	chromecache_139.1.dr	false		high
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_139.1.dr	false		high
https://cloud.google.com/contact	chromecache_139.1.dr	false		high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_139.1.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_139.1.dr	false		high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_139.1.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_139.1.dr	false		high
https://www.gstatic.c..?/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__.	chromecache_139.1.dr	false	Avira URL Cloud: safe	low
https://www.google.com/recaptcha/api2/	chromecache_145.1.dr, chromecache_139.1.dr	false		high
https://support.google.com/recaptcha	chromecache_139.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.217.228	www.google.com	United States	15169	GOOGLEUS	false
59.163.48.94	kra.ndml.in	India	4755	TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP	false
142.250.217.196	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432281
Start date and time:	2024-04-26 19:16:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w=
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@43/34@10/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.217.163, 173.194.211.84, 142.250.64.206, 34.104.35.123, 199.232.210.172, 172.217.2.195, 142.250.217.206, 74.125.26.84, 142.250.217.234, 142.250.64.234, 142.250.64.170, 142.250.217.202, 192.178.50.74, 142.250.64.202, 142.250.217.170, 172.217.2.202, 142.250.64.138, 172.217.15.202, 172.217.165.202, 192.178.50.42, 142.250.189.138, 172.217.165.195, 172.217.3.74, 142.250.217.195
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 16:17:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9903455423883827
Encrypted:	false
SSDEEP:	48:8bd4T8kLHkidAKZdA1FehwiZUklqehDy+3:8+veMy
MD5:	2916854136F988C7F439EB259511194A
SHA1:	1B80C86C0B9768DFF1DFDD9290CC031DA18A6136
SHA-256:	C3F546ADB370DAFD220E067DB40DD459AED971DD0BE27ABE972EDA887879B2EA
SHA-512:	9C6D53CC811E2F5612AB637EC61D2BEB594D164CB663B13CA4F49DFA3E85B2E65E10E7F57A011378E10D8366D42D2FBF8A86421BF7386EADC05DE1187C5900BC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X".....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X).....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X).....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X)............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y>.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 16:17:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.0049152942249835
Encrypted:	false
SSDEEP:	48:88d4T8kLHkidAKZdA1seh/iZUkAQkqeh8y+2:8DvY9QRy
MD5:	DC9C721B9F3D986BAAD86FA904058AAD
SHA1:	665EB86F920CBFF1EA80BFE55EC0F9DF21010ED0
SHA-256:	9B73E44D65BB81135B18490ACBE06C508751ABCA0FF1E1437E93BFBEC50FED2E
SHA-512:	8A10E595612AEA69BF9813F76B775E26317CAA1E039A059C5D4E8C6AD3D43877E42909D95402CEAB815625B03ABC0B93E4144AA1D298CD2B37DE49513C5B6537
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....r.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X".....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X).....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X).....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X)............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y>.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0111035644781525
Encrypted:	false
SSDEEP:	48:8Sd4T8kAHkidAKZdA14meh7sFiZUkmgqeh7sCy+BX:8RvNn4y
MD5:	EC3B923FACD788D39619A7196C9E5124
SHA1:	7B12630387CE3CBE9E4AD0A5BE7F2B369454116C
SHA-256:	ECBFEC6F910427D84A2028DDCD935ABC289F3511D0349D18F552B54FB13E213C
SHA-512:	C29837CF8630781E2DDB77291CAB853F8C205CDEA0D4AAE48CE6E0F34854AA91F5055CF39C84870304ACE230B0D2DBFC89C7A1A257F812DD9FBFF6303AEE20C7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X".....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X).....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X).....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X)............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y>.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 16:17:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.003509213627761
Encrypted:	false
SSDEEP:	48:8bd4T8kLHkidAKZdA1TehDiZUkwqehAy+R:8+vTKy
MD5:	CA48DE0701B8BB4819D6ED25AA805C32
SHA1:	F1269EB1E484EA7094D962A890E19A15EE55CCC0
SHA-256:	97E6D5745CA866B4BB8366CAAB4EF065B5F50CCDCCE29A7536F5037EDCD38AAE
SHA-512:	E7820A670BB58B9674AACFA3005AF49C9F7D618AE98858D28B573EDBC13F2F13716FF191831998AE7F96A2241B0A2877A00AF610F674112D9DE88E480B01B9C9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X".....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X).....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X).....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X)............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y>.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 16:17:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9944056137679014
Encrypted:	false
SSDEEP:	48:8Yd4T8kLHkidAKZdA1dehBiZUk1W1qeh+y+C:8vvj9ey
MD5:	FD2A18B1171BA14186F6258C8B25CC56
SHA1:	71995549EB6C2DFC99472559F573556F15DCFF5C
SHA-256:	64554364609E64D6A87877711BC81C460A09FC1BA6700E31AD6B3686E144EF5D
SHA-512:	14B5338CEE73B647F67E3E303F711E8C2210D980B8942F1E5BE2AEDBA092D9A0081112D32D44C2DB4CA066859D7D52E4E8714138F949DB648F694983AB9DE1C4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X".....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X).....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X).....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X)............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y>.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 16:17:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.003380087752861
Encrypted:	false
SSDEEP:	48:8Wd4T8kLHkidAKZdA1duTeehOuTbbiZUk5OjqehOuTb4y+yT+:8lvnTfTbxWOvTb4y7T
MD5:	E9C8DEE118D4BA095D2BDC28968749C6
SHA1:	0CE3A7EF45069387FAADBCE9C4E7428FC63BE080
SHA-256:	3BACB792AB799FA7A06232F63EFFB535042C6BB3BE7797AEC55A50DD486FD031
SHA-512:	152C94D51C96F7CFFCC9D02DB34C5E87A603B2C9BDF0C8B20022C05A5A0747A05056A06F6E477411EEF404D8711A19F829ECDFB21E5D69D45397707C8470AD37
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X".....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X).....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X).....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X)............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y>.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (631)
Category:	downloaded
Size (bytes):	517649
Entropy (8bit):	5.713376874006511
Encrypted:	false
SSDEEP:	6144:m1K1Z7NMxjW6eJoWvAlUjWwuMSYCVvLk8DSWd1Ps8Jz38iZc:m6eWTAujfuPY0JGgkt
MD5:	E2E79D6B927169D9E0E57E3BAECC0993
SHA1:	1299473950B2999BA0B7F39BD5E4A60EAFD1819D
SHA-256:	231336ED913A5EBD4445B85486E053CAF2B81CAB91318241375F3F7A245B6C6B
SHA-512:	D6A2ED7B19E54D1447EE9BBC684AF7101B48086945A938A5F9B6AE74ACE30B9A98CA83D3183814DD3CC40F251AB6433DC7F8B425F313EA9557B83E1C2E035DFF
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././*.. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that contro

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.8013557344442175
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKVnIwN4wECWaee:PLKdXNQKVnDoCL
MD5:	284B36421A1CF446F32CB8F7987B1091
SHA1:	EB14D6298C9DA3FB26D75B54C087EA2DF9F3F05F
SHA-256:	94AB2BE973685680D0BE9C08D4E1A7465F3C09053CF631126BD33F49CC2F939B
SHA-512:	093F3F5624DE2E43E43EB06036107FF3260237F9E47E1F86FDFBA7C7036522187A9B47B291F5443C566658A8EF555E5033C7F2AC0C9F4FA8EB69EB8E2540B372
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js');

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65450), with CRLF line terminators
Category:	downloaded
Size (bytes):	89478
Entropy (8bit):	5.2899182577550565
Encrypted:	false
SSDEEP:	1536:/jExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvaks:/Yh8eip3huuf6IidlrvakdtQ47GK8
MD5:	B61AA6E2D68D21B3546B5B418BF0E9C3
SHA1:	9C1398F0DE4C869DACB1C9AB1A8CC327F5421FF7
SHA-256:	F36844906AD2309877AAE3121B87FB15B9E09803CB4C333ADC7E1E35AC92E14B
SHA-512:	5882735D9A0239C5C63C5C87B81618E3C8DC09D7D743C3444C535B9547B9B65DEFA509D7804552C581CB84B61DD1225E2ADD5DCA6B120868EC201FA979504F4B
Malicious:	false
Reputation:	low
URL:	https://kra.ndml.in/kra-web/javascripts/jquery.min.js
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2593)
Category:	downloaded
Size (bytes):	2598
Entropy (8bit):	5.849889608241476
Encrypted:	false
SSDEEP:	48:Hjm37KlgZ01ReVz6peMEbvELfgyQoxG9Ib8vIYgTK/8i12Ad3FQuSEqHfffffo:Hjm3Glifimc1bGeGIzOUHw3Ufffffo
MD5:	F42908C269798F7433B3CBDF4020284A
SHA1:	7B3DBFD58139DA30E388260442200648350243C4
SHA-256:	627C0F2535256C7C22EC13835F754B73FC3E1EF12C0295A33B2C5EEA87BB7216
SHA-512:	1629915FD6373EC84CB0C70EDD32E10C5565DB4E7E6A29616DBDAE49879364DC96A76BABA8F19CE542AA269E3DDFC4E968FC9053CE33F76A146780B2585A6C25
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["premier league","household cavalry horses london","nyt connections hints april 26","fallout 4 next gen update","bristol myers squibb layoffs","chicago bears draft caleb williams","abrams tanks","puzzle nyt crossword clue"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CggvbS8wMl90YxINU29jY2VyIGxlYWd1ZTLOCWRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFBYkNBTUFBQUQ3L25uWUFBQUFlMUJNVkVYLy8vODlHVnNPQUVBQUFEeGdTM1VUQUVMMjlmY3hBRk1tQUV3ZkFFZ0FBRGt0QUZBUUFFSGs0ZWZCdThpdXByZWptcTRhQUVYVjBkcC9jSS90Nis5Uk4ycEdLR0pVTzJ3N0ZWcTVzc0dOZ0p1WWphUjVhWXFJZTVlU2hwL0p3ODlDSUY5eVlZUUFBRFZaUW5BQUFDeHFWMzQzQzFkTEwyWUFBREU2ZzdXZ0FBQUN5RWxFUVZRNGpaMlZZWk9qSUF5R0l5cGdFY1NJVnFWS3JZdTkvLzhMRDJ6WDdleDA5bTQyWDJ6QlBKUGtUU0xBcDZFRTBQQmJXeWhNSzJnQ3c2L2NFUmJ1TnI0VWJNSGZCWEQxdk14R2F5OEYvUjJnV2xFcWJhMTU4VmZETUpqM3I3ODdQblBCaTd5ZWlQMDhXWG1abDI5TE1uM0li

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	low
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1120
Entropy (8bit):	5.271517120241527
Encrypted:	false
SSDEEP:	24:WavZNWsCEvCHEtRW+3NVMD+oNVMDFGQeYMCxqVCLWHqEigN+8X:7RHCEvYm4KJoPCxq4GqEbX
MD5:	A6B15878F35508F11F8928E7671ED999
SHA1:	227C0EDABE298121D4502F1EEE9C553ABCCC3AD0
SHA-256:	0147E297DFE17FF53F70119EA281236BEF6912A3468AB8187B2CE94B75993A74
SHA-512:	EFACF15AC910E585882107504C848D58ADCAA387AB83CAF4BA4DC2AF65B4D367A36390FB28AE537A31852199E7415696A2CA2EBB88E3E568F3D9058817A97371
Malicious:	false
Reputation:	low
URL:	https://kra.ndml.in/kra-web/MailClose.jsp
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">............<html>..<title>Mail Response - KYC</title>..<head>..<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">..<meta name="GENERATOR" content="KRA Application Developer">..<link rel="stylesheet" type="text/css" href="/kra-web/themes/layout.css" />..<link rel="shortcut icon" type="image/x-icon" href="/kra-web/images/favicon.ico">..<script type="text/javascript" src="/kra-web/javascripts/jquery.min.js"></script>..<script type="text/javascript" src="/kra-web/javascripts/jquery-ui.min.js"></script>..<script type="text/javascript"> ........function closeMe()..{..alert('null');..var win=window.open("","_self");..win.close();..}..</script>..</head>..<body onload="closeMe()">...... ... <tr><td id="lkLogin"> Click <a href="/kra-web/Login.jsp"> here</a> to Login </td></tr> ..-->..</body>..</html>..<html>..<head>..<meta http-equiv="Cache-Control" content="no-ca

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1222), with no line terminators
Category:	downloaded
Size (bytes):	1222
Entropy (8bit):	5.818804287152988
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCLTLv138EgFB5vtTGJTlWtRcw1MuhtsLqo40RWUnYN:VKEctKonR3evtTA87b1Muh6LrwUnG
MD5:	463D838587C8B5873CB6E4E942B770C9
SHA1:	E69DCF383A6F3F51F123CA2D86F19FC4BE09E612
SHA-256:	1448EC1B3F30A554233BD280AA99A7EAF690D1098647E7DDDEA286C757884F9C
SHA-512:	F02DE64A37B90492D714CC7D132C49BF29CB5117CA945258BAF5B36D087A3A2AED165C6FF37D2ED4E4F10D7199AFB9C2B5E2555BA1BECA1A8D3AE133F4DF4B23
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-0lJkOVHDy3ItYlCbUoEzThjP3hLhLYfEFPAkVOCx

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56412), with no line terminators
Category:	downloaded
Size (bytes):	56412
Entropy (8bit):	5.907540404138125
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKYlebyBblxRx54PHSGdXXwW7MFWwXVuE2:4UcW6v+0BbchXwW49z2
MD5:	2C00B9F417B688224937053CD0C284A5
SHA1:	17B4C18EBC129055DD25F214C3F11E03E9DF2D82
SHA-256:	1E754B107428162C65A26D399B66DB3DAAEA09616BF8620D9DE4BC689CE48EED
SHA-512:	8DC644D4C8E6DA600C751975AC4A9E620E26179167A4021DDB1DA81B452ECF420E459DD1C23D1F2E177685B4E1006DBC5C8736024C447D0FF65F75838A785F57
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17673)
Category:	downloaded
Size (bytes):	18268
Entropy (8bit):	5.619856960314813
Encrypted:	false
SSDEEP:	384:Va/VuX6x1E4rZ5gIcAGn5o86/TZeIeaedo/939zg:Ukqxe4rZ5gIcAGnQ/tEaeE9C
MD5:	9FBB8606566EBF96C502666BFFFD254A
SHA1:	FEB80CB296B30432EC659D7EEDFE3C6022A450E2
SHA-256:	9644D7AB8F581B9FDE8F5C3B9B84FD370FF52F1D4E71DD60B5E590A6C7D5FD39
SHA-512:	7C9C38D0710B52EE4761EEAC4E50BB8F5E319C5AFA49253888D0F45B42DB03DE244181AF62A0BC0431D0AB963AB04A5FD2263907CE0B1188BCB1F6954622204C
Malicious:	false
Reputation:	low
URL:	https://www.google.com/js/bg/lkTXq49YG5_ej1w7m4T9Nw_1Lx1Ocd1gteWQpsfV_Tk.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var f=function(R,N){if(!(N=(R=e.trustedTypes,null),R)\|\|!R.createPolicy)return N;try{N=R.createPolicy("bg",{createHTML:p,createScript:p,createScriptURL:p})}catch(P){e.console&&e.console.error(P.message)}return N},p=function(R){return R},e=this\|\|self;(0,eval)(function(R,N){return(N=f())&&1===R.eval(N.createScript("1"))?function(P){return N.createScript(P)}:function(P){return""+P}}(e)(Array(7824Math.random()\|0).join("\n")+['(function(){/',.'',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var Re=function(R,N){return R[N]<<24\|R[(N\|0)+1]<<16\|R[(N\|0)+2]<<8\|R[(N\|0)+3]},d=function(R,N,p){if(438==R\|\|331==R)N.X[R]?N.X[R].concat(p):N.X[R]=N_(p,N);else{if(N.ri&&247!=R)return;466==R\|\|163==R\|\|161==R\|\|301==R\|\|172==R\|\|120==R\|\|59==R\|\|298==R\|\|344==R?N.X[R]\|\|(N.X[R]=PR(N,p,R,142)):N.X[R]=PR(N,p,R,49)}247==R&&(N.h=q(false,32,N),N.R=void 0)},eZ=function(R,N,p,e){W((e=V((p=V(R),R)),e),R,z(N,Z(p,R)))},sH=

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64394), with CRLF line terminators
Category:	downloaded
Size (bytes):	255089
Entropy (8bit):	5.159752797884137
Encrypted:	false
SSDEEP:	3072:nDPNddBFak8JUaVDpYujVHUc92smVppuzUPFI9fB8NpjJSyACAV:TNdIVWjNS9cdzAV
MD5:	B4BAECB73B7A75044853D7F4D363CB49
SHA1:	CEE14F8598C3C7F75ED141896F976FE94ED286A0
SHA-256:	9D9B75E6BF99296F7797ED12F73137F52966DBB02180FF054C6C01680C7BDB1D
SHA-512:	B5E6510052414B90C694C0A01835A7B49C73801757BC12F0AFA7BB96808FC63E474A38CC7C28ADCF3A4A43D145BE9DCCF0A1923A405777FE3D2FD06474583229
Malicious:	false
Reputation:	low
URL:	https://kra.ndml.in/kra-web/javascripts/jquery-ui.min.js
Preview:	/! jQuery UI - v1.13.2 - 2022-07-14.. http://jqueryui.com..* Includes: widget.js, position.js, data.js, disable-selection.js, effect.js, effects/effect-blind.js, effects/effect-bounce.js, effects/effect-clip.js, effects/effect-drop.js, effects/effect-explode.js, effects/effect-fade.js, effects/effect-fold.js, effects/effect-highlight.js, effects/effect-puff.js, effects/effect-pulsate.js, effects/effect-scale.js, effects/effect-shake.js, effects/effect-size.js, effects/effect-slide.js, effects/effect-transfer.js, focusable.js, form-reset-mixin.js, jquery-patch.js, keycode.js, labels.js, scroll-parent.js, tabbable.js, unique-id.js, widgets/accordion.js, widgets/autocomplete.js, widgets/button.js, widgets/checkboxradio.js, widgets/controlgroup.js, widgets/datepicker.js, widgets/dialog.js, widgets/draggable.js, widgets/droppable.js, widgets/menu.js, widgets/mouse.js, widgets/progressbar.js, widgets/resizable.js, widgets/selectable.js, widgets/selectmenu.js, widgets/slider.js, widgets/sor

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	15474
Entropy (8bit):	5.22895373457441
Encrypted:	false
SSDEEP:	192:BtHmLBcR5ecsSTdpHd2jkiaimu+Gi7J6FC7Itlwb1hJHFX:pLTd5uGF1AKVHZ
MD5:	3062FE933129EB82969E2E983D02EAAE
SHA1:	2F967EBF0B0A0BDE1064D169674FE641AA225F2D
SHA-256:	AB20D36D52E4122FB8F84984D75373319976A63C1BC4042104739FC7A0BC01B0
SHA-512:	B5580D24E75F7B010220DB79F133A2E1C293D96715F467743D087D254D2CC5B265F41AFB9ACC5718E8788BA5DF489DBB734A729384AD3EE3A65A7EDD06F417AD
Malicious:	false
Reputation:	low
URL:	https://kra.ndml.in/kra-web/themes/layout.css
Preview:	td {...font: 11px Verdana, Arial;...color: #6E0000;..}....body {...margin-top: 0px;...font: 11px Verdana, Arial;...text-align: center;...color: #333;...background-color: white;..}.....welcomeBar {...color: #FFFFFF;...background-color: #C46D0F;...font-family: Verdana;...padding: 2px;...height: 17px;...text-indent: 9px;..}.....enableTextField {...font: 8pt x-small Verdana, Tahoma, arial, sans-serif;...color: black;...background-color: white;..}.....headerTop {...background-color: #F4CE85;...height: 15px;..}.....header {...background: url('../images/Header.jpg');...height: 70px;..}.....footer1 {...clear: both;...height: 20px;...margin: 0 auto;...background: #000000 /url('../images/Footer.png');/ ... text-align: .center;...color: #FFFFFF;..}.....footer {...width: 100%;...border-top-style: solid;...border-top: 1px #af2929;...border-top-width: thin;...line-height: 10px;...font-size: 10px;...color: #424D5A;...font-family: Verdana;...font-weight: normal;...align: center;..}../*.main {...back

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk8dqZYMe7mkRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 19:17:17.426093102 CEST	49698	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:17.426831007 CEST	49699	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:17.551198959 CEST	49702	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:17.819472075 CEST	80	49699	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:17.819663048 CEST	49699	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:17.819756985 CEST	80	49698	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:17.819822073 CEST	49698	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:17.819926023 CEST	49699	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:17.942962885 CEST	80	49702	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:17.943053007 CEST	49702	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:18.213582039 CEST	80	49699	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:18.213602066 CEST	80	49699	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:18.268790960 CEST	49699	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:18.349131107 CEST	49703	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:18.349169970 CEST	443	49703	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:18.349248886 CEST	49703	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:18.349487066 CEST	49703	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:18.349502087 CEST	443	49703	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:19.147700071 CEST	443	49703	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:19.184864044 CEST	49703	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:19.184884071 CEST	443	49703	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:19.186002970 CEST	443	49703	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:19.186079979 CEST	49703	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:19.279002905 CEST	49703	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:19.279134035 CEST	443	49703	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:19.279232979 CEST	49703	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:19.279248953 CEST	443	49703	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:19.333805084 CEST	49703	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:20.022547960 CEST	443	49703	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:20.022640944 CEST	443	49703	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:20.022713900 CEST	49703	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:20.024338007 CEST	49703	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:20.024364948 CEST	443	49703	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:20.025135040 CEST	49705	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:20.025185108 CEST	443	49705	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:20.025265932 CEST	49705	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:20.025496960 CEST	49705	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:20.025511026 CEST	443	49705	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:20.825635910 CEST	443	49705	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:20.826014042 CEST	49705	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:20.826041937 CEST	443	49705	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:20.827992916 CEST	443	49705	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:20.828304052 CEST	49705	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:20.828439951 CEST	49705	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:20.828444958 CEST	443	49705	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:20.828550100 CEST	443	49705	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:20.880812883 CEST	49705	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.612974882 CEST	443	49705	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:21.613209963 CEST	443	49705	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:21.613393068 CEST	49705	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.614216089 CEST	49705	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.614236116 CEST	443	49705	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:21.633299112 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.633335114 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:21.633426905 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.633657932 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.633671999 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:21.635473013 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.635509968 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:21.635591030 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.635912895 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.635946989 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:21.636004925 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.636142969 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.636156082 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:21.636435032 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:21.636456013 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.427220106 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.428308010 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.433763981 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.448174953 CEST	49709	443	192.168.2.16	142.250.217.228
Apr 26, 2024 19:17:22.448208094 CEST	443	49709	142.250.217.228	192.168.2.16
Apr 26, 2024 19:17:22.448292017 CEST	49709	443	192.168.2.16	142.250.217.228
Apr 26, 2024 19:17:22.448438883 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.448458910 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.448848963 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.476445913 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.476468086 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.476615906 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.476625919 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.477854967 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.477901936 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.477971077 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.501794100 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.526806116 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.534051895 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.534194946 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.569405079 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.569613934 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.588792086 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.588805914 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.600595951 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.601114035 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.603737116 CEST	49709	443	192.168.2.16	142.250.217.228
Apr 26, 2024 19:17:22.603756905 CEST	443	49709	142.250.217.228	192.168.2.16
Apr 26, 2024 19:17:22.604329109 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.604398012 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.604443073 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:22.648161888 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.652127981 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.652138948 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:22.936832905 CEST	443	49709	142.250.217.228	192.168.2.16
Apr 26, 2024 19:17:22.937124968 CEST	49709	443	192.168.2.16	142.250.217.228
Apr 26, 2024 19:17:22.937154055 CEST	443	49709	142.250.217.228	192.168.2.16
Apr 26, 2024 19:17:22.938234091 CEST	443	49709	142.250.217.228	192.168.2.16
Apr 26, 2024 19:17:22.938293934 CEST	49709	443	192.168.2.16	142.250.217.228
Apr 26, 2024 19:17:22.939271927 CEST	49709	443	192.168.2.16	142.250.217.228
Apr 26, 2024 19:17:22.939352989 CEST	443	49709	142.250.217.228	192.168.2.16
Apr 26, 2024 19:17:22.987793922 CEST	49709	443	192.168.2.16	142.250.217.228
Apr 26, 2024 19:17:22.987812996 CEST	443	49709	142.250.217.228	192.168.2.16
Apr 26, 2024 19:17:23.035790920 CEST	49709	443	192.168.2.16	142.250.217.228
Apr 26, 2024 19:17:23.218669891 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.218708992 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.218755007 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.218813896 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.218832970 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.218884945 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.219228029 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.219284058 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.219577074 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.219624043 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.220040083 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.220093966 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.220134974 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.220901966 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.220951080 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.220957994 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.221401930 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.221452951 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.221458912 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.222168922 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.222218037 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.222225904 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.222790956 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.222843885 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.222851992 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.227627039 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.227685928 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.227708101 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.227747917 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.227767944 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.227782011 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.227838039 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.227885962 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.227900028 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.228037119 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.228085995 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.228092909 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.228180885 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.228239059 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.228245974 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.228395939 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.228442907 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.228450060 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.228704929 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.228771925 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.228779078 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.274811029 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.275012970 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.614861965 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.614887953 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.614893913 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.614926100 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.614942074 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.614950895 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.615041971 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.615041971 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.615056038 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.615101099 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.616066933 CEST	49708	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.616086006 CEST	443	49708	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617131948 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617196083 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617238045 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.617240906 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617269039 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617286921 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.617296934 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617393970 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617439032 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617444992 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.617454052 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617485046 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617490053 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.617526054 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.617532015 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617543936 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617587090 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.617594957 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.617918015 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.618330956 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.618381023 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.618408918 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.618417978 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.618453026 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.618503094 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.618550062 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.618556976 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.618740082 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.618859053 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.618906021 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.618915081 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.618953943 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.619832039 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.619887114 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.619894028 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.619900942 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.619934082 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.619971037 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.620022058 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.620141983 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.620189905 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.621145964 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.621187925 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.621203899 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.621212006 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.621520996 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.623017073 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.623095989 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.623150110 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.623203039 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.623306990 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.623352051 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.623406887 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.623457909 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.623507977 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.623558998 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.623614073 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.623652935 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.623709917 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.623765945 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.623799086 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.623840094 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.623910904 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.623955965 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.624001026 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.624044895 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.624119043 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.624165058 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.624234915 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.624278069 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.624325037 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.624371052 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.624417067 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.624455929 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.624502897 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.624550104 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.624594927 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.624645948 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.624689102 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.624732971 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.624778986 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.624824047 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.624869108 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.624912024 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.624958992 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.624995947 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.625025988 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:23.625066996 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:23.881346941 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 19:17:24.009830952 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010036945 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010138988 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010309935 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010315895 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.010341883 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010356903 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.010395050 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010483027 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010531902 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.010540009 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010577917 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.010586023 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010610104 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010698080 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010746002 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.010754108 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010785103 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010791063 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.010806084 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010893106 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010946035 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.010953903 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010981083 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.010992050 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.011003017 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011096001 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011137962 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.011146069 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011190891 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.011190891 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011213064 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011312008 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011358023 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.011367083 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011404991 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011405945 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.011426926 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011511087 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011564016 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.011579037 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011600018 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011619091 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.011625051 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011687040 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011733055 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.011740923 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011774063 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011779070 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.011794090 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011878967 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011889935 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.011902094 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.011986017 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012036085 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.012044907 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012073040 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012089968 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.012096882 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012202978 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012252092 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.012259007 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012293100 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012301922 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.012315035 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012411118 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012461901 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.012470007 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012507915 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012510061 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.012527943 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012609959 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012658119 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.012665987 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012691975 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012710094 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.012716055 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012850046 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012904882 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.012912035 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012938023 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.012953043 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.012959957 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.013020992 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.013067961 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.013076067 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.013115883 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.013154984 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.013351917 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.013354063 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.013380051 CEST	443	49706	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.013416052 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.013443947 CEST	49706	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.019506931 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.019588947 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.019635916 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.019685984 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.019733906 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.019788980 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.019829035 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.019922972 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020087004 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020140886 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.020154953 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020201921 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020292997 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020344019 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.020354033 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020386934 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020479918 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020525932 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.020534039 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020577908 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.020584106 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020610094 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020662069 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.020706892 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020768881 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.020807981 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020853996 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.020895958 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.020940065 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.020982981 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021069050 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021162033 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021208048 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.021218061 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021251917 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021258116 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.021274090 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021347046 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.021365881 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021414042 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.021459103 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021506071 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.021553040 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021600962 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.021641970 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021687984 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.021732092 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021779060 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.021820068 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021866083 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.021908045 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.021974087 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.021996975 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.022042990 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.022085905 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.022134066 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.022176027 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.022222996 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.185003042 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 19:17:24.416342974 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.416547060 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.416611910 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.416687012 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.416726112 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.416831970 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.416881084 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.416893005 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.416939020 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.417114973 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.417181015 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.417228937 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.417278051 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.417320013 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.417365074 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.417428970 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.417484045 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.417541027 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.417592049 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.417723894 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.417790890 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.417809010 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.417867899 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.417994976 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.418046951 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.418176889 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.418222904 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.418258905 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.418306112 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.418348074 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.418394089 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.419436932 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.419457912 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.419500113 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.419511080 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.419529915 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.419574022 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.419595957 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.420383930 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.420428038 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.420456886 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.420469046 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.420491934 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.421642065 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.421689987 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.421715021 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.421726942 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.421772003 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.470891953 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.791914940 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 19:17:24.811891079 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.811924934 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.812031984 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.812061071 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.812114000 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.812891960 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.812913895 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.812977076 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.812992096 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.813043118 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.814265013 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.814285994 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.814366102 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.814377069 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.814426899 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.815289974 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.815310955 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.815376043 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.815387011 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.815437078 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.815604925 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.815661907 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.815668106 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.815705061 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.815707922 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.815754890 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.815761089 CEST	443	49707	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:24.815784931 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.815784931 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:24.815804958 CEST	49707	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:25.999789000 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 19:17:26.291671991 CEST	49688	443	192.168.2.16	23.219.0.183
Apr 26, 2024 19:17:28.409826040 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 19:17:29.106004000 CEST	49698	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:29.106040955 CEST	49702	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:29.106106997 CEST	49699	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:29.106134892 CEST	49709	443	192.168.2.16	142.250.217.228
Apr 26, 2024 19:17:29.106267929 CEST	443	49709	142.250.217.228	192.168.2.16
Apr 26, 2024 19:17:29.106327057 CEST	49709	443	192.168.2.16	142.250.217.228
Apr 26, 2024 19:17:29.497704029 CEST	80	49702	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:29.497756958 CEST	80	49702	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:29.497823954 CEST	49702	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:29.498148918 CEST	80	49698	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:29.498193979 CEST	80	49698	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:29.498266935 CEST	49698	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:29.498645067 CEST	80	49699	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:29.498680115 CEST	80	49699	59.163.48.94	192.168.2.16
Apr 26, 2024 19:17:29.498742104 CEST	49699	80	192.168.2.16	59.163.48.94
Apr 26, 2024 19:17:31.031368971 CEST	49715	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.031410933 CEST	443	49715	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.031497955 CEST	49715	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.033514023 CEST	49715	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.033525944 CEST	443	49715	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.296885014 CEST	443	49715	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.296977997 CEST	49715	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.306586981 CEST	49715	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.306611061 CEST	443	49715	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.307342052 CEST	443	49715	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.356823921 CEST	49715	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.459481955 CEST	49715	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.500144958 CEST	443	49715	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.587003946 CEST	443	49715	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.587080956 CEST	443	49715	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.587141037 CEST	49715	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.587208033 CEST	49715	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.587224960 CEST	443	49715	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.587234974 CEST	49715	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.587239981 CEST	443	49715	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.616621971 CEST	49716	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.616657019 CEST	443	49716	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.616731882 CEST	49716	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.616991997 CEST	49716	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.617002010 CEST	443	49716	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.872437000 CEST	443	49716	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.872548103 CEST	49716	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.873703957 CEST	49716	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.873712063 CEST	443	49716	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.874018908 CEST	443	49716	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:31.875360966 CEST	49716	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:31.895392895 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:31.895432949 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:31.895526886 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:31.896579981 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:31.896593094 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:31.920108080 CEST	443	49716	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:32.058389902 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 19:17:32.125185966 CEST	443	49716	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:32.125272989 CEST	443	49716	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:32.125336885 CEST	49716	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:32.126193047 CEST	49716	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:32.126213074 CEST	443	49716	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:32.126224995 CEST	49716	443	192.168.2.16	23.204.76.112
Apr 26, 2024 19:17:32.126230001 CEST	443	49716	23.204.76.112	192.168.2.16
Apr 26, 2024 19:17:32.362489939 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 19:17:32.592513084 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:32.592607975 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:32.596225023 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:32.596235991 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:32.596499920 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:32.646827936 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:32.677405119 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:32.720119953 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:32.965857029 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 19:17:33.220926046 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 19:17:33.268863916 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:33.268897057 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:33.268906116 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:33.268919945 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:33.268955946 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:33.268968105 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:33.268992901 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:33.269041061 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:33.269073963 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:33.269421101 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:33.269495010 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:33.269531965 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:33.269546032 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:33.281028986 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:33.281056881 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:33.281089067 CEST	49717	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:17:33.281095982 CEST	443	49717	40.127.169.103	192.168.2.16
Apr 26, 2024 19:17:34.178845882 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 19:17:36.530011892 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 19:17:36.593966961 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 19:17:36.835834026 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 19:17:37.441838980 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 19:17:38.656831026 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 19:17:41.057868958 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 19:17:41.393879890 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 19:17:42.829844952 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 19:17:45.864851952 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 19:17:50.996877909 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 19:17:55.474904060 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 19:18:10.287678003 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:10.287725925 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:10.287815094 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:10.288239956 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:10.288259029 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:10.992703915 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:10.992806911 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:10.994153976 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:10.994163990 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:10.994564056 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:10.995728970 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:11.040127993 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:11.668838978 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:11.668976068 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:11.669023991 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:11.669054031 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:11.669092894 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:11.669111967 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:11.669142008 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:11.669207096 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:11.669260025 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:11.669296026 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:11.669302940 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:11.669337034 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:11.669389963 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:11.669435978 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:11.672117949 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:11.672135115 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:11.672144890 CEST	49718	443	192.168.2.16	40.127.169.103
Apr 26, 2024 19:18:11.672151089 CEST	443	49718	40.127.169.103	192.168.2.16
Apr 26, 2024 19:18:48.298710108 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.298764944 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.298837900 CEST	49722	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.298851967 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.298881054 CEST	443	49722	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.298960924 CEST	49722	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.304507017 CEST	49722	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.304538012 CEST	443	49722	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.321573973 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.321593046 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.663398027 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.663625956 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.663636923 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.664555073 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.664685965 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.665657997 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.665747881 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.666138887 CEST	49724	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.666178942 CEST	443	49724	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.666289091 CEST	49724	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.666349888 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.666383028 CEST	443	49725	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.666428089 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.666434050 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.666481972 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.666692972 CEST	49724	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.666708946 CEST	443	49724	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.666866064 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.666878939 CEST	443	49725	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.690069914 CEST	443	49722	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.690397024 CEST	49722	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.690416098 CEST	443	49722	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.691446066 CEST	443	49722	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.691555023 CEST	49722	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.691972017 CEST	49722	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.692038059 CEST	443	49722	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.692152977 CEST	49722	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.692173004 CEST	443	49722	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:48.717062950 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.733076096 CEST	49722	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:48.999725103 CEST	443	49725	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.000055075 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.000080109 CEST	443	49725	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.001584053 CEST	443	49725	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.001671076 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.001930952 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.002010107 CEST	443	49725	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.002057076 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.044122934 CEST	443	49725	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.052078962 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.052109957 CEST	443	49725	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.065283060 CEST	49722	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.065396070 CEST	443	49722	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.065498114 CEST	49722	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.100061893 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.518568993 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.518615007 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.518640041 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.518681049 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.518708944 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.518757105 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.519224882 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.519370079 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.519412994 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.519788027 CEST	49721	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.519804001 CEST	443	49721	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.723356962 CEST	443	49725	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.723481894 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.723490953 CEST	443	49725	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.723532915 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.724232912 CEST	49725	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.724251986 CEST	443	49725	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.726830959 CEST	49726	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.726872921 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:49.726974964 CEST	49726	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.727194071 CEST	49726	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:49.727206945 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.060830116 CEST	443	49724	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.061209917 CEST	49724	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.061243057 CEST	443	49724	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.061620951 CEST	443	49724	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.061908960 CEST	49724	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.061974049 CEST	443	49724	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.062035084 CEST	49724	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.104150057 CEST	443	49724	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.116785049 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.117037058 CEST	49726	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.117064953 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.117393970 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.117669106 CEST	49726	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.117726088 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.117779016 CEST	49726	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.160114050 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.168041945 CEST	49726	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.478413105 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.478471994 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.478497028 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.478588104 CEST	49726	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.478615999 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.478658915 CEST	49726	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.479130983 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.479197025 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.479243040 CEST	49726	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.479676008 CEST	49726	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.479687929 CEST	443	49726	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.859375000 CEST	443	49724	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.859483004 CEST	49724	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:50.859502077 CEST	443	49724	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:50.859541893 CEST	49724	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.200608969 CEST	49724	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.200642109 CEST	443	49724	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.202604055 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.202649117 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.202713013 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.202945948 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.202964067 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.630223989 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.630615950 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.630659103 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.631781101 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.632081985 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.632219076 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.632225990 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.632313967 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.674062967 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.991822958 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.991987944 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.992109060 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.992145061 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.992393970 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.992455006 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.992988110 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.993006945 CEST	443	49727	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:51.993020058 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:51.993065119 CEST	49727	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:52.728319883 CEST	49728	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:52.728362083 CEST	443	49728	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:52.728490114 CEST	49728	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:52.728693962 CEST	49728	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:52.728705883 CEST	443	49728	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:53.071517944 CEST	443	49728	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:53.071877956 CEST	49728	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:53.071906090 CEST	443	49728	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:53.072441101 CEST	443	49728	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:53.072745085 CEST	49728	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:53.072815895 CEST	443	49728	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:53.126101017 CEST	49728	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:54.361008883 CEST	49728	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:54.361536980 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:54.361581087 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:54.361649990 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:54.361903906 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:54.361918926 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:54.408123016 CEST	443	49728	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:54.492655993 CEST	49728	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:54.492866993 CEST	443	49728	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:54.492933035 CEST	49728	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:54.697654963 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:54.698381901 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:54.698399067 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:54.702121973 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:54.702240944 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:54.706439972 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:54.706528902 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:54.750025988 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:54.750050068 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:54.798031092 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:58.491992950 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:58.532114029 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.063968897 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.064071894 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.064153910 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.064227104 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.064227104 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.064558983 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.064580917 CEST	443	49729	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.064593077 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.064640045 CEST	49729	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.066596031 CEST	49733	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.066665888 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.066766024 CEST	49733	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.066960096 CEST	49733	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.066975117 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.459990978 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.460263968 CEST	49733	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.460306883 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.460649014 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.460987091 CEST	49733	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.461045027 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.461143970 CEST	49733	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.461168051 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.816411972 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.816458941 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.816519022 CEST	49733	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.816524029 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.816551924 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.816596985 CEST	49733	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.816605091 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.817030907 CEST	49733	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.817070007 CEST	443	49733	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.817127943 CEST	49733	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.830003023 CEST	49734	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.830037117 CEST	443	49734	142.250.217.196	192.168.2.16
Apr 26, 2024 19:18:59.830107927 CEST	49734	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.830303907 CEST	49734	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:18:59.830318928 CEST	443	49734	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:00.164310932 CEST	443	49734	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:00.205040932 CEST	49734	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:00.401523113 CEST	49734	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:00.401592970 CEST	443	49734	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:00.405859947 CEST	443	49734	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:00.405945063 CEST	49734	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:00.610965967 CEST	49734	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:00.611404896 CEST	443	49734	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:00.613545895 CEST	49734	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:00.613590956 CEST	443	49734	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:00.664056063 CEST	49734	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:00.788422108 CEST	443	49734	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:00.788563013 CEST	443	49734	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:00.788619041 CEST	49734	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:00.789232016 CEST	49734	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:00.789256096 CEST	443	49734	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:02.696536064 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:02.696563959 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:02.696643114 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:02.696825027 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:02.696829081 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.021676064 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.021982908 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.022001028 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.022344112 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.022650957 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.022726059 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.022803068 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.022914886 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.371639967 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.371682882 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.371750116 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.371820927 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.371840000 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.371865034 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.371881008 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.371886969 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.371925116 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.372137070 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.382313013 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.382358074 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.382368088 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.393302917 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.393357992 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.393381119 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.403902054 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.403980017 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.404021025 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.450057983 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.450097084 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.498049974 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.526523113 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.531712055 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.531738997 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.531780005 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.531815052 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.531871080 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.542686939 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.553391933 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.553441048 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.553482056 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.553515911 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.553571939 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.564212084 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.575061083 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.575105906 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.575115919 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.585869074 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.585901022 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.585942030 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.585947037 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.585975885 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.596627951 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.606583118 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.606614113 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.606646061 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.606652021 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.606683969 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.616513968 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.626415968 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.626465082 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.626471043 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.636353016 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.636390924 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.636394978 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.636404037 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.636440039 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.646271944 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.656069040 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.656117916 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.656133890 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.656244040 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:03.656276941 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.846899033 CEST	49739	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:03.846959114 CEST	443	49739	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:04.878150940 CEST	49745	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:04.878169060 CEST	443	49745	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:04.878225088 CEST	49745	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:04.878436089 CEST	49745	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:04.878451109 CEST	443	49745	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.205065012 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.205101967 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.205173016 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.205461979 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.205476999 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.268872023 CEST	443	49745	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.269140005 CEST	49745	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.269157887 CEST	443	49745	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.269489050 CEST	443	49745	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.269840002 CEST	49745	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.269939899 CEST	443	49745	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.270092964 CEST	49745	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.316112995 CEST	443	49745	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.594744921 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.595089912 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.595108986 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.595406055 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.595746040 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.595801115 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.595861912 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.629930973 CEST	443	49745	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.630192041 CEST	443	49745	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.630247116 CEST	49745	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.631156921 CEST	49745	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.631181002 CEST	443	49745	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.640121937 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.772855997 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.772891045 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.772994041 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.773242950 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.773257971 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.940854073 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.940903902 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.940926075 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.940953970 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.940963030 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.940973997 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.941015005 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.941030979 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.941071033 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.953746080 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.966840982 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.966891050 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.966897011 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.966907024 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.966939926 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.980051994 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.993272066 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:05.993319035 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:05.993338108 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.045064926 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.097107887 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.102550983 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.102828026 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.102849960 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.103362083 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.103688955 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.103715897 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.103753090 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.103780985 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.103799105 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.103863955 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.103970051 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.103998899 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.104227066 CEST	49747	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.104244947 CEST	443	49747	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.157083035 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.434328079 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.434389114 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.434429884 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.434462070 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.434489965 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.434530020 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.434535027 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.445225000 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.445353985 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.445382118 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.448287010 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.448385000 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.448450089 CEST	49748	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.448467970 CEST	443	49748	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.468153954 CEST	49749	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.468204975 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.468290091 CEST	49749	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.468602896 CEST	49749	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.468622923 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.858354092 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.904090881 CEST	49749	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.943059921 CEST	49749	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.943075895 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.943895102 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.970587969 CEST	49749	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.970782042 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:06.998202085 CEST	49749	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:06.998234987 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:07.225373983 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:07.225436926 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:07.225477934 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:07.225517988 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:07.225517988 CEST	49749	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:07.225563049 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:07.225581884 CEST	49749	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:07.230849981 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:07.230943918 CEST	49749	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:07.231106043 CEST	49749	443	192.168.2.16	142.250.217.196
Apr 26, 2024 19:19:07.231131077 CEST	443	49749	142.250.217.196	192.168.2.16
Apr 26, 2024 19:19:15.060095072 CEST	49750	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:19:15.060151100 CEST	443	49750	59.163.48.94	192.168.2.16
Apr 26, 2024 19:19:15.060250044 CEST	49750	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:19:15.060501099 CEST	49750	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:19:15.060518980 CEST	443	49750	59.163.48.94	192.168.2.16
Apr 26, 2024 19:19:15.849903107 CEST	443	49750	59.163.48.94	192.168.2.16
Apr 26, 2024 19:19:15.850183010 CEST	49750	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:19:15.850218058 CEST	443	49750	59.163.48.94	192.168.2.16
Apr 26, 2024 19:19:15.851258039 CEST	443	49750	59.163.48.94	192.168.2.16
Apr 26, 2024 19:19:15.851320982 CEST	49750	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:19:15.852344990 CEST	49750	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:19:15.852425098 CEST	443	49750	59.163.48.94	192.168.2.16
Apr 26, 2024 19:19:15.892086983 CEST	49750	443	192.168.2.16	59.163.48.94
Apr 26, 2024 19:19:15.892115116 CEST	443	49750	59.163.48.94	192.168.2.16
Apr 26, 2024 19:19:15.940186977 CEST	49750	443	192.168.2.16	59.163.48.94

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 19:17:17.294203043 CEST	52664	53	192.168.2.16	1.1.1.1
Apr 26, 2024 19:17:17.295124054 CEST	59246	53	192.168.2.16	1.1.1.1
Apr 26, 2024 19:17:17.418112993 CEST	53	50508	1.1.1.1	192.168.2.16
Apr 26, 2024 19:17:17.425219059 CEST	53	59246	1.1.1.1	192.168.2.16
Apr 26, 2024 19:17:17.425235987 CEST	53	52664	1.1.1.1	192.168.2.16
Apr 26, 2024 19:17:17.525598049 CEST	53	64016	1.1.1.1	192.168.2.16
Apr 26, 2024 19:17:18.216563940 CEST	64398	53	192.168.2.16	1.1.1.1
Apr 26, 2024 19:17:18.216703892 CEST	64289	53	192.168.2.16	1.1.1.1
Apr 26, 2024 19:17:18.346817970 CEST	53	64398	1.1.1.1	192.168.2.16
Apr 26, 2024 19:17:18.348624945 CEST	53	64289	1.1.1.1	192.168.2.16
Apr 26, 2024 19:17:18.486216068 CEST	53	59295	1.1.1.1	192.168.2.16
Apr 26, 2024 19:17:22.185656071 CEST	63592	53	192.168.2.16	1.1.1.1
Apr 26, 2024 19:17:22.223475933 CEST	63860	53	192.168.2.16	1.1.1.1
Apr 26, 2024 19:17:22.310236931 CEST	53	63592	1.1.1.1	192.168.2.16
Apr 26, 2024 19:17:22.348532915 CEST	53	63860	1.1.1.1	192.168.2.16
Apr 26, 2024 19:18:28.220679045 CEST	138	138	192.168.2.16	192.168.2.255
Apr 26, 2024 19:18:48.171834946 CEST	49395	53	192.168.2.16	1.1.1.1
Apr 26, 2024 19:18:48.172044039 CEST	52428	53	192.168.2.16	1.1.1.1
Apr 26, 2024 19:18:48.242341995 CEST	53	64832	1.1.1.1	192.168.2.16
Apr 26, 2024 19:18:48.296325922 CEST	53	55464	1.1.1.1	192.168.2.16
Apr 26, 2024 19:18:48.297168970 CEST	53	49395	1.1.1.1	192.168.2.16
Apr 26, 2024 19:18:48.297745943 CEST	53	52428	1.1.1.1	192.168.2.16
Apr 26, 2024 19:18:49.230055094 CEST	53	55450	1.1.1.1	192.168.2.16
Apr 26, 2024 19:18:57.855164051 CEST	53	58243	1.1.1.1	192.168.2.16
Apr 26, 2024 19:19:00.919517994 CEST	53	62683	1.1.1.1	192.168.2.16
Apr 26, 2024 19:19:02.920996904 CEST	53	59967	1.1.1.1	192.168.2.16
Apr 26, 2024 19:19:05.031811953 CEST	53	52259	1.1.1.1	192.168.2.16
Apr 26, 2024 19:19:06.668929100 CEST	53	54485	1.1.1.1	192.168.2.16
Apr 26, 2024 19:19:14.929188967 CEST	62614	53	192.168.2.16	1.1.1.1
Apr 26, 2024 19:19:14.929311037 CEST	62966	53	192.168.2.16	1.1.1.1
Apr 26, 2024 19:19:15.055665016 CEST	53	62614	1.1.1.1	192.168.2.16
Apr 26, 2024 19:19:15.059631109 CEST	53	62966	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 19:17:17.294203043 CEST	192.168.2.16	1.1.1.1	0x127e	Standard query (0)	kra.ndml.in	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:17.295124054 CEST	192.168.2.16	1.1.1.1	0x92db	Standard query (0)	kra.ndml.in	65	IN (0x0001)	false
Apr 26, 2024 19:17:18.216563940 CEST	192.168.2.16	1.1.1.1	0x2f2c	Standard query (0)	kra.ndml.in	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:18.216703892 CEST	192.168.2.16	1.1.1.1	0x1d	Standard query (0)	kra.ndml.in	65	IN (0x0001)	false
Apr 26, 2024 19:17:22.185656071 CEST	192.168.2.16	1.1.1.1	0x1992	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:22.223475933 CEST	192.168.2.16	1.1.1.1	0xac25	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 19:18:48.171834946 CEST	192.168.2.16	1.1.1.1	0x7d83	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:18:48.172044039 CEST	192.168.2.16	1.1.1.1	0x3c17	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 19:19:14.929188967 CEST	192.168.2.16	1.1.1.1	0x61a4	Standard query (0)	kra.ndml.in	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:19:14.929311037 CEST	192.168.2.16	1.1.1.1	0x92c5	Standard query (0)	kra.ndml.in	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 19:17:17.425235987 CEST	1.1.1.1	192.168.2.16	0x127e	No error (0)	kra.ndml.in	59.163.48.94	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:18.346817970 CEST	1.1.1.1	192.168.2.16	0x2f2c	No error (0)	kra.ndml.in	59.163.48.94	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:22.310236931 CEST	1.1.1.1	192.168.2.16	0x1992	No error (0)	www.google.com	142.250.217.228	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:22.348532915 CEST	1.1.1.1	192.168.2.16	0xac25	No error (0)	www.google.com		65	IN (0x0001)	false
Apr 26, 2024 19:18:48.297168970 CEST	1.1.1.1	192.168.2.16	0x7d83	No error (0)	www.google.com	142.250.217.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:18:48.297745943 CEST	1.1.1.1	192.168.2.16	0x3c17	No error (0)	www.google.com		65	IN (0x0001)	false
Apr 26, 2024 19:19:15.055665016 CEST	1.1.1.1	192.168.2.16	0x61a4	No error (0)	kra.ndml.in	59.163.48.94	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

kra.ndml.in

https:

www.google.com

fs.microsoft.com

slscr.update.microsoft.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49699	59.163.48.94	80	6164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 19:17:17.819926023 CEST	573	OUT	GET /kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w= HTTP/1.1 Host: kra.ndml.in Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 26, 2024 19:17:18.213602066 CEST	271	IN	HTTP/1.0 302 Moved Temporarily Location: https://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w= Server: BigIP Connection: Keep-Alive Content-Length: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49703	59.163.48.94	443	6164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:19 UTC	801	OUT	GET /kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w= HTTP/1.1 Host: kra.ndml.in Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:17:20 UTC	1130	IN	HTTP/1.1 302 302 Date: Fri, 26 Apr 2024 17:17:19 GMT X-Frame-Options: SAMEORIGIN Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Location: /kra-web/MailClose.jsp Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-WebKit-CSP: default-src 'self' X-Permitted-Cross-Domain-Policies: master-only Access-Control-Allow-Headers: ORIGIN, X-REQUESTED-WITH, CONTENT-TYPE Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Credentials: false Access-Control-Max-Age: 60000 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Set-Cookie: JSESSIONID=E47F5636979E00115307E516EF26B360.tomcat4; Path=/kra-web; Secure; HttpOnly; Secure; SameSite=Strict ; HTTPOnly Vary: User-Agent Connection: close Set-Cookie: NL01893a59=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; Path=/; Domain=.kra.ndml.in Set-Cookie: NL01506f6b=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; path=/kra-web

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49705	59.163.48.94	443	6164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:20 UTC	974	OUT	GET /kra-web/MailClose.jsp HTTP/1.1 Host: kra.ndml.in Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=E47F5636979E00115307E516EF26B360.tomcat4; NL01506f6b=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; NL01893a59=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4
2024-04-26 17:17:21 UTC	1129	IN	HTTP/1.1 200 200 Date: Fri, 26 Apr 2024 17:17:21 GMT X-Frame-Options: SAMEORIGIN cache-Control: must-revalidate Pragma: no-cache Last-Modified: Fri, 26 Apr 2024 17:17:21 GMT Content-Length: 1120 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-WebKit-CSP: default-src 'self' X-Permitted-Cross-Domain-Policies: master-only Access-Control-Allow-Headers: ORIGIN, X-REQUESTED-WITH, CONTENT-TYPE Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Credentials: false Access-Control-Max-Age: 60000 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Set-Cookie: JSESSIONID=03696D8317CDA0BFF28F8899498895B9.tomcat4; Path=/kra-web; Secure; HttpOnly; Secure; SameSite=Strict ; HTTPOnly Vary: User-Agent Connection: close Content-Type: text/html;charset=ISO-8859-1 Set-Cookie: NL01893a59=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; Path=/; Domain=.kra.ndml.in Set-Cookie: NL01506f6b=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; path=/kra-web
2024-04-26 17:17:21 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 74 69 74 6c 65 3e 4d 61 69 6c 20 52 65 73 70 6f 6e 73 65 20 2d 20 4b 59 43 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><title>Mail Response - KYC</title><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><meta name="GEN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49708	59.163.48.94	443	6164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:22 UTC	866	OUT	GET /kra-web/themes/layout.css HTTP/1.1 Host: kra.ndml.in Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://kra.ndml.in/kra-web/MailClose.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NL01506f6b=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; JSESSIONID=03696D8317CDA0BFF28F8899498895B9.tomcat4; NL01893a59=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4
2024-04-26 17:17:23 UTC	714	IN	HTTP/1.1 200 200 Date: Fri, 26 Apr 2024 17:17:23 GMT X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes Last-Modified: Thu, 04 Apr 2024 10:20:30 GMT Content-Length: 15474 Cache-Control: max-age=2592000 Expires: Sun, 26 May 2024 17:17:23 GMT X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-WebKit-CSP: default-src 'self' X-Permitted-Cross-Domain-Policies: master-only Access-Control-Allow-Headers: ORIGIN, X-REQUESTED-WITH, CONTENT-TYPE Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Credentials: false Access-Control-Max-Age: 60000 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: User-Agent Connection: close Content-Type: text/css
2024-04-26 17:17:23 UTC	15474	IN	Data Raw: 74 64 20 7b 0d 0a 09 66 6f 6e 74 3a 20 31 31 70 78 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 3b 0d 0a 09 63 6f 6c 6f 72 3a 20 23 36 45 30 30 30 30 3b 0d 0a 7d 0d 0a 0d 0a 62 6f 64 79 20 7b 0d 0a 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 30 70 78 3b 0d 0a 09 66 6f 6e 74 3a 20 31 31 70 78 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 3b 0d 0a 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 09 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0d 0a 7d 0d 0a 0d 0a 2e 77 65 6c 63 6f 6d 65 42 61 72 20 7b 0d 0a 09 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 43 34 36 44 30 46 3b 0d 0a 09 66 6f 6e 74 2d 66 61 6d 69 Data Ascii: td {font: 11px Verdana, Arial;color: #6E0000;}body {margin-top: 0px;font: 11px Verdana, Arial;text-align: center;color: #333;background-color: white;}.welcomeBar {color: #FFFFFF;background-color: #C46D0F;font-fami

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49706	59.163.48.94	443	6164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:22 UTC	860	OUT	GET /kra-web/javascripts/jquery.min.js HTTP/1.1 Host: kra.ndml.in Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://kra.ndml.in/kra-web/MailClose.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NL01506f6b=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; JSESSIONID=03696D8317CDA0BFF28F8899498895B9.tomcat4; NL01893a59=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4
2024-04-26 17:17:23 UTC	728	IN	HTTP/1.1 200 200 Date: Fri, 26 Apr 2024 17:17:23 GMT X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes Last-Modified: Thu, 04 Apr 2024 10:20:28 GMT Content-Length: 89478 Cache-Control: max-age=2592000 Expires: Sun, 26 May 2024 17:17:23 GMT X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-WebKit-CSP: default-src 'self' X-Permitted-Cross-Domain-Policies: master-only Access-Control-Allow-Headers: ORIGIN, X-REQUESTED-WITH, CONTENT-TYPE Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Credentials: false Access-Control-Max-Age: 60000 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: User-Agent Connection: close Content-Type: application/javascript
2024-04-26 17:17:23 UTC	2152	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 35 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 Data Ascii: /! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 7c 7c 7b 7d 2c 73 3d 31 2c 75 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6c 3d 21 31 3b 66 6f 72 28 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 61 26 26 28 6c 3d 61 2c 61 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 7c 7c 7b 7d 2c 73 2b 2b 29 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 7c 7c 6d 28 61 29 7c 7c 28 61 3d 7b 7d 29 2c 73 3d 3d 3d 75 26 26 28 61 3d 74 68 69 73 2c 73 2d 2d 29 3b 73 3c 75 3b 73 2b 2b 29 69 66 28 6e 75 6c 6c 21 3d 28 65 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 29 29 66 6f 72 28 74 20 69 6e 20 65 29 72 3d 65 5b 74 5d 2c 22 5f 5f 70 72 6f 74 6f 5f 5f 22 21 3d 3d 74 26 26 61 21 3d 3d 72 26 26 28 Data Ascii: ction(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|m(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 2c 6f 2c 6e 29 29 26 26 61 2e 70 75 73 68 28 69 29 3b 65 6c 73 65 20 66 6f 72 28 6f 20 69 6e 20 65 29 6e 75 6c 6c 21 3d 28 69 3d 74 28 65 5b 6f 5d 2c 6f 2c 6e 29 29 26 26 61 2e 70 75 73 68 28 69 29 3b 72 65 74 75 72 6e 20 67 28 61 29 7d 2c 67 75 69 64 3a 31 2c 73 75 70 70 6f 72 74 3a 79 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 28 53 2e 66 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 74 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2c 53 2e 65 61 63 68 28 22 42 6f 6f 6c 65 61 6e 20 4e 75 6d 62 65 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f 6e 20 41 72 72 61 79 20 44 61 74 65 20 52 65 67 45 78 70 20 4f 62 6a 65 63 74 20 45 72 72 6f 72 20 53 79 6d 62 6f 6c 22 2e 73 70 6c 69 74 28 22 20 Data Ascii: ,o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split("
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 20 52 65 67 45 78 70 28 22 5e 3a 28 6f 6e 6c 79 7c 66 69 72 73 74 7c 6c 61 73 74 7c 6e 74 68 7c 6e 74 68 2d 6c 61 73 74 29 2d 28 63 68 69 6c 64 7c 6f 66 2d 74 79 70 65 29 28 3f 3a 5c 5c 28 22 2b 4d 2b 22 2a 28 65 76 65 6e 7c 6f 64 64 7c 28 28 5b 2b 2d 5d 7c 29 28 5c 5c 64 2a 29 6e 7c 29 22 2b 4d 2b 22 2a 28 3f 3a 28 5b 2b 2d 5d 7c 29 22 2b 4d 2b 22 2a 28 5c 5c 64 2b 29 7c 29 29 22 2b 4d 2b 22 2a 5c 5c 29 7c 29 22 2c 22 69 22 29 2c 62 6f 6f 6c 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 22 2b 52 2b 22 29 24 22 2c 22 69 22 29 2c 6e 65 65 64 73 43 6f 6e 74 65 78 74 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 2b 22 2a 5b 3e 2b 7e 5d 7c 3a 28 65 76 65 6e 7c 6f 64 64 7c 65 71 7c 67 74 7c 6c 74 7c 6e 74 68 7c 66 69 72 73 74 7c 6c 61 73 74 29 28 3f Data Ascii: RegExp("^:(only\|first\|last\|nth\|nth-last)-(child\|of-type)(?:\$"+M+"(even\|odd\|(([+-]\|)(\\d)n\|)"+M+"(?:([+-]\|)"+M+"(\\d+)\|))"+M+"\$\|)","i"),bool:new RegExp("^(?:"+R+")$","i"),needsContext:new RegExp("^"+M+"[>+~]\|:(even\|odd\|eq\|gt\|lt\|nth\|first\|last)(?
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 65 20 69 66 28 66 26 26 28 61 3d 66 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 69 29 29 26 26 79 28 65 2c 61 29 26 26 61 2e 69 64 3d 3d 3d 69 29 72 65 74 75 72 6e 20 6e 2e 70 75 73 68 28 61 29 2c 6e 7d 65 6c 73 65 7b 69 66 28 75 5b 32 5d 29 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 74 29 29 2c 6e 3b 69 66 28 28 69 3d 75 5b 33 5d 29 26 26 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 26 26 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 69 29 29 2c 6e 7d 69 66 28 64 2e 71 73 61 26 26 21 4e 5b 74 2b Data Ascii: e if(f&&(a=f.getElementById(i))&&y(e,a)&&a.id===i)return n.push(a),n}else{if(u[2])return H.apply(n,e.getElementsByTagName(t)),n;if((i=u[3])&&d.getElementsByClassName&&e.getElementsByClassName)return H.apply(n,e.getElementsByClassName(i)),n}if(d.qsa&&!N[t+
2024-04-26 17:17:23 UTC	240	IN	Data Raw: 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 6f 72 6d 22 69 6e 20 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 21 31 3d 3d 3d 65 2e 64 69 73 61 62 6c 65 64 3f 22 6c 61 62 65 6c 22 69 6e 20 65 3f 22 6c 61 62 65 6c 22 69 6e 20 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 3a 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 3a 65 2e 69 73 44 69 73 61 62 6c 65 64 3d 3d 3d 74 7c 7c 65 2e 69 73 44 69 73 61 62 6c 65 64 21 3d 3d 21 74 26 26 61 65 28 65 29 3d 3d 3d 74 3a 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 3a 22 6c 61 62 65 6c 22 69 6e 20 65 26 26 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 7d 7d 66 75 6e Data Ascii: (t){return function(e){return"form"in e?e.parentNode&&!1===e.disabled?"label"in e?"label"in e.parentNode?e.parentNode.disabled===t:e.disabled===t:e.isDisabled===t\|\|e.isDisabled!==!t&&ae(e)===t:e.disabled===t:"label"in e&&e.disabled===t}}fun
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 63 74 69 6f 6e 20 76 65 28 61 29 7b 72 65 74 75 72 6e 20 6c 65 28 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 6f 3d 2b 6f 2c 6c 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 Data Ascii: ction ve(a){return le(function(o){return o=+o,le(function(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=func
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 6e 3d 6f 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 Data Ascii: e(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((n=o.getAttributeNode("
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 64 69 73 61 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 6f 70 74 69 6f 6e 2f 3e 3c 2f 73 65 6c 65 63 74 3e 22 3b 76 61 72 20 74 3d 43 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 Data Ascii: d"),e.querySelectorAll("a#"+S+"+*").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='disabled'></a><select disabled='disabled'><option/></select>";var t=C.createElement("input")
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 74 29 3f 31 3a 75 3f 50 28 75 2c 65 29 2d 50 28 75 2c 74 29 3a 30 3a 34 26 6e 3f 2d 31 3a 31 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 65 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6c 3d 21 30 2c 30 3b 76 61 72 20 6e 2c 72 3d 30 2c 69 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 6f 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 61 3d 5b 65 5d 2c 73 3d 5b 74 5d 3b 69 66 28 21 69 7c 7c 21 6f 29 72 65 74 75 72 6e 20 65 3d 3d 43 3f 2d 31 3a 74 3d 3d 43 3f 31 3a 69 Data Ascii: t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p&&y(p,t)?1:u?P(u,e)-P(u,t):0:4&n?-1:1)}:function(e,t){if(e===t)return l=!0,0;var n,r=0,i=e.parentNode,o=t.parentNode,a=[e],s=[t];if(!i\|\|!o)return e==C?-1:t==C?1:i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49707	59.163.48.94	443	6164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:22 UTC	863	OUT	GET /kra-web/javascripts/jquery-ui.min.js HTTP/1.1 Host: kra.ndml.in Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://kra.ndml.in/kra-web/MailClose.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NL01506f6b=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4; JSESSIONID=03696D8317CDA0BFF28F8899498895B9.tomcat4; NL01893a59=01e02e5d4a671cd8a7eddad07f8fcc2adea612c85f78d00d7b299915cdcb7a9d0b451d98c6e7034edb88972c03c4699e447ca6aec4
2024-04-26 17:17:23 UTC	729	IN	HTTP/1.1 200 200 Date: Fri, 26 Apr 2024 17:17:23 GMT X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes Last-Modified: Thu, 04 Apr 2024 10:20:28 GMT Content-Length: 255089 Cache-Control: max-age=2592000 Expires: Sun, 26 May 2024 17:17:23 GMT X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-WebKit-CSP: default-src 'self' X-Permitted-Cross-Domain-Policies: master-only Access-Control-Allow-Headers: ORIGIN, X-REQUESTED-WITH, CONTENT-TYPE Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Credentials: false Access-Control-Max-Age: 60000 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: User-Agent Connection: close Content-Type: application/javascript
2024-04-26 17:17:23 UTC	5047	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 55 49 20 2d 20 76 31 2e 31 33 2e 32 20 2d 20 32 30 32 32 2d 30 37 2d 31 34 0d 0a 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 75 69 2e 63 6f 6d 0d 0a 2a 20 49 6e 63 6c 75 64 65 73 3a 20 77 69 64 67 65 74 2e 6a 73 2c 20 70 6f 73 69 74 69 6f 6e 2e 6a 73 2c 20 64 61 74 61 2e 6a 73 2c 20 64 69 73 61 62 6c 65 2d 73 65 6c 65 63 74 69 6f 6e 2e 6a 73 2c 20 65 66 66 65 63 74 2e 6a 73 2c 20 65 66 66 65 63 74 73 2f 65 66 66 65 63 74 2d 62 6c 69 6e 64 2e 6a 73 2c 20 65 66 66 65 63 74 73 2f 65 66 66 65 63 74 2d 62 6f 75 6e 63 65 2e 6a 73 2c 20 65 66 66 65 63 74 73 2f 65 66 66 65 63 74 2d 63 6c 69 70 2e 6a 73 2c 20 65 66 66 65 63 74 73 2f 65 66 66 65 63 74 2d 64 72 6f 70 2e 6a 73 2c 20 65 66 66 65 63 74 73 2f 65 66 66 65 63 74 2d 65 78 Data Ascii: /! jQuery UI - v1.13.2 - 2022-07-14 http://jqueryui.com* Includes: widget.js, position.js, data.js, disable-selection.js, effect.js, effects/effect-blind.js, effects/effect-bounce.js, effects/effect-clip.js, effects/effect-drop.js, effects/effect-ex
2024-04-26 17:17:23 UTC	2896	IN	Data Raw: 65 6e 64 28 7b 7d 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 29 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 29 69 66 28 6f 3d 7b 7d 2c 74 3d 28 69 3d 74 2e 73 70 6c 69 74 28 22 2e 22 29 29 2e 73 68 69 66 74 28 29 2c 69 2e 6c 65 6e 67 74 68 29 7b 66 6f 72 28 73 3d 6f 5b 74 5d 3d 56 2e 77 69 64 67 65 74 2e 65 78 74 65 6e 64 28 7b 7d 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 5b 74 5d 29 2c 6e 3d 30 3b 6e 3c 69 2e 6c 65 6e 67 74 68 2d 31 3b 6e 2b 2b 29 73 5b 69 5b 6e 5d 5d 3d 73 5b 69 5b 6e 5d 5d 7c 7c 7b 7d 2c 73 3d 73 5b 69 5b 6e 5d 5d 3b 69 66 28 74 3d 69 2e 70 6f 70 28 29 2c 31 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 73 5b 74 5d 3f 6e 75 6c 6c 3a 73 5b 74 5d 3b 73 5b 74 5d Data Ascii: end({},this.options);if("string"==typeof t)if(o={},t=(i=t.split(".")).shift(),i.length){for(s=o[t]=V.widget.extend({},this.options[t]),n=0;n<i.length-1;n++)s[i[n]]=s[i[n]]\|\|{},s=s[i[n]];if(t=i.pop(),1===arguments.length)return void 0===s[t]?null:s[t];s[t]
2024-04-26 17:17:23 UTC	241	IN	Data Raw: 65 73 70 61 63 65 2c 74 2e 6f 66 66 28 65 29 2c 74 68 69 73 2e 62 69 6e 64 69 6e 67 73 3d 56 28 74 68 69 73 2e 62 69 6e 64 69 6e 67 73 2e 6e 6f 74 28 74 29 2e 67 65 74 28 29 29 2c 74 68 69 73 2e 66 6f 63 75 73 61 62 6c 65 3d 56 28 74 68 69 73 2e 66 6f 63 75 73 61 62 6c 65 2e 6e 6f 74 28 74 29 2e 67 65 74 28 29 29 2c 74 68 69 73 2e 68 6f 76 65 72 61 62 6c 65 3d 56 28 74 68 69 73 2e 68 6f 76 65 72 61 62 6c 65 2e 6e 6f 74 28 74 29 2e 67 65 74 28 29 29 7d 2c 5f 64 65 6c 61 79 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 3f 69 Data Ascii: espace,t.off(e),this.bindings=V(this.bindings.not(t).get()),this.focusable=V(this.focusable.not(t).get()),this.hoverable=V(this.hoverable.not(t).get())},_delay:function(t,e){var i=this;return setTimeout(function(){return("string"==typeof t?i
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 5b 74 5d 3a 74 29 2e 61 70 70 6c 79 28 69 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 65 7c 7c 30 29 7d 2c 5f 68 6f 76 65 72 61 62 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 68 69 73 2e 68 6f 76 65 72 61 62 6c 65 3d 74 68 69 73 2e 68 6f 76 65 72 61 62 6c 65 2e 61 64 64 28 74 29 2c 74 68 69 73 2e 5f 6f 6e 28 74 2c 7b 6d 6f 75 73 65 65 6e 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 68 69 73 2e 5f 61 64 64 43 6c 61 73 73 28 56 28 74 2e 63 75 72 72 65 6e 74 54 61 72 67 65 74 29 2c 6e 75 6c 6c 2c 22 75 69 2d 73 74 61 74 65 2d 68 6f 76 65 72 22 29 7d 2c 6d 6f 75 73 65 6c 65 61 76 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 68 69 73 2e 5f 72 65 6d 6f 76 65 43 6c 61 73 73 28 56 28 74 2e 63 75 72 72 65 6e 74 54 61 72 67 65 74 29 2c 6e 75 6c 6c 2c 22 75 69 Data Ascii: [t]:t).apply(i,arguments)},e\|\|0)},_hoverable:function(t){this.hoverable=this.hoverable.add(t),this._on(t,{mouseenter:function(t){this._addClass(V(t.currentTarget),null,"ui-state-hover")},mouseleave:function(t){this._removeClass(V(t.currentTarget),null,"ui
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 74 2c 65 29 7b 72 65 74 75 72 6e 20 70 61 72 73 65 49 6e 74 28 56 2e 63 73 73 28 74 2c 65 29 2c 31 30 29 7c 7c 30 7d 66 75 6e 63 74 69 6f 6e 20 54 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 74 26 26 74 3d 3d 3d 74 2e 77 69 6e 64 6f 77 7d 78 3d 4d 61 74 68 2e 6d 61 78 2c 6b 3d 4d 61 74 68 2e 61 62 73 2c 6f 3d 2f 6c 65 66 74 7c 63 65 6e 74 65 72 7c 72 69 67 68 74 2f 2c 6c 3d 2f 74 6f 70 7c 63 65 6e 74 65 72 7c 62 6f 74 74 6f 6d 2f 2c 68 3d 2f 5b 5c 2b 5c 2d 5d 5c 64 2b 28 5c 2e 5b 5c 64 5d 2b 29 3f 25 3f 2f 2c 63 3d 2f 5e 5c 77 2b 2f 2c 75 3d 2f 25 24 2f 2c 43 3d 56 2e 66 6e 2e 70 6f 73 69 74 69 6f 6e 2c 56 2e 70 6f 73 69 74 69 6f 6e 3d 7b 73 63 72 6f 6c 6c 62 61 72 57 69 64 74 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 76 6f 69 64 20 30 21 3d Data Ascii: t,e){return parseInt(V.css(t,e),10)\|\|0}function T(t){return null!=t&&t===t.window}x=Math.max,k=Math.abs,o=/left\|center\|right/,l=/top\|center\|bottom/,h=/[\+\-]\d+(\.[\d]+)?%?/,c=/^\w+/,u=/%$/,C=V.fn.position,V.position={scrollbarWidth:function(){if(void 0!=
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 65 3d 39 3d 3d 3d 28 74 3d 28 65 3d 5f 29 5b 30 5d 29 2e 6e 6f 64 65 54 79 70 65 3f 7b 77 69 64 74 68 3a 65 2e 77 69 64 74 68 28 29 2c 68 65 69 67 68 74 3a 65 2e 68 65 69 67 68 74 28 29 2c 6f 66 66 73 65 74 3a 7b 74 6f 70 3a 30 2c 6c 65 66 74 3a 30 7d 7d 3a 54 28 74 29 3f 7b 77 69 64 74 68 3a 65 2e 77 69 64 74 68 28 29 2c 68 65 69 67 68 74 3a 65 2e 68 65 69 67 68 74 28 29 2c 6f 66 66 73 65 74 3a 7b 74 6f 70 3a 65 2e 73 63 72 6f 6c 6c 54 6f 70 28 29 2c 6c 65 66 74 3a 65 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 7d 7d 3a 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 3f 7b 77 69 64 74 68 3a 30 2c 68 65 69 67 68 74 3a 30 2c 6f 66 66 73 65 74 3a 7b 74 6f 70 3a 74 2e 70 61 67 65 59 2c 6c 65 66 74 3a 74 2e 70 61 67 65 58 7d 7d 3a 7b 77 69 64 74 68 3a 65 2e 6f 75 Data Ascii: e=9===(t=(e=_)[0]).nodeType?{width:e.width(),height:e.height(),offset:{top:0,left:0}}:T(t)?{width:e.width(),height:e.height(),offset:{top:e.scrollTop(),left:e.scrollLeft()}}:t.preventDefault?{width:0,height:0,offset:{top:t.pageY,left:t.pageX}}:{width:e.ou
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 70 2c 74 61 72 67 65 74 48 65 69 67 68 74 3a 66 2c 65 6c 65 6d 57 69 64 74 68 3a 72 2c 65 6c 65 6d 48 65 69 67 68 74 3a 6c 2c 63 6f 6c 6c 69 73 69 6f 6e 50 6f 73 69 74 69 6f 6e 3a 69 2c 63 6f 6c 6c 69 73 69 6f 6e 57 69 64 74 68 3a 6e 2c 63 6f 6c 6c 69 73 69 6f 6e 48 65 69 67 68 74 3a 6f 2c 6f 66 66 73 65 74 3a 5b 64 5b 30 5d 2b 63 5b 30 5d 2c 64 5b 31 5d 2b 63 5b 31 5d 5d 2c 6d 79 3a 75 2e 6d 79 2c 61 74 3a 75 2e 61 74 2c 77 69 74 68 69 6e 3a 76 2c 65 6c 65 6d 3a 61 7d 29 7d 29 2c 75 2e 75 73 69 6e 67 26 26 28 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 67 2e 6c 65 66 74 2d 68 2e 6c 65 66 74 2c 69 3d 65 2b 70 2d 72 2c 73 3d 67 2e 74 6f 70 2d 68 2e 74 6f 70 2c 6e 3d 73 2b 66 2d 6c 2c 6f 3d 7b 74 61 72 67 65 74 3a 7b 65 6c 65 6d 65 6e 74 3a Data Ascii: p,targetHeight:f,elemWidth:r,elemHeight:l,collisionPosition:i,collisionWidth:n,collisionHeight:o,offset:[d[0]+c[0],d[1]+c[1]],my:u.my,at:u.at,within:v,elem:a})}),u.using&&(t=function(t){var e=g.left-h.left,i=e+p-r,s=g.top-h.top,n=s+f-l,o={target:{element:
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 65 74 2e 6c 65 66 74 2c 61 3d 74 2e 6c 65 66 74 2d 65 2e 63 6f 6c 6c 69 73 69 6f 6e 50 6f 73 69 74 69 6f 6e 2e 6d 61 72 67 69 6e 4c 65 66 74 2c 72 3d 61 2d 6f 2c 6c 3d 61 2b 65 2e 63 6f 6c 6c 69 73 69 6f 6e 57 69 64 74 68 2d 6e 2d 6f 2c 68 3d 22 6c 65 66 74 22 3d 3d 3d 65 2e 6d 79 5b 30 5d 3f 2d 65 2e 65 6c 65 6d 57 69 64 74 68 3a 22 72 69 67 68 74 22 3d 3d 3d 65 2e 6d 79 5b 30 5d 3f 65 2e 65 6c 65 6d 57 69 64 74 68 3a 30 2c 69 3d 22 6c 65 66 74 22 3d 3d 3d 65 2e 61 74 5b 30 5d 3f 65 2e 74 61 72 67 65 74 57 69 64 74 68 3a 22 72 69 67 68 74 22 3d 3d 3d 65 2e 61 74 5b 30 5d 3f 2d 65 2e 74 61 72 67 65 74 57 69 64 74 68 3a 30 2c 61 3d 2d 32 2a 65 2e 6f 66 66 73 65 74 5b 30 5d 3b 72 3c 30 3f 28 28 73 3d 74 2e 6c 65 66 74 2b 68 2b 69 2b 61 2b 65 2e 63 6f 6c 6c Data Ascii: et.left,a=t.left-e.collisionPosition.marginLeft,r=a-o,l=a+e.collisionWidth-n-o,h="left"===e.my[0]?-e.elemWidth:"right"===e.my[0]?e.elemWidth:0,i="left"===e.at[0]?e.targetWidth:"right"===e.at[0]?-e.targetWidth:0,a=-2*e.offset[0];r<0?((s=t.left+h+i+a+e.coll
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 76 65 6e 74 44 65 66 61 75 6c 74 28 29 7d 29 7d 29 2c 65 6e 61 62 6c 65 53 65 6c 65 63 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6f 66 66 28 22 2e 75 69 2d 64 69 73 61 62 6c 65 53 65 6c 65 63 74 69 6f 6e 22 29 7d 7d 29 3b 76 61 72 20 74 2c 64 3d 56 2c 70 3d 7b 7d 2c 65 3d 70 2e 74 6f 53 74 72 69 6e 67 2c 66 3d 2f 5e 28 5b 5c 2d 2b 5d 29 3d 5c 73 2a 28 5c 64 2b 5c 2e 3f 5c 64 2a 29 2f 2c 67 3d 5b 7b 72 65 3a 2f 72 67 62 61 3f 5c 28 5c 73 2a 28 5c 64 7b 31 2c 33 7d 29 5c 73 2a 2c 5c 73 2a 28 5c 64 7b 31 2c 33 7d 29 5c 73 2a 2c 5c 73 2a 28 5c 64 7b 31 2c 33 7d 29 5c 73 2a 28 3f 3a 2c 5c 73 2a 28 5c 64 3f 28 3f 3a 5c 2e 5c 64 2b 29 3f 29 5c 73 2a 29 3f 5c 29 2f 2c 70 61 72 73 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b Data Ascii: ventDefault()})}),enableSelection:function(){return this.off(".ui-disableSelection")}});var t,d=V,p={},e=p.toString,f=/^([\-+])=\s(\d+\.?\d)/,g=[{re:/rgba?$\s(\d{1,3})\s,\s(\d{1,3})\s,\s(\d{1,3})\s(?:,\s(\d?(?:\.\d+)?)\s)?$/,parse:function(t){
2024-04-26 17:17:23 UTC	1448	IN	Data Raw: 6f 66 20 74 3f 70 5b 65 2e 63 61 6c 6c 28 74 29 5d 7c 7c 22 6f 62 6a 65 63 74 22 3a 74 79 70 65 6f 66 20 74 7d 66 75 6e 63 74 69 6f 6e 20 4d 28 74 2c 65 2c 69 29 7b 76 61 72 20 73 3d 76 5b 65 2e 74 79 70 65 5d 7c 7c 7b 7d 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 69 7c 7c 21 65 2e 64 65 66 3f 6e 75 6c 6c 3a 65 2e 64 65 66 3a 28 74 3d 73 2e 66 6c 6f 6f 72 3f 7e 7e 74 3a 70 61 72 73 65 46 6c 6f 61 74 28 74 29 2c 69 73 4e 61 4e 28 74 29 3f 65 2e 64 65 66 3a 73 2e 6d 6f 64 3f 28 74 2b 73 2e 6d 6f 64 29 25 73 2e 6d 6f 64 3a 4d 61 74 68 2e 6d 69 6e 28 73 2e 6d 61 78 2c 4d 61 74 68 2e 6d 61 78 28 30 2c 74 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 53 28 73 29 7b 76 61 72 20 6e 3d 6d 28 29 2c 6f 3d 6e 2e 5f 72 67 62 61 3d 5b 5d 3b 72 65 74 75 72 6e 20 73 3d 73 Data Ascii: of t?p[e.call(t)]\|\|"object":typeof t}function M(t,e,i){var s=v[e.type]\|\|{};return null==t?i\|\|!e.def?null:e.def:(t=s.floor?~~t:parseFloat(t),isNaN(t)?e.def:s.mod?(t+s.mod)%s.mod:Math.min(s.max,Math.max(0,t)))}function S(s){var n=m(),o=n._rgba=[];return s=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49715	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:31 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 17:17:31 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=49574 Date: Fri, 26 Apr 2024 17:17:31 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49716	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:31 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 17:17:32 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=49567 Date: Fri, 26 Apr 2024 17:17:32 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 17:17:32 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49717	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:32 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pc1WpNHhOrX8rdE&MD=babuuHWv HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 17:17:33 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 30722023-3721-4b5e-bf40-9d8529a900d8 MS-RequestId: 7f6643f5-f9ad-43ef-aae9-b6c26cf26764 MS-CV: IEsRstuRnUq1c5Hh.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:17:32 GMT Connection: close Content-Length: 24490
2024-04-26 17:17:33 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 17:17:33 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49718	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:18:10 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pc1WpNHhOrX8rdE&MD=babuuHWv HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 17:18:11 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: d896fd70-0894-41ab-93fc-caf200914445 MS-RequestId: e19e908e-9fcd-4cff-ac32-44b5edb7cdd2 MS-CV: jl8BdbzdFkyeG9xH.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:18:10 GMT Connection: close Content-Length: 25457
2024-04-26 17:18:11 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 17:18:11 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49721	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:18:48 UTC	567	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:18:49 UTC	1703	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:18:49 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Q5UIvVT70MFkFFKnbjyAnQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:18:49 UTC	1703	IN	Data Raw: 61 32 36 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 72 65 6d 69 65 72 20 6c 65 61 67 75 65 22 2c 22 68 6f 75 73 65 68 6f 6c 64 20 63 61 76 61 6c 72 79 20 68 6f 72 73 65 73 20 6c 6f 6e 64 6f 6e 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 61 70 72 69 6c 20 32 36 22 2c 22 66 61 6c 6c 6f 75 74 20 34 20 6e 65 78 74 20 67 65 6e 20 75 70 64 61 74 65 22 2c 22 62 72 69 73 74 6f 6c 20 6d 79 65 72 73 20 73 71 75 69 62 62 20 6c 61 79 6f 66 66 73 22 2c 22 63 68 69 63 61 67 6f 20 62 65 61 72 73 20 64 72 61 66 74 20 63 61 6c 65 62 20 77 69 6c 6c 69 61 6d 73 22 2c 22 61 62 72 61 6d 73 20 74 61 6e 6b 73 22 2c 22 70 75 7a 7a 6c 65 20 6e 79 74 20 63 72 6f 73 73 77 6f 72 64 20 63 6c 75 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c Data Ascii: a26)]}'["",["premier league","household cavalry horses london","nyt connections hints april 26","fallout 4 next gen update","bristol myers squibb layoffs","chicago bears draft caleb williams","abrams tanks","puzzle nyt crossword clue"],["","","","","",
2024-04-26 17:18:49 UTC	902	IN	Data Raw: 52 7a 51 7a 6c 53 5a 6c 46 44 55 31 6c 6f 61 54 64 69 51 30 31 74 62 6e 42 49 51 58 46 43 52 54 52 53 52 6d 4a 32 4b 33 5a 4a 63 54 5a 4e 57 6b 46 78 65 53 39 57 64 56 6c 42 61 55 68 31 4d 69 74 7a 65 45 5a 59 59 56 70 50 4e 56 56 49 56 44 56 52 53 45 6c 49 56 79 39 45 4d 56 4e 58 4f 48 4d 30 62 6b 78 78 4e 57 6c 6f 62 45 68 32 65 56 64 53 53 6c 64 44 62 44 51 79 51 58 68 57 55 57 74 72 62 6b 68 50 4d 45 38 34 56 6b 35 34 54 45 31 77 64 45 78 54 64 48 4e 36 5a 6c 64 36 61 45 74 5a 55 32 68 59 5a 30 52 70 54 56 55 7a 62 6d 39 70 65 46 42 47 4d 33 42 4f 4d 44 6c 4e 55 57 56 77 61 6d 74 68 4b 32 64 52 55 58 56 79 54 33 63 31 55 31 4d 78 53 55 6c 56 59 56 56 77 61 58 67 34 55 6a 52 59 65 55 78 76 61 7a 52 6a 4e 6b 31 73 63 54 52 52 65 47 5a 59 61 44 4e 46 4d Data Ascii: RzQzlSZlFDU1loaTdiQ01tbnBIQXFCRTRSRmJ2K3ZJcTZNWkFxeS9WdVlBaUh1MitzeEZYYVpPNVVIVDVRSElIVy9EMVNXOHM0bkxxNWlobEh2eVdSSldDbDQyQXhWUWtrbkhPME84Vk54TE1wdExTdHN6Zld6aEtZU2hYZ0RpTVUzbm9peFBGM3BOMDlNUWVwamthK2dRUXVyT3c1U1MxSUlVYVVwaXg4UjRYeUxvazRjNk1scTRReGZYaDNFM
2024-04-26 17:18:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49722	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:18:48 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49725	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:18:48 UTC	470	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:18:49 UTC	1843	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGPnDr7EGIjBmzD6XKne16sxc7aHb3W-_JuZBXg9GdeRJ5dqb22OPbS63K98czF4n9otYLEAd3dAyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI-cOvsQYQotXHswISBGaBmNw Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 17:18:49 GMT Server: gws Content-Length: 458 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-17; expires=Sun, 26-May-2024 17:18:49 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=jcu3EtVbSHR6kL3b5EFYZHRUW4QpUZ_Aq652jhGIof5j_95LJDYZC31Yb-nuCdOWf2c51F4xU5YF7YeAn5_tUHUCQXbaq_BqxMr81hhHgjOXdAfhL8FD8uNz_MGKuWTOQP41O7dPpNqOH6qa4C_2Md3eWsfOH8pYKiRHYsvSNs4; expires=Sat, 26-Oct-2024 17:18:49 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:18:49 UTC	458	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49724	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:18:50 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:18:50 UTC	1761	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGPrDr7EGIjA51nBO0ouJB96IkrPObbeH40esAxTUWJYDSH_tpPv7r8GIlnQ1bntE4rLxvVsQBtUyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI-sOvsQYQjvCO9AISBGaBmNw Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 17:18:50 GMT Server: gws Content-Length: 417 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-17; expires=Sun, 26-May-2024 17:18:50 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; expires=Sat, 26-Oct-2024 17:18:50 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:18:50 UTC	417	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49726	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:18:50 UTC	872	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGPnDr7EGIjBmzD6XKne16sxc7aHb3W-_JuZBXg9GdeRJ5dqb22OPbS63K98czF4n9otYLEAd3dAyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-17; NID=513=jcu3EtVbSHR6kL3b5EFYZHRUW4QpUZ_Aq652jhGIof5j_95LJDYZC31Yb-nuCdOWf2c51F4xU5YF7YeAn5_tUHUCQXbaq_BqxMr81hhHgjOXdAfhL8FD8uNz_MGKuWTOQP41O7dPpNqOH6qa4C_2Md3eWsfOH8pYKiRHYsvSNs4
2024-04-26 17:18:50 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 17:18:50 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3186 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:18:50 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 3f 68 6c 3d 65 6e 2d 55 53 26 61 6d 70 3b 61 73 79 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_ogb?hl=en-US&asy
2024-04-26 17:18:50 UTC	1255	IN	Data Raw: 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 76 59 67 43 72 32 6b 68 55 Data Ascii: <script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="vYgCr2khU
2024-04-26 17:18:50 UTC	1032	IN	Data Raw: 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 Data Ascii: ; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly aft

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49727	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:18:51 UTC	738	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGPrDr7EGIjA51nBO0ouJB96IkrPObbeH40esAxTUWJYDSH_tpPv7r8GIlnQ1bntE4rLxvVsQBtUyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A
2024-04-26 17:18:51 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 17:18:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3114 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:18:51 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_promos</title></head
2024-04-26 17:18:51 UTC	1255	IN	Data Raw: 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 72 4b 59 72 39 76 6c 45 4a 6c 33 49 51 4b 32 6d 6b 53 73 4b 37 77 50 69 65 75 6a 6c 59 74 4a 64 75 Data Ascii: ack = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="rKYr9vlEJl3IQK2mkSsK7wPieujlYtJdu
2024-04-26 17:18:51 UTC	960	IN	Data Raw: 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e Data Ascii: ogle automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solvin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49728	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:18:54 UTC	764	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49729	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:18:58 UTC	1268	OUT	GET /search?q=nyt+connections+hints+april+26&oq=&gs_lcrp=EgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A
2024-04-26 17:18:59 UTC	2160	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIgsSvsQYQuObX1gMSBGaBmNw Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-W1iSz8wi6t5bCgP8pXPZ_A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Fri, 26 Apr 2024 17:18:58 GMT Server: gws Content-Length: 729 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-17; expires=Sun, 26-May-2024 17:18:58 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww; expires=Wed, 23-Oct-2024 17:18:58 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:18:59 UTC	729	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 25 33 46 71 25 33 44 6e 79 74 25 32 42 63 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49733	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:18:59 UTC	1534	OUT	GET /sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
2024-04-26 17:18:59 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 17:18:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 4014 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:18:59 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 6e 79 74 2b 63 6f 6e 6e 65 63 74 69 6f 6e 73 2b 68 69 6e 74 73 2b 61 70 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/search?q=nyt+connections+hints+ap
2024-04-26 17:18:59 UTC	1255	IN	Data Raw: 6f 6c 6f 72 3a 23 63 63 63 3b 22 3e 3c 62 72 3e 0a 3c 66 6f 72 6d 20 69 64 3d 22 63 61 70 74 63 68 61 2d 66 6f 72 6d 22 20 61 63 74 69 6f 6e 3d 22 69 6e 64 65 78 22 20 6d 65 74 68 6f 64 3d 22 70 6f 73 74 22 3e 0a 3c 6e 6f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 22 3e 0a 20 20 49 6e 20 6f 72 64 65 72 20 74 6f 20 63 6f 6e 74 69 6e 75 65 2c 20 70 6c 65 61 73 65 20 65 6e 61 62 6c 65 20 6a 61 76 61 73 63 72 69 70 74 20 6f 6e 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 2e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 22 20 Data Ascii: olor:#ccc;"><br><form id="captcha-form" action="index" method="post"><noscript><div style="font-size:13px;"> In order to continue, please enable javascript on your web browser.</div></noscript><script src="https://www.google.com/recaptcha/api.js"
2024-04-26 17:18:59 UTC	1255	IN	Data Raw: 41 47 41 4d 59 51 68 69 50 41 52 6a 71 41 6a 49 4f 43 41 59 51 41 42 67 44 47 45 49 59 6a 77 45 59 36 67 49 79 44 67 67 48 45 41 41 59 41 78 68 43 47 49 38 42 47 4f 6f 43 30 67 45 4b 4d 6a 45 7a 4d 44 45 32 61 6a 42 71 4e 36 67 43 43 4c 41 43 41 51 26 61 6d 70 3b 73 6f 75 72 63 65 69 64 3d 63 68 72 6f 6d 65 26 61 6d 70 3b 69 65 3d 55 54 46 2d 38 22 3e 0a 3c 2f 66 6f 72 6d 3e 0a 3c 68 72 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 63 63 63 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 63 63 63 3b 22 3e 0a 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 22 3e 0a 3c 62 3e 41 62 6f 75 74 20 74 68 69 73 20 70 61 67 65 3c 2f 62 3e 3c 62 72 3e 3c 62 72 3e 0a 54 Data Ascii: AGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8"></form><hr noshade size="1" style="color:#ccc; background-color:#ccc;"><div style="font-size:13px;"><b>About this page</b><br><br>T
2024-04-26 17:18:59 UTC	605	IN	Data Raw: 61 3e 3c 62 72 3e 3c 62 72 3e 53 6f 6d 65 74 69 6d 65 73 20 79 6f 75 20 6d 61 79 20 62 65 20 61 73 6b 65 64 20 74 6f 20 73 6f 6c 76 65 20 74 68 65 20 43 41 50 54 43 48 41 20 69 66 20 79 6f 75 20 61 72 65 20 75 73 69 6e 67 20 61 64 76 61 6e 63 65 64 20 74 65 72 6d 73 20 74 68 61 74 20 72 6f 62 6f 74 73 20 61 72 65 20 6b 6e 6f 77 6e 20 74 6f 20 75 73 65 2c 20 6f 72 20 73 65 6e 64 69 6e 67 20 72 65 71 75 65 73 74 73 20 76 65 72 79 20 71 75 69 63 6b 6c 79 2e 0a 3c 2f 64 69 76 3e 0a 0a 49 50 20 61 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 3c 62 72 3e 54 69 6d 65 3a 20 32 30 32 34 2d 30 34 2d 32 36 54 31 37 3a 31 38 3a 35 39 5a 3c 62 72 3e 55 52 4c 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 Data Ascii: a><br><br>Sometimes you may be asked to solve the CAPTCHA if you are using advanced terms that robots are known to use, or sending requests very quickly.</div>IP address: 102.129.152.220<br>Time: 2024-04-26T17:18:59Z<br>URL: https://www.google.com/sear

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49734	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:19:00 UTC	1406	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
2024-04-26 17:19:00 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Fri, 26 Apr 2024 17:19:00 GMT Date: Fri, 26 Apr 2024 17:19:00 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:19:00 UTC	727	IN	Data Raw: 34 63 36 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 4c6/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-04-26 17:19:00 UTC	502	IN	Data Raw: 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 3b 70 6f 2e 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 30 6c 4a 6b 4f 56 48 44 79 33 49 74 59 6c 43 62 55 Data Ascii: cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-0lJkOVHDy3ItYlCbU
2024-04-26 17:19:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49739	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:19:03 UTC	2013	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=vWL3XR6bUxdvXanjzgKCgEt4BUdQ4faUZ9Hnj8aS-3-I55LEIZ4AYvRhGF-wJSM497bhMMi52MYWcmCCXHI_W3F1uUVELfHlotpkbgfWfTqXneZbsfP8lNgHpqjdt32JzCYWCogb8S4GDGOKi2_FqBdw1G6eHa_FuOQO_745xd_Cb-V36fiU5wtVD--4aQ1epOhrkAO5VwPc9DGOs7XJ95I31mVj0aQxbkIqaSvlgxg2hcXt0VcsvAkVfMDCxi0tb5XOXpjc8Yx6DdUdyvYmz4Qy0VF2FW0&cb=x31kv38olxs4 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
2024-04-26 17:19:03 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Apr 2024 17:19:03 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-hPXxWS96_EOQ8VIHkPXElw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:19:03 UTC	364	IN	Data Raw: 36 33 30 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 6306<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-04-26 17:19:03 UTC	1255	IN	Data Raw: 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 Data Ascii: 18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//font
2024-04-26 17:19:03 UTC	1255	IN	Data Raw: 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 Data Ascii: 0AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00
2024-04-26 17:19:03 UTC	1255	IN	Data Raw: 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 Data Ascii: +04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-26 17:19:03 UTC	1255	IN	Data Raw: 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 Data Ascii: e { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0
2024-04-26 17:19:03 UTC	1255	IN	Data Raw: 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a Data Ascii: ic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2024-04-26 17:19:03 UTC	1255	IN	Data Raw: 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 68 50 58 78 57 53 39 36 5f 45 4f 51 38 56 49 48 6b 50 58 45 6c 77 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d Data Ascii: </style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css"><script nonce="hPXxWS96_EOQ8VIHkPXElw" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com
2024-04-26 17:19:03 UTC	1255	IN	Data Raw: 6e 67 77 56 4a 46 4a 45 67 58 57 50 72 5f 4d 34 6f 4b 5f 69 73 30 36 4c 56 64 35 68 38 63 4f 76 70 48 59 73 32 39 6a 31 52 48 4d 58 45 50 57 53 61 63 5a 79 65 6c 4a 70 51 79 2d 6f 7a 41 48 67 50 6e 4b 66 35 68 6d 30 47 47 45 65 76 39 38 44 65 61 4e 32 71 44 34 30 78 46 33 32 30 43 77 64 46 5a 4f 79 53 31 55 39 7a 46 4a 32 6f 57 38 37 2d 5f 5a 71 68 34 68 70 52 45 43 66 59 6e 77 50 6d 37 44 5f 6b 67 5a 64 66 4e 57 49 76 34 6c 78 55 4c 70 73 75 51 48 43 5a 6e 36 4e 57 5a 4a 7a 76 67 41 64 4b 45 34 30 46 74 46 70 32 5f 30 52 76 6f 65 57 49 4e 2d 35 46 31 4b 30 52 4b 32 2d 6a 62 45 36 50 6f 57 6c 47 4a 67 5a 77 39 46 30 2d 34 77 4d 51 63 48 52 57 41 7a 79 37 59 72 38 58 45 33 72 37 7a 55 36 6c 67 77 6c 5a 4d 56 4b 6a 61 46 7a 32 43 63 57 49 39 69 7a 31 6e 32 Data Ascii: ngwVJFJEgXWPr_M4oK_is06LVd5h8cOvpHYs29j1RHMXEPWSacZyelJpQy-ozAHgPnKf5hm0GGEev98DeaN2qD40xF320CwdFZOyS1U9zFJ2oW87-_Zqh4hpRECfYnwPm7D_kgZdfNWIv4lxULpsuQHCZn6NWZJzvgAdKE40FtFp2_0RvoeWIN-5F1K0RK2-jbE6PoWlGJgZw9F0-4wMQcHRWAzy7Yr8XE3r7zU6lgwlZMVKjaFz2CcWI9iz1n2
2024-04-26 17:19:03 UTC	1255	IN	Data Raw: 7a 67 31 50 43 39 5a 4d 59 65 69 4e 54 4d 4c 4e 56 73 6c 5f 39 58 68 66 76 6c 75 75 32 4b 79 6b 52 6b 56 30 48 43 4b 2d 67 44 46 4c 33 34 41 73 6c 44 39 63 39 34 5f 4f 62 31 6b 54 61 53 75 34 77 65 45 57 69 59 4f 46 4e 34 57 68 59 36 61 54 43 61 36 46 48 65 74 44 63 70 74 36 4b 75 46 32 51 6c 46 56 43 55 49 4b 53 45 51 6e 5a 58 46 78 63 49 36 30 39 5f 54 4f 78 56 68 66 57 6d 66 30 33 70 7a 46 6c 70 32 41 69 4d 76 42 56 64 46 38 70 71 4e 47 62 44 6b 63 72 64 4e 4a 34 6c 71 4c 56 36 41 76 42 65 51 58 36 33 45 6a 6e 32 54 31 54 4e 55 79 32 52 37 38 33 34 5a 6e 77 2d 38 6a 45 56 31 58 32 48 47 61 6b 41 4d 4b 73 50 61 54 59 46 71 58 54 69 51 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d Data Ascii: zg1PC9ZMYeiNTMLNVsl_9Xhfvluu2KykRkV0HCK-gDFL34AslD9c94_Ob1kTaSu4weEWiYOFN4WhY6aTCa6FHetDcpt6KuF2QlFVCUIKSEQnZXFxcI609_TOxVhfWmf03pzFlp2AiMvBVdF8pqNGbDkcrdNJ4lqLV6AvBeQX63Ejn2T1TNUy2R7834Znw-8jEV1X2HGakAMKsPaTYFqXTiQ"><script type="text/javascript" nonce=
2024-04-26 17:19:03 UTC	1255	IN	Data Raw: 52 49 51 54 64 6b 63 55 70 6a 4b 7a 52 6d 64 31 42 56 52 32 4a 35 62 47 74 76 62 31 6c 50 4e 6e 52 68 59 30 45 72 63 47 70 6a 61 30 64 58 64 44 46 55 61 58 70 31 55 55 49 32 54 55 4a 52 61 6c 5a 57 57 54 4e 61 5a 6a 6c 75 65 58 55 76 4e 45 34 78 4c 30 31 70 62 6c 56 4e 62 32 78 71 52 44 64 55 55 6e 4a 46 4e 31 52 50 62 58 46 54 54 44 68 70 65 6b 4e 78 56 56 52 55 65 57 68 6e 4d 30 64 72 64 57 31 71 62 6c 6f 34 4f 45 70 45 64 58 5a 58 59 30 52 70 56 47 4a 6a 4e 33 5a 46 52 31 4e 6f 64 6d 78 69 64 32 70 59 56 55 78 57 55 47 39 54 4e 58 45 32 65 6b 74 45 62 6c 56 74 64 32 64 6f 61 32 70 4d 62 55 70 55 63 57 39 52 4e 45 78 72 4d 47 68 43 55 58 68 42 57 6b 31 56 65 48 68 48 51 32 56 34 52 6e 68 44 62 54 63 78 64 54 52 4e 59 55 39 6a 54 7a 4e 55 5a 31 4a 75 63 Data Ascii: RIQTdkcUpjKzRmd1BVR2J5bGtvb1lPNnRhY0ErcGpja0dXdDFUaXp1UUI2TUJRalZWWTNaZjlueXUvNE4xL01pblVNb2xqRDdUUnJFN1RPbXFTTDhpekNxVVRUeWhnM0drdW1qblo4OEpEdXZXY0RpVGJjN3ZFR1Nodmxid2pYVUxWUG9TNXE2ektEblVtd2doa2pMbUpUcW9RNExrMGhCUXhBWk1VeHhHQ2V4RnhDbTcxdTRNYU9jTzNUZ1Juc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49745	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:19:05 UTC	1409	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=vWL3XR6bUxdvXanjzgKCgEt4BUdQ4faUZ9Hnj8aS-3-I55LEIZ4AYvRhGF-wJSM497bhMMi52MYWcmCCXHI_W3F1uUVELfHlotpkbgfWfTqXneZbsfP8lNgHpqjdt32JzCYWCogb8S4GDGOKi2_FqBdw1G6eHa_FuOQO_745xd_Cb-V36fiU5wtVD--4aQ1epOhrkAO5VwPc9DGOs7XJ95I31mVj0aQxbkIqaSvlgxg2hcXt0VcsvAkVfMDCxi0tb5XOXpjc8Yx6DdUdyvYmz4Qy0VF2FW0&cb=x31kv38olxs4 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
2024-04-26 17:19:05 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Fri, 26 Apr 2024 17:19:05 GMT Date: Fri, 26 Apr 2024 17:19:05 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:19:05 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js');
2024-04-26 17:19:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49747	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:19:05 UTC	1397	OUT	GET /js/bg/lkTXq49YG5_ej1w7m4T9Nw_1Lx1Ocd1gteWQpsfV_Tk.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&s=vWL3XR6bUxdvXanjzgKCgEt4BUdQ4faUZ9Hnj8aS-3-I55LEIZ4AYvRhGF-wJSM497bhMMi52MYWcmCCXHI_W3F1uUVELfHlotpkbgfWfTqXneZbsfP8lNgHpqjdt32JzCYWCogb8S4GDGOKi2_FqBdw1G6eHa_FuOQO_745xd_Cb-V36fiU5wtVD--4aQ1epOhrkAO5VwPc9DGOs7XJ95I31mVj0aQxbkIqaSvlgxg2hcXt0VcsvAkVfMDCxi0tb5XOXpjc8Yx6DdUdyvYmz4Qy0VF2FW0&cb=x31kv38olxs4 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
2024-04-26 17:19:05 UTC	811	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18268 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 25 Apr 2024 17:40:07 GMT Expires: Fri, 25 Apr 2025 17:40:07 GMT Cache-Control: public, max-age=31536000 Age: 85138 Last-Modified: Tue, 16 Apr 2024 13:30:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:19:05 UTC	444	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 66 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 69 66 28 21 28 4e 3d 28 52 3d 65 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 6e 75 6c 6c 29 2c 52 29 7c 7c 21 52 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 4e 3b 74 72 79 7b 4e 3d 52 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 70 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 70 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 70 7d Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var f=function(R,N){if(!(N=(R=e.trustedTypes,null),R)\|\|!R.createPolicy)return N;try{N=R.createPolicy("bg",{createHTML:p,createScript:p,createScriptURL:p}
2024-04-26 17:19:05 UTC	1255	IN	Data Raw: 65 61 74 65 53 63 72 69 70 74 28 50 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 50 29 7b 72 65 74 75 72 6e 22 22 2b 50 7d 7d 28 65 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 5b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 27 2c 0a 27 27 2c 0a 27 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 52 65 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 72 65 74 75 72 6e 20 52 5b 4e 5d 3c 3c 32 34 7c 52 5b 28 4e 7c 30 29 2b 31 5d 3c 3c 31 36 7c 52 5b 28 4e 7c 30 29 2b 32 5d 3c 3c 38 7c 52 5b 28 4e 7c 30 29 2b 33 5d 7d 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 29 7b 69 66 28 34 33 38 3d Data Ascii: eateScript(P)}:function(P){return""+P}}(e)(Array(7824Math.random()\|0).join("\n")+['(function(){/','',' SPDX-License-Identifier: Apache-2.0','*/','var Re=function(R,N){return R[N]<<24\|R[(N\|0)+1]<<16\|R[(N\|0)+2]<<8\|R[(N\|0)+3]},d=function(R,N,p){if(438=
2024-04-26 17:19:05 UTC	1255	IN	Data Raw: 67 5b 77 5d 2c 52 29 3b 72 65 74 75 72 6e 20 4e 7d 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 66 6f 72 28 4e 3d 5b 5d 3b 52 2d 2d 3b 29 4e 2e 70 75 73 68 28 32 35 35 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 3b 72 65 74 75 72 6e 20 4e 7d 2c 5a 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 28 4e 3d 4e 2e 58 5b 52 5d 2c 4e 29 29 74 68 72 6f 77 5b 4d 2c 33 30 2c 52 5d 3b 69 66 28 4e 2e 76 61 6c 75 65 29 72 65 74 75 72 6e 20 4e 2e 63 72 65 61 74 65 28 29 3b 72 65 74 75 72 6e 28 4e 2e 63 72 65 61 74 65 28 33 2a 52 2a 52 2b 32 31 2a 52 2b 2d 33 34 29 2c 4e 29 2e 70 72 6f 74 6f 74 79 70 65 7d 2c 50 52 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 2c 65 2c 77 2c 54 2c 6b 2c 50 29 7b 72 65 74 75 72 6e 20 50 3d 28 Data Ascii: g[w],R);return N},c=function(R,N){for(N=[];R--;)N.push(255Math.random()\|0);return N},Z=function(R,N){if(void 0===(N=N.X[R],N))throw[M,30,R];if(N.value)return N.create();return(N.create(3RR+21R+-34),N).prototype},PR=function(R,N,p,e,w,T,k,P){return P=(
2024-04-26 17:19:05 UTC	1255	IN	Data Raw: 2e 67 69 3d 66 2c 32 5d 5d 2c 66 29 3c 3c 33 29 2d 34 3b 74 72 79 7b 54 2e 63 4f 3d 74 41 28 52 65 28 54 2c 28 66 7c 30 29 2b 34 29 2c 52 65 28 54 2c 66 29 2c 79 29 7d 63 61 74 63 68 28 61 29 7b 74 68 72 6f 77 20 61 3b 7d 7d 54 2e 70 75 73 68 28 54 2e 63 4f 5b 50 26 37 5d 5e 6b 29 7d 2c 77 3d 5a 28 35 39 2c 4e 29 29 3a 52 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 54 2e 70 75 73 68 28 6b 29 7d 2c 65 26 26 52 28 65 26 32 35 35 29 2c 4e 3d 70 2e 6c 65 6e 67 74 68 2c 65 3d 30 3b 65 3c 4e 3b 65 2b 2b 29 52 28 70 5b 65 5d 29 7d 2c 45 2c 56 30 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 28 70 3d 74 79 70 65 6f 66 20 52 2c 70 29 29 69 66 28 52 29 7b 69 66 28 52 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 72 65 Data Ascii: .gi=f,2]],f)<<3)-4;try{T.cO=tA(Re(T,(f\|0)+4),Re(T,f),y)}catch(a){throw a;}}T.push(T.cO[P&7]^k)},w=Z(59,N)):R=function(k){T.push(k)},e&&R(e&255),N=p.length,e=0;e<N;e++)R(p[e])},E,V0=function(R,N,p){if("object"==(p=typeof R,p))if(R){if(R instanceof Array)re
2024-04-26 17:19:05 UTC	1255	IN	Data Raw: 37 2c 28 4b 28 33 33 36 2c 52 2c 28 4b 28 34 38 35 2c 28 4b 28 28 64 28 35 35 2c 52 2c 28 4b 28 28 64 28 28 64 28 35 30 33 2c 52 2c 28 4b 28 31 32 37 2c 28 64 28 32 39 38 2c 52 2c 63 28 28 4b 28 34 31 38 2c 52 2c 28 4b 28 33 37 2c 52 2c 28 64 28 28 64 28 33 30 31 2c 52 2c 28 64 28 31 36 37 2c 28 4b 28 28 64 28 35 39 2c 52 2c 5b 30 2c 28 4b 28 31 37 31 2c 52 2c 28 4b 28 32 35 2c 28 4b 28 31 31 37 2c 28 4b 28 31 35 33 2c 52 2c 28 64 28 31 36 33 2c 52 2c 28 64 28 33 33 31 2c 28 64 28 34 33 38 2c 52 2c 28 52 2e 61 79 3d 28 4e 3d 28 28 52 2e 57 4f 3d 32 35 2c 52 29 2e 53 3d 28 52 2e 50 3d 5b 5d 2c 28 52 2e 54 3d 28 52 2e 6a 3d 66 61 6c 73 65 2c 52 29 2c 52 29 2e 4c 43 3d 30 2c 52 2e 5a 3d 28 28 28 28 52 2e 73 3d 30 2c 52 2e 59 3d 76 6f 69 64 20 30 2c 52 2e 42 Data Ascii: 7,(K(336,R,(K(485,(K((d(55,R,(K((d((d(503,R,(K(127,(d(298,R,c((K(418,R,(K(37,R,(d((d(301,R,(d(167,(K((d(59,R,[0,(K(171,R,(K(25,(K(117,(K(153,R,(d(163,R,(d(331,(d(438,R,(R.ay=(N=((R.WO=25,R).S=(R.P=[],(R.T=(R.j=false,R),R).LC=0,R.Z=((((R.s=0,R.Y=void 0,R.B
2024-04-26 17:19:05 UTC	1255	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 29 7b 64 28 28 66 3d 28 61 3d 56 28 28 79 3d 56 28 50 29 2c 50 29 29 2c 56 29 28 50 29 2c 66 29 2c 50 2c 5a 28 79 2c 50 29 7c 7c 5a 28 61 2c 50 29 29 7d 29 2c 39 34 31 29 29 2c 34 34 29 2c 52 2c 72 29 2c 31 37 29 2c 52 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 29 7b 21 58 28 66 2c 74 72 75 65 2c 66 61 6c 73 65 2c 50 29 26 26 28 66 3d 54 32 28 50 29 2c 61 3d 66 2e 73 52 2c 79 3d 66 2e 6e 43 2c 50 2e 54 3d 3d 50 7c 7c 61 3d 3d 50 2e 5a 55 26 26 79 3d 3d 50 29 26 26 28 64 28 66 2e 7a 73 2c 50 2c 61 2e 61 70 70 6c 79 28 79 2c 66 2e 67 29 29 2c 50 2e 41 3d 50 2e 4e 28 29 29 7d 29 2c 30 29 29 2c 35 30 38 29 2c 52 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 2c 74 2c 47 2c 53 2c 43 2c 62 2c 42 2c 59 Data Ascii: function(P,f,y,a){d((f=(a=V((y=V(P),P)),V)(P),f),P,Z(y,P)\|\|Z(a,P))}),941)),44),R,r),17),R,function(P,f,y,a){!X(f,true,false,P)&&(f=T2(P),a=f.sR,y=f.nC,P.T==P\|\|a==P.ZU&&y==P)&&(d(f.zs,P,a.apply(y,f.g)),P.A=P.N())}),0)),508),R,function(P,f,y,a,t,G,S,C,b,B,Y
2024-04-26 17:19:05 UTC	1255	IN	Data Raw: 29 2c 50 29 29 2c 56 29 28 50 29 2c 5a 28 66 2c 50 29 29 2c 74 29 2c 50 29 2c 5a 28 53 2c 50 29 29 2c 79 3d 5a 28 79 2c 50 29 2c 53 29 29 29 7b 66 6f 72 28 61 20 69 6e 20 47 3d 5b 5d 2c 53 29 47 2e 70 75 73 68 28 61 29 3b 53 3d 47 7d 69 66 28 50 2e 54 3d 3d 50 29 66 6f 72 28 66 3d 30 3c 66 3f 66 3a 31 2c 50 3d 53 2e 6c 65 6e 67 74 68 2c 61 3d 30 3b 61 3c 50 3b 61 2b 3d 66 29 74 28 53 2e 73 6c 69 63 65 28 61 2c 28 61 7c 30 29 2b 28 66 7c 30 29 29 2c 79 29 7d 7d 29 2c 52 29 2e 48 4f 3d 30 2c 52 29 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 66 2c 79 2c 61 29 7b 28 61 3d 56 28 28 79 3d 28 66 3d 56 28 50 29 2c 56 28 50 29 29 2c 50 29 29 2c 50 2e 54 3d 3d 50 29 26 26 28 79 3d 5a 28 79 2c 50 29 2c 61 3d 5a 28 61 2c 50 29 2c 5a 28 66 2c 50 29 5b 79 5d 3d 61 2c 32 34 37 Data Ascii: ),P)),V)(P),Z(f,P)),t),P),Z(S,P)),y=Z(y,P),S))){for(a in G=[],S)G.push(a);S=G}if(P.T==P)for(f=0<f?f:1,P=S.length,a=0;a<P;a+=f)t(S.slice(a,(a\|0)+(f\|0)),y)}}),R).HO=0,R),function(P,f,y,a){(a=V((y=(f=V(P),V(P)),P)),P.T==P)&&(y=Z(y,P),a=Z(a,P),Z(f,P)[y]=a,247
2024-04-26 17:19:05 UTC	1255	IN	Data Raw: 6e 5b 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4e 7d 2c 28 52 28 66 75 6e 63 74 69 6f 6e 28 70 29 7b 70 28 4e 29 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 5d 7d 2c 72 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 49 65 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 2c 65 29 7b 72 65 74 75 72 6e 20 5a 28 28 64 28 34 33 38 2c 52 2c 28 46 79 28 4e 2c 28 28 65 3d 5a 28 34 33 38 2c 52 29 2c 52 2e 50 29 26 26 65 3c 52 2e 73 3f 28 64 28 34 33 38 2c 52 2c 52 2e 73 29 2c 5a 65 28 52 2c 70 29 29 3a 64 28 34 33 38 2c 52 2c 70 29 2c 52 29 29 2c 65 29 29 2c 32 36 31 29 2c 52 29 7d 2c 4e 5f 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 29 7b 72 65 74 75 72 6e 28 70 3d 6c 5b 4e 2e 57 5d 28 4e 2e 4f 52 29 2c 70 5b 4e 2e 57 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 Data Ascii: n[function(){return N},(R(function(p){p(N)}),function(){})]},r=this\|\|self,Ie=function(R,N,p,e){return Z((d(438,R,(Fy(N,((e=Z(438,R),R.P)&&e<R.s?(d(438,R,R.s),Ze(R,p)):d(438,R,p),R)),e)),261),R)},N_=function(R,N,p){return(p=l[N.W](N.OR),p[N.W]=function(){r
2024-04-26 17:19:05 UTC	1255	IN	Data Raw: 4e 5d 7c 30 29 2d 28 52 5b 28 28 4e 7c 30 29 2b 31 29 25 33 5d 7c 30 29 2d 28 65 7c 30 29 5e 28 31 3d 3d 4e 3f 65 3c 3c 70 3a 65 3e 3e 3e 70 29 7d 63 61 74 63 68 28 77 29 7b 74 68 72 6f 77 20 77 3b 7d 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 2c 70 2c 65 2c 77 2c 54 29 7b 69 66 28 21 70 2e 72 69 26 26 28 54 3d 76 6f 69 64 20 30 2c 4e 26 26 4e 5b 30 5d 3d 3d 3d 4d 26 26 28 54 3d 4e 5b 32 5d 2c 52 3d 4e 5b 31 5d 2c 4e 3d 76 6f 69 64 20 30 29 2c 65 3d 5a 28 31 37 32 2c 70 29 2c 30 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 28 77 3d 5a 28 33 33 31 2c 70 29 3e 3e 33 2c 65 2e 70 75 73 68 28 52 2c 77 3e 3e 38 26 32 35 35 2c 77 26 32 35 35 29 2c 76 6f 69 64 20 30 21 3d 54 26 26 65 2e 70 75 73 68 28 54 26 32 35 35 29 29 2c 52 3d 22 22 2c 4e 26 26 28 4e 2e 6d 65 73 Data Ascii: N]\|0)-(R[((N\|0)+1)%3]\|0)-(e\|0)^(1==N?e<<p:e>>>p)}catch(w){throw w;}},n=function(R,N,p,e,w,T){if(!p.ri&&(T=void 0,N&&N[0]===M&&(T=N[2],R=N[1],N=void 0),e=Z(172,p),0==e.length&&(w=Z(331,p)>>3,e.push(R,w>>8&255,w&255),void 0!=T&&e.push(T&255)),R="",N&&(N.mes
2024-04-26 17:19:05 UTC	1255	IN	Data Raw: 2e 41 3d 54 3b 69 66 28 21 6b 7c 7c 54 2d 65 2e 43 3c 65 2e 42 4f 2d 28 70 3f 32 35 35 3a 4e 3f 35 3a 32 29 29 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 72 65 74 75 72 6e 20 65 2e 5a 3d 28 64 28 34 33 38 2c 28 70 3d 5a 28 28 65 2e 74 54 3d 52 2c 4e 29 3f 33 33 31 3a 34 33 38 2c 65 29 2c 65 29 2c 65 2e 73 29 2c 65 2e 56 2e 70 75 73 68 28 5b 69 47 2c 70 2c 4e 3f 52 2b 31 3a 52 2c 65 2e 44 2c 65 2e 6a 2c 65 2e 76 2c 65 2e 69 5d 29 2c 44 65 29 2c 74 72 75 65 7d 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 52 2c 4e 29 7b 4e 2e 42 3d 28 28 4e 2e 42 3f 4e 2e 42 2b 22 7e 22 3a 22 45 3a 22 29 2b 52 2e 6d 65 73 73 61 67 65 2b 22 3a 22 2b 52 2e 73 74 61 63 6b 29 2e 73 6c 69 63 65 28 30 2c 32 30 34 38 29 7d 2c 44 65 3d 72 2e 72 65 71 75 65 73 74 49 64 6c 65 43 61 6c 6c 62 61 63 Data Ascii: .A=T;if(!k\|\|T-e.C<e.BO-(p?255:N?5:2))return false;return e.Z=(d(438,(p=Z((e.tT=R,N)?331:438,e),e),e.s),e.V.push([iG,p,N?R+1:R,e.D,e.j,e.v,e.i]),De),true},H=function(R,N){N.B=((N.B?N.B+"~":"E:")+R.message+":"+R.stack).slice(0,2048)},De=r.requestIdleCallbac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49748	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:19:06 UTC	1650	OUT	GET /recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
2024-04-26 17:19:06 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Apr 2024 17:19:06 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-6Phh0N8-K2jlmkCpqVzMKg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 17:19:06 UTC	364	IN	Data Raw: 31 64 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 Data Ascii: 1d14<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face
2024-04-26 17:19:06 UTC	1255	IN	Data Raw: 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e Data Ascii: v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fon
2024-04-26 17:19:06 UTC	1255	IN	Data Raw: 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 Data Ascii: 20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E0
2024-04-26 17:19:06 UTC	1255	IN	Data Raw: 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b Data Ascii: U+04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-26 17:19:06 UTC	1255	IN	Data Raw: 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b Data Ascii: ce { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+
2024-04-26 17:19:06 UTC	1255	IN	Data Raw: 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 Data Ascii: tic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight
2024-04-26 17:19:06 UTC	813	IN	Data Raw: 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 56 36 5f 38 35 71 70 63 32 58 66 32 73 62 65 33 78 54 6e 52 74 65 37 6d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 36 50 68 68 30 4e 38 2d 4b 32 6a 6c 6d 6b 43 70 71 56 7a 4d 4b 67 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f Data Ascii: }</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css"><script nonce="6Phh0N8-K2jlmkCpqVzMKg" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.co
2024-04-26 17:19:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49749	142.250.217.196	443	5404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:19:06 UTC	1461	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQj5wNQVCMGezSIY2IbOARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dnyt%2Bconnections%2Bhints%2Bapril%2B26%26oq%3D%26gs_lcrp%3DEgZjaHJvbWUqDggCEAAYAxhCGI8BGOoCMgwIABAuGAMYjwEY6gIyDggBEAAYAxhCGI8BGOoCMg4IAhAAGAMYQhiPARjqAjIOCAMQABgDGEIYjwEY6gIyDggEEAAYAxhCGI8BGOoCMg4IBRAAGAMYQhiPARjqAjIOCAYQABgDGEIYjwEY6gIyDggHEAAYAxhCGI8BGOoC0gEKMjEzMDE2ajBqN6gCCLACAQ%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRmgZjcGILEr7EGIjDYWZjKno5JvCWZFz_8l_wfRjhUucocyKy4RSU_MxZIiCKq2ngkq1Rr5-2EKs1dAfoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-17; NID=513=GNTiojWSaGrM32c-UmrVkHUP350m5hQ6C0kM0aAuxAXXt5jUlXr1UyC05l-78yOhHw7i2evzQIoeghsPuWLsbeCLx2mslDJLkEUVJjL8X5cfPo8_A5PEPrwk0ASlacnacEnWY8eesD6AOA2CPhdDH6TLxX-JdCZFG4B8b0shr9A; AEC=AQTF6HyUHE_JpRWjc8spBywq_7mt4hpzTZ6nIcTdZM1_ksA8-ooLPc8_ww
2024-04-26 17:19:07 UTC	706	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 26 Apr 2024 06:30:51 GMT Expires: Sat, 04 May 2024 06:30:51 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 38896 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 17:19:07 UTC	549	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-04-26 17:19:07 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C;I
2024-04-26 17:19:07 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4S4S
2024-04-26 17:19:07 UTC	1255	IN	Data Raw: ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-04-26 17:19:07 UTC	1116	IN	Data Raw: 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 7020, Parent PID: 3548

General

Target ID:	0
Start time:	19:17:16
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w=
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6164, Parent PID: 7020

General

Target ID:	1
Start time:	19:17:16
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1936,i,2990256087952315808,2795152919663852828,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7140, Parent PID: 804

General

Target ID:	12
Start time:	19:17:42
Start date:	26/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff6b9240000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5484, Parent PID: 4380

General

Target ID:	16
Start time:	19:18:46
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5404, Parent PID: 5484

General

Target ID:	17
Start time:	19:18:47
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2044,i,10422334157882643257,4372687792267405033,262144 /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w=

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
http://kra.ndml.in/kra-web/Mail/ENEDpDME_ddRnXxVc50cpgYEG3w8mclx4APm6ShyCOrrvM6hBqc3-5vCvQN-X5XN/Pbpp1LlByBKEzvjWvaUdYAoxoxNWtNmpdPLEflzCf0nTwIx6mcECpQ==/PhKsGuPve2w=